HELP poor Heresson with otmans and ofants

[Heresson]

To get internet connection, I had to install some silly program. After I got it, Windows demanded installing 18+ updates, so I did it (I didn't have internet connection in this comp for a year or more).

Now

1) Almost every time I load windows, just at the start explorer crashes, but then it works fine
2) From time to time some other thing pops-up, claiming some strange dos-like thing is located somewhere, blah blah blah, I will write it down.
3) the most annoying - I can not use Word, because after a while it writes that Word can not open blah blah file, I must re-establish internet connection of put a diskette in. And it is the end of this word session.

Thanks to that info, I managed to discover that it's about reduction of efficiency of the files' server or something like that:

http://support.microsoft.com/kb/822219/pl

here is the relevant support page in polish.
and in english

http://support.microsoft.com/kb/822219/br

so I need to do something about ofant.sys and otman.sys

BUT I DUNNO HOW and stuff.

Help me

[Heresson]

I have Windows XP, btw.

[Grandpa Troll]

Originally posted by Heresson
I have Windows XP, btw.

Did you try posting in the tech forum, they are usually very helpful

[Fake Boris]

Boot in safe mode and revert back to a previous state of your install?

[Heresson]

Someone plz move it to Tech Forum

• When you try to open a Microsoft Word file, you may receive the following error message:
Word failed reading from this file file_name. Please restore the network connection or replace the floppy disk and retry.
Additionally, the following event may be logged in the System log on the client computer:
Type: Warning
Source: MrxSmb
Event ID: 50
Description: {Lost Delayed-Write-Data} The system was attempting to transfer file data from buffers to \Device\LanmanRedirector. The write operation failed, and only some of the data may have been written to the file.

Back to the top

CAUSE
This issue may occur if a non-Microsoft program that is installed on your computer uses an outdated kernel-mode filter driver. The kernel-mode filter driver may be outdated if the following conditions are true: • One of the following programs is installed on the computer: • ARCserve Backup Agent for Open Files or ARCserve Open File Agent from Computer Associates International, Inc. is installed on your computer, and the Ofant.sys driver for the program is outdated.
• Open Transaction Manager is installed on your computer, and the Otman.sys driver for the program is outdated.

Note Open Transaction Manager is included with certain programs from VERITAS Software Corporation, but it can also be installed separately from the VERITAS program. For example, Open Transaction Manager may be included with Open File Option. This program may be included with VERITAS Backup Exec.
• A VERITAS program that uses the Otman4.sys or Otman5.sys driver (such as Open File Option) is installed on your computer, and the Otman4.sys or Otman5.sys driver for the program is outdated.

• The driver for the program is incompatible with the filter driver that is installed on the computer by a non-Microsoft antivirus program. As a result, the filter driver on the server may return an incorrect status code to the Server service. For example, the filter driver may return a STATUS_SUCCESS code instead of a STATUS_OPLOCK_BREAK_IN_PROGRESS code.

Back to the top

RESOLUTION
To resolve this issue, contact the manufacturer of the program to inquire about the availability of a filter driver update. For more information about how to contact Computer Associates to obtain the latest update for the Ofant.sys driver, visit the following Computer Associates Web site:
http://www.ca.com/support/ (http://www.ca.com/support/)
If you installed Open Transaction Manager separately, contact Columbia Data Products, Inc. to inquire about the availability of an update that may resolve this issue. To contact Columbia Data Products, visit the following Columbia Data Products Web site:
http://www.cdp.com/ (http://www.cdp.com/)
For more information about how to contact VERITAS, visit the following VERITAS Web site:
http://support.veritas.com/ (http://support.veritas.com/)
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
Back to the top

MORE INFORMATION
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows


To temporarily work around this issue, restart the Server services on the server. To restart the Server services, follow these steps: 1. Click Start, and then click Run.
2. In the Open box, type cmd, and then click OK.
3. At the command prompt, type the following lines, and press ENTER after each line:
net stop server
net start server
To troubleshoot this issue, use any of the following methods: • Use Performance Logs and Alerts to monitor theAvg. Disk Queue Length counter of the PhysicalDisk performance object. Under ordinary conditions, the number of waiting input/output (I/O) requests is typically no more than 1.5 to 2 times the number of spindles that the physical disk has. Most disks have one spindle, although redundant array of independent disks (RAID) devices typically have more than one spindle. When a program runs small successive I/O operations, you see a spike in the Current Disk Queue Length counter when I/O-bound operations are queued. You may also see an increase in the Context Switches/sec counter of the System performance object.
• Disable opportunistic locking on either the client or on the server. To disable opportunistic locking on the client, set the following registry value to 1:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\MRXSmb\Parameters\OplocksDisabled
To disable opportunistic locking on the server, set the following registry value to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\LanmanServer\Parameters\EnableOplocks
For more information about how to disable opportunistic locking, click the following article number to view the article in the Microsoft Knowledge Base:
296264 (http://support.microsoft.com/kb/296264/) Configuring opportunistic locking in Windows
• Use the Microsoft Configuration Capture Utility (MPS_REPORTS) to determine the version of the filter driver that is installed on your computer.

For more information about the Microsoft Configuration Capture Utility, click the following article number to view the article in the Microsoft Knowledge Base:
818742 (http://support.microsoft.com/kb/818742/) Overview of the Microsoft Configuration Capture Utility (MPS_REPORTS)
• Edit the registry to temporarily deactivate the filter driver.

For more information about how to temporarily deactivate the kernel-mode filter driver, click the following article number to view the article in the Microsoft Knowledge Base:
816071 (http://support.microsoft.com/kb/816071/) How to temporarily deactivate the kernel mode filter driver in Windows
The registry key that stores information for the Ofant.sys driver is Ofadriver.

Back to the top

[Mercator]

Are any of the programs mentioned under "CAUSE" actually installed on your computer, and if so which one(s)?

Could you uninstall them, or do you actually use them?

[Heresson]

How do I check it?
In the msconfig, I've found Microsoft / Veritas program, it is called Logical Disc Manager Administrative Service.
It sounds very official and important, therefore I'm afraid to turn it off What does it do? Should I try turning it off?

Thank You.

[Heresson]

Perhaps I should mail this Veritas company about my problem? Would they help me?

[Heresson]

Apart from that, I tried to download a new anti-virus kit, and when I launch setup, it has to close.
When I tried downloading an upgrade to something else, it told me the file is corrupt.
I tried downloading firefox, and it told me the file is corrupt as well. It seems I can not download any program.

[Mercator]

I have that logical disk manager thing too... I don't seem to have any otmans or ofants on my system, though.

You'd better come up with some more details on the error messages you're getting, because I have no idea.

[Heresson]

here's a log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:15:36, on 2008-10-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\admServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\lvcomsx.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\DOCUME~1\ZDZIS£~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Acer\OrbiCam\VideoEffectsWatcher.exe
C:\Documents and Settings\Zdzis³awa\Desktop\putty_ssh.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Zdzis³awa\Desktop\ComboFix.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\HPZipm12.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\sw g.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaSt udioAgent.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Wyœlij do urz¹dzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{90B29E79-6464-4D59-A29B-8940EC975810}: NameServer = 194.204.152.34,194.204.159.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 11371 bytes

[Mercator]

Hmmm, I see a lot of stuff in there that could slow your system down, but most of it seems to be drivers and other nonsense hardware manufacturers insist on having running all the time. I'm not sure how much of that you can safely lose...

But you should at least try unchecking all the boxes in the Startup tab of MSCONFIG. See if that improves anything. If Windows doesn't start properly I think it turns them back on again. Otherwise you can switch them back on yourself next time if it doesn't help...

Also try switching off all non-Microsoft services. Again, you can switch them back (either by restarting normally if it goes really bad, or by restating in safe mode) on if it doesn't help, or makes it worse.

If switching of all those things does solve the instability, but some programs don't work properly anymore, you'll have to try and turn on as few of them as possible. And if you can identify the wrong-doers, uninstall those programs.