Ztruker (signs posts: Rich) said to post here because he suspects I "you have something that is calling-home. And it may not be a good-guy."
Here are the posts from Software > Microsoft Windows:
Jul 19 2010, 11:53 AM Post #1
It's taking over a minute for a file to open or for the box to appear after I right click. It just hangs with the hourglass cursor until it finally responds. I know this isn't normal. So what's causing it?
Anyone, anyone, …Bueller, Bueller
Jul 19 2010, 07:28 PM Post #2
Is it only when opening files that it's slow or is everything slow?
What does Task Manager show for CPU utilization under the Process Tab and what doe the Performance tab look like?
For CPU utilization, after clicking on the Process tab, click the CPU heading at the top of the column twice. The first time it sorts in ascending order, then next in descending order which shows you the processes using the most CPU cycles at the top.
Open Task Manager (right click on the TaskBar and select Task Manager) and move it to one side or the other so you can see it when you open Windows Explorer. Click on the Process tab and sort as above, then try opening a file, see what comes to the top. Also look at the Performance tab.
If you want, post screen captures of those windows here:
How to capture screen images (screen shots), Windows Made Easy>
How to upload an Image into your Thread, Windows Made Easy
——————–
Rich
Yesterday, 10:24 AM Post #3
Mostly opening files & Firefox takes a long time to open as well. Double clicking a file in M Documents takes over a minute to finally open.
Process tab: System Idle process high 70 - mid 90.
Performance Tab: CPU Usage 4 -16%
PF usage: 710 mb
Yesterday, 07:07 PM Post #4
That doesn't sound bad. How does it behave if you boot to Safe Mode with Networking? If better then something is starting at boot that is causing the problem.
Use msconfig to determine what is causing the problem.
Click on Start then Run, type msconfig and press Enter.
Click on the Startup tab, record what is currently starting then click the Disable All button.
Reboot and see if it runs normal.
If yes then use msconfig to enable several items at a time till you find the culprit.
If no, boot to Safe Mode again, start msconfig and click on the Services tab.
Check the Hide All Microsoft Services box, record what is currently starting then click the Disable All button.
Again, do a regular boot, see if it runs normal.
If yes then use msconfig to enable services till you find the culprit.
Once you've found the culprit, uninstall it or find out how to eliminate it from your system.
Simply disabling it in msconfig is a temporary fix at best.
Enable everything else you disabled.
——————–
Rich
Today, 06:44 PM Post #5
Rich,
I began to follow your instruction when I discovered something interesting that i have to assume is relevant. I didn't want to be connected to the internet if I was going to disable everything that was running because I was afraid that I would be shutting down my protection programs (McAfee). I didn't want to be connected to internet w/o McAfee running so I pulled the Ethernet cable out from the back of my CPU. I discovered that with the Ethernet cable disconnected files in MY Documents (doc, pdf) opened only after a few seconds like normal. Then when i plugged the cable back in, the same files would take over a minute to open. I never got to the part where I was supposed to reboot to see if it ran normal w/ everything disabled. I figured being connected to the internet must have something to do with the problem, but it shouldn't. I'm pretty sure I should be able to be connect to the internet and have files open fast, right?
Thanks,
Rod
5 minutes ago Post #6
Good observation, Rush4Rod.
Head on over to Virus, Spyware, Infections Removal. Forum.
I found this here: http://www.mvps.org/winhelp2002/hosts.htm
Is this relevant?
What it does …
The Hosts file contains the mappings of IP addresses to host names. This file is loaded into memory (cache) at startup, then Windows checks the Hosts file before it queries any DNS servers, which enables it to override addresses in the DNS. This prevents access to the listed sites by redirecting any connection attempts back to the local (your) machine. Another feature of the HOSTS file is its ability to block other applications from connecting to the Internet, providing the entry exists.
You can use a HOSTS file to block ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and even most hijackers. This is accomplished by blocking the connection(s) that supplies these little gems.
Example - the following entry 127.0.0.1 ad.doubleclick.net blocks all files supplied by that DoubleClick Server to the web page you are viewing. This also prevents the server from tracking your movements. Why? … because in certain cases "Ad Servers" like Doubleclick (and many others) will try silently to open a separate connection on the webpage you are viewing, record your movements then yes … follow you to additional sites you may visit.
In many cases using a well designed HOSTS file can speed the loading of web pages by not having to wait for these ads, annoying banners, hit counters, etc. to load. This also helps to protect your Privacy and Security by blocking sites that may track your viewing habits, also known as "click-thru tracking" or Data Miners. Simply using a HOSTS file is not a cure-all against all the dangers on the Internet, but it does provide another very effective "Layer of Protection".
For Windows XP SP2 users you should see a Security Center prompt about allowing this connection. [screenshot]
Simply click No and continue. Yes the prompts can be annoying but at least you'll know, however you should not see these prompts if these entries are included in the HOSTS file.
Note: this prompt only occurs if (example) *.doubleclick.net is included in the "Restricted Zone".
More Examples
AdTech | BridgeTrack | Honesty | Mgnetwork | ValueClick | Google AdSense | Atdmt | Atdmt
Now here is a 3rd party ad server opening a connection to another 3rd party ad server - Ad-Flow
More 3rd parties opening other 3rd parties: Overture | Overture | Directtrack | Directtrack | RealMedia
Note: By placing these type sites in the Restricted Zone this also cures most "Back Button" issues.
MVPS HOSTS now includes most major parasites, hijackers and unwanted Adware/Spyware programs!
Proudly now the #1 rated HOSTS file on the Internet! - Google | MSN | Yahoo | AltaVista
Now regularly featured on the Kim Komando Radio Show
The MVPS HOSTS file has been selected by Pricelessware as "the best of the best in Freeware" for the 2nd time …
Editors Note: As time has progressed the focus of this project has changed from just blocking ads/banners to protecting the user from the many parasites that now exist on the Internet. It doesn't serve much purpose if you block the ad banner from displaying as most other HOSTS files do, but get hijacked by a parasite from an evil exploit or download contained on the web site. The object is to surf faster while preserving your Safety, Security and Privacy. [more info]
To view the HOSTS file in plain text form. (596 kb) (opens in browser)
Note: The text version also makes a terrific searchable reference for determining possible unwanted connections
Download: hosts.zip [right-click - Select: Save Target As] [Updated July-15-2010]
This download includes a simple batch file (mvps.bat) that will rename the existing HOSTS file to HOSTS.MVP then copy the included updated HOSTS file to the proper location. For more information please see the readme.txt included in the download.
Important! Windows Vista requires special instructions Not here - over there > see here
Important! Windows 7 requires special instructions Not here - over there > see here
When you run the (mvps.bat) batch file XP users may see a prompt, simply click Run and continue. Once updated you should see another prompt that the task was completed. Some users may see a pop-up from certain Security programs about changes to the HOSTS file. Allow the change … however if you see this pop-up at any other time … investigate.
Download Information: (checksum info is on the HOSTS file not the "hosts.zip")
MD5: 34C24CAB47239616A52D64D0B6E43739 SHA-1: 28A4353610F1E97C6B588EFB2736EAC52D0C32EF
Manual Install Method - Unzip in a "temp" folder and place in the appropriate installed location:
* If you are having trouble downloading or extracting the HOSTS file [click here]
Note: the below locations are for the typical default paths, edit as needed.
Windows 7/Vista/XP = C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K = C:\WINNT\SYSTEM32\DRIVERS\ETC
The actual location is defined by the following Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath
There is no need to turn on, adjust or change any settings with the exception of the DNS Client service (see below). Windows automatically looks for the existence of a HOSTS file and if found, checks the HOSTS file first for entries to the web page you just requested. The 127.0.0.1 is considered the location of your computer, so when the entry (example) "ad.doubleclick.net" is requested your computer thinks 127.0.0.1 is the location of the file. When this file is not located it skips onto the next file and thus the ad server is blocked from loading the banner, Cookie, or some unscrupulous ActiveX, or javascript file.
In case you're wondering … this all happens in microseconds, which is much faster than trying to fetch a file from half way around the world. Another great feature of the HOSTS file is that it is a two-way file, meaning if some parasite does get into your system (usually bundled with other products) the culprit can not get out (call home) as long as the necessary entries exist. This is why it's important to keep your HOSTS file up to Date.
Editors Note: in most cases a large HOSTS file (over 135 kb) tends to slow down the machine.
To resolve this issue (manually) open the "Services Editor"
* Start | Run (type) "services.msc" (no quotes)
* Scroll down to "DNS Client", Right-click and select: Properties - click Stop
* Click the drop-down arrow for "Startup type"
* Select: Manual (recommended) or Disabled click Apply/Ok and restart. [more info]
When set to Manual you can see that the above "Service" is not needed (after a little browsing - when set to Manual) by opening the Services Editor again, scroll down to DNS Client and check the "Status" column. It should be blank, if it was needed it would show "Started" in that column. There are several Utilities that can reset the DNS Client for you … [more info]
Editors Note: The above instructions are intended for a single (home-user) PC. If your machine is part of a "Domain", check with your IT Dept. before applying this work-around. This especially applies to Laptop users who travel or bring their work machines home. Make sure to reset the Service (if needed) prior to connecting (reboot required) to your work Domain …
Important! If you are using Network Discovery then the DNS Client service is required and should not be set to either Manual or Disabled.
Possible Workaround for using the MVPS HOSTS file and leaving the DNS Client service enabled (set to: Automatic)
* If you find after a period of time that your browser seems sluggish with the DNS Client service enabled you can manually flush the DNS cache
* Close all browser windows … open a "Command Prompt" from the Start Menu > All Programs > Accessories > Command Prompt
* (type) ipconfig /flushdns (press Enter) Then close the Command Prompt …
A better Win7/Vista workaround would be to add two Registry entries to control the amount of time the DNS cache is saved.
* Flush the existing DNS cache (see above)
* Start > Run (type) regedit
* Navigate to the following location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
* Click Edit > New > DWORD Value (type) MaxCacheTtl
* Click Edit > New > DWORD Value (type) MaxNegativeCacheTtl
* Next right-click on the MaxCacheTtl entry (right pane) and select: Modify and change the value to 1
* The MaxNegativeCacheTtl entry should already have a value of 0 (leave it that way - see screenshot)
* Close Regedit and reboot …
* As usual you should always backup your Registry before editing … see Regedit Help under "Exporting Registry files"
JBF sends along this Tip: IPCOP running a DHCP server needs the DNS Client enabled to function.
Reset the DNS Client with a simple batch file (submitted by: Ronny Ong - 2K/XP only)
DnsManual.bat (resets the DNS Client to Manual) [right-click and select: Save Target As]
DnsDisabled.bat (resets the DNS Client to Disabled) [right-click and select: Save Target As]
To use: double-click on the downloaded file and reboot that's it …
For all other Questions, Issues and Solutions - see: The HOSTS File FAQ
For detailed Download and Extract Instructions - see: Download Help
How To Uninstall the MVPS HOSTS file
I did the following but It did resolve the problem:
[Install Instructions for using the included Installer (98/ME/2K/XP)]
You may use the included batch file "mvps.bat" to copy the included HOSTS file to the proper
location on your machine. This batch file will backup the existing HOSTS file prior to copying
the updated version. The backed-up file will be renamed to HOSTS.MVP.
To use: double-click on mvps.bat
***********************************************
Note: if prompted by one of your Security programs about this file, allow it to run. Also if
you are prompted by a Security program about changes to the HOSTS file = allow them.
***********************************************
[Important Notice - 2K/XP/Vista/Win7 Users]
In most cases a large HOSTS file (over 135 kb) tends to slow down the machine. This only occurs
in 2K/XP/Vista. Windows 98 and Windows ME are not affected.
To resolve this issue (manually) open the "Services Editor"
Start | Run (type) "services.msc" (no quotes)
Scroll down to "DNS Client", Right-click and select: Properties
Click the drop-down arrow for "Startup type"
Select: Manual, click Apply/Ok and restart.
I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.
_________________________________________________
Please do the following:
Please download DDS by sUBs from one of the following links and save it to your desktop.
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.
—————————————————
Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
—————————————————
Please include the contents of the following in your next reply:
DDS.txt
Please attach the second file; Attach.txt. To attach a file, do the following:
Under the reply panel is the Attachments Panel.
Browse for the attachment file you want to upload, then click the green Upload button.
Once it has uploaded, click the Manage Current Attachments drop down box.
Click on to insert the attachment into your post
Please post both DDS logs in your next reply.
–Next–
[external image: Posted Image]
Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one) [external image: Posted Image] Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.
To post in your next reply:
1. DDS logs.
2. GMER log.
I downloaded GMER again and ran it. This time the BSOD stayed on. I took photos of the BSOD, but it's too big to upload 3700K. Here's a transcription:
A problem has been detected and windows has been shut down to prevent damage to your computer.
The problem seems to be caused by the following file: kgtiikow.sys
PAGE_FAULT_IN _NONPAGED_AREA
If this is the first time time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow these steps :
Check to make sure any new hardware or software is properly installed.
if this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.
If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advances Startup Options, and then select Safe Mode.
Technical Information :
*** STOP: 0x00000050 (0xECD88B30, 0x00000001, 0xECC45FA6, 0x00000000)
*** kgtiikow.sys - Address ECC45FA6 base at ECC3A000, DateStamp 4b274f8d
Beginning dump of physical memory
Physical memory dump complete
Contact your system administrator or technical support group for further assistance.
——————————————————————————————————————————————————————————-
That's it. Phew!! I had to type that out. I have the photo of the BSOD if you ever want it.
Also after i restarted my computer I got the same error message as the other times:
The system has recovered from a serious error.
Please tell Microsoft about this problem.
Error Signature
BCCode : 10000050 BCP1 : ECD88B30 BCP2 : 00000001 BCP3 : ECC45FA6
BCP4 : 00000000 OSVer : 5_1_2600 SP : 3_0 Product : 256_1
Error Report contents
The following files will be included in this error report:
C:\DOCUME~1\Rod\LOCALS~1\Temp\WER421c.dir00\Mini072410-03.dmp
C:\DOCUME~1\Rod\LOCALS~1\Temp\WER421c.dir00\sysdata.xml
Send Report Don't Send
Also, you're 15 hours ahead of me and we never seem to be logged on simultaneously. It's not necessarily a problem but it's like playing chess through the mail. It's Monday 3:30 am there now local time for you. You're previous post were made during your local time week end. I don't know your work schedule and can only assume that you may post a reply this evening for you local time. Your 6pm-9pm is my 3am-6am & my 6pm-9pm is your 12pm-3pm & when I assume your at work. So I guess it will just be slow going which is not so great for me <>.
The real problem is that I will be leaving town this Sunday evening, (12 pm Monday for you) and wont be returning until Tues. 8/3/10 around 2 pm ( Wed. 8/4/10, 5am for you). Does that mean this topic will be closed after 3 days without a reply or can we pick it up from where ever we left off?
Thanks
Yes we are on a very different time zone but rest assured that am doing my best to reply promptly.
Since you've already notified me regarding your absence then this topic will not be closed and we'll continue to where we left off.
Please do the following:
Please read through these instructions to familiarize yourself with what to expect when this tool runs
Download ComboFix from one of these locations:
Link 1 Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
——————————————————————– IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Thanks. I have no doubt that you will do your best to reply promptly.
When I return home on Next Tuesday I'll download and run Combo Fix.
Did you find anything in the DDS log, Attach log, & Rootkit Unhooker Report ? What about THE BSOD transcript.
Rod
