(not so)Random Crashes

By TheMackey
Nov 19, 2006
Topic Status:
Not open for further replies.
  1. Alright ive read through the forum and i see a lot of ppl having this problem, ive read all the posts and followed all instructions no matter if i thought it would help or not. I have the "Services.exe was terminated unexpectedly with status code 203" like the others the error code varies from time to time but this is the most common one, then it gives me 60 secs and boots me or freezes me. As the other posts said ive downloaded, updated and ran:
    AVG
    Avert Stinger
    Spybot
    Spyware blaster

    and i own and ran counterspy on my own. ive tried editing a couple (1 or 2) registry keys as it said to on a couple of other forums to no avail. i also ran HJT cause i see it was recommended in most cases, i will post the log in a following string.

    please help im so frustrated...
    ~TheMackey

    my HJT log is to long to post so i attached it to this post here: View attachment 10742

    Also i noticed that when i dont do anything "net" related it wont crash, also it loves to crash when i run firefox, which i thought was to be better than IE.
  2. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Hello and welcome to Techspot.

    Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {348FE907-249E-4C65-A838-F34A193FE1D1} - (no file)

    O2 - BHO: (no name) - {44221C5A-782D-4C87-BC68-83D30B8B922B} - C:\WINDOWS\Cursors\fmcolg.dll (file missing)

    O2 - BHO: (no name) - {CF49F98F-F767-403B-BA88-83C7876B0051} - (no file)

    O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\kurslulo.dll (file missing)

    O9 - Extra button: LanWhoIs - {F96A9D15-8486-414D-9ACE-312197E3364F} - C:\PROGRA~1\LANTRI~1\LanWhoIs\lanwhois.htm (file missing)

    O9 - Extra 'Tools' menuitem: LanWhoIs - {F96A9D15-8486-414D-9ACE-312197E3364F} - C:\PROGRA~1\LANTRI~1\LanWhoIs\lanwhois.htm (file missing)

    O17 - HKLM\System\CCS\Services\Tcpip\..\{6CFAF34F-9CAA-49C5-841C-C61CB0F12D90}: NameServer = 85.255.114.53,85.255.112.84<Only fix this if it doesn`t belong to your ISP.

    Fix all 018-Protocol entries.

    O20 - Winlogon Notify: fmcolg - C:\WINDOWS\Cursors\fmcolg.dll (file missing)

    O20 - Winlogon Notify: style32 - C:\WINDOWS\q77046.dll (file missing)

    O20 - Winlogon Notify: wineij32 - wineij32.dll (file missing)

    O21 - SSODL: Httpssvr - {AE4C5AE0-AB8B-44F4-B2F0-C9474F7F1D71} - C:\WINDOWS\system32\camsys.dll

    Click on the fix checked button.

    Close HJT.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    This is the filepath you need to enter into killbox.

    C:\WINDOWS\system32\camsys.dll

    Once your system has rebooted, turn system restore back on and rehide your protected OS files.

    Now go HERE and follow the instructions for renaming HijackThis.exe. Also, follow the instructions for installing and running AVG Antispyware.

    Post fresh HJT and AVG Antispyware logs As Attachments, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of TheMackey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. TheMackey

    TheMackey Newcomer, in training Topic Starter

    The link for renaming HJT isent linked, its just plain text, could you repost it for me? And thanks for the help, nice and fast reply, you cease to amaze me Howard.
  4. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Sorry mate, I forgot to add the link. Fixed now.

    Regards Howard :)

    This thread is for the use of TheMackey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. TheMackey

    TheMackey Newcomer, in training Topic Starter

    how you do it...

    wow, im so amazed at the speed and accuracy at which you fix ppl's computers, ive never used a message board for my problems before but this one had me stumped and after reading your posts i figured it was my best bet. im about done doin what you said and ill post my results as soon as i get them but i had to take a moment to send a little praise your way, even if it dosent work you still know your way around my pc better than me and its fricken amazing, thanks for the help and keep up the good work.
  6. TheMackey

    TheMackey Newcomer, in training Topic Starter

    Finally Finished

    Ive followed your instructions to the best of my abilities, unfortunatly the dreaded crash window still haunts my pc. As requested ive got new HJT results, i booted into safe mode (Without Networking): View attachment 10766

    I also have the results of HJT while booted normally with nothing but notpad running: View attachment 10765

    I wasent sure what you meant by an AVG virus scan result so i ran the software and came up with these results: View attachment 10767 hope thats what you were looking for.

    Please save my PC
  7. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Have HJT fix this inactive entry.

    O21 - SSODL: Httpssvr - {AE4C5AE0-AB8B-44F4-B2F0-C9474F7F1D71} - C:\WINDOWS\system32\camsys.dll (file missing)

    Other than that, your HJT log is clean.

    Instructions for AVG Antispyware are in this thread HERE.

    Download, install and run the above programme and post the log file.

    Regards Howard :)

    This thread is for the use of TheMackey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.