windows freezes on DDS, spybot SD and sometimes boot

Dear all,

Any help on the below will be much appreciated. I had a problem with malware a few weeks ago, which a kind individual on the spybot forums fixed advised on and removed (thread found here: http://forums.spybot.info/showthread.php?t=63453) . However, the original problems I encountered still exist, as follows:

i) when I run DDS (as you probably know, the diagnosis tool like Hijackthis) the computer freezes in the process (about 5 minutes in);

ii) linked to this, I tried to run Spybot SD and this also crashes; iii) I installed the new BETA version 2, which produced the error messages "Not enough storage space to process this command”;

iii) on booting the computer, the screen sometimes freezes at the beginning of the process of loading the toolbar applications (or background processes).

The details of my computer are: Laptop, Windows XP (Pro) SP3, Genuine Intel CPU, 1.83 GHz, 504MB RAM [around 3/4 years old?]

The problems started to occur after I tried to clean the computer in order to make it faster (it has progressively been getting slower for the past 3 months or so). The programmes I used were COMODO System-Cleaner and Auslogics Registry Defrag. I suspect that I may have inadvertantly damaged some files by using these applications (svchost.exe?).

Any advice or help would be much appreciated.

Best,

Simon

Hiya boymonkey,

Sorry to hear you are having problems with your system, after reading over what Ken has done for you as he said in one post he was a bit concerned about your host files.

For DDS I am not sure of why it will not run or hangs, that would be best for Malware folks to explain it, and as for Beta programs they are what they are beta and it could be problems with the program.

So with that we can try and take a look at your system to see what may or could be done.

• 1. I would like for you to go here and Please Run the PCPitstop Full Tests, here: PCPitstop Full Tests
  
  You must use Internet Explorer as it needs to install an ActiveX program.
  
  Note: Vista/Windows 7 users with UAC must first Right-click IE - Select "Run as Administrator"
  
  If you haven't already registered, Click - Sign up now! (left hand column in User Login)
  
  Register and create a password
  Accept the ActiveX component to allow your machine to run the Full Tests
  Registering and accepting the ActiveX are both SAFE and FREE.
  
  The Full Tests take less than 5 minutes for most machines.
  
  Once you have your Results, please post the URL (the http:// stuff) back here into this thread for review.
  
  Note: Vista/Windows 7 users, please close your instance of IE "Running as Administrator" after you are finished reviewing your Results.
  
  Caution: During the testing of Video Adapter, a variety of patterns, shapes, colors and text are “flashed” onto the users monitor screen. In the many thousands of daily uses of the PCPitstop Full Tests over several years, two individuals who suffer epilepsy experienced discomfort and temporary dizziness when viewing the flashing patterns.
  
  If you know that you are susceptible to photo driven seizure, please look away from your screen during the Video Adapter testing sequence.
  
  Note: The PCPitstop Full Tests Results is a free service, but is supported by various paid product advertisements for utilities that "could" remedy the OP's problem.
  
  Since this site is a "free-help" forum, we do not recommend or endorse purchase of automated utilities, and will assist you in manually correcting any problems and settings necessary to optimize your machine's performance. Ask your questions here. We'll help you walk through any necessary steps.
  
  
  
• 2nd. I need you to download this file to see whats in your Start Up Service. It would also be good to see what is starting when you boot your computer. Install and run CodeStuff Starter. http://codestuff.tripod.com/products_starter.html
  
  Select the Startups tab then click on File, save as plain text.
  
  Copy and paste that info here.

When done with the above, then post the info back here.

Jimbo1

Hi Jimbo,

Thank you for the message and suggestions. I have now run the PC Pitstop tests:

http://www.pcpitstop.com/betapit/sec.asp?conid=24513200

The Startup service text is as follows:

Name,Value,Section,Enabled,Description,Company
"Adobe Reader Speed Launcher",""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"","Registry - Machine Run","1","Adobe Acrobat SpeedLauncher (Adobe Acrobat)","Adobe Systems Incorporated"
"AVG_TRAY","C:\Program Files\AVG\AVG10\avgtray.exe","Registry - Machine Run","1","AVG Tray Monitor (AVG Internet Security)","AVG Technologies CZ, s.r.o."
"ctfmon.exe","C:\WINDOWS\system32\ctfmon.exe","Registry - User Run","1","CTF Loader (Microsoft® Windows® Operating System)","Microsoft Corporation"
"Dropbox.lnk","C:\Documents and Settings\ttzcwd\Application Data\Dropbox\bin\Dropbox.exe","Startup - Current User","1","Dropbox","Dropbox, Inc."
"EPSON Stylus C66 Series","C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"","Registry - Machine Run","1","EPSON Status Monitor 3","SEIKO EPSON CORPORATION"
"ERUNT AutoBackup.lnk","C:\Program Files\ERUNT\AUTOBACK.EXE %SystemRoot%\ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow","Startup - Current User","1","",""
"HControl","C:\WINDOWS\ATK0100\HControl.exe","Registry - Machine Run","1","HControl (ATK0100)",""
"High Definition Audio Property Page Shortcut","HDAShCut.exe","Registry - Machine Run","1","High Definition Audio Property Page Shortcut v1.0a (Microsoft® Windows® Operating System)","Windows ® Server 2003 DDK provider"
"igfxhkcmd","C:\WINDOWS\system32\hkcmd.exe","Registry - Machine Run","1","hkcmd Module (Intel® Common User Interface)","Intel Corporation"
"igfxpers","C:\WINDOWS\system32\igfxpers.exe","Registry - Machine Run","1","persistence Module (Intel® Common User Interface)","Intel Corporation"
"igfxtray","C:\WINDOWS\system32\igfxtray.exe","Registry - Machine Run","1","igfxTray Module (Intel® Common User Interface)","Intel Corporation"
"iTunesHelper",""C:\Program Files\iTunes\iTunesHelper.exe"","Registry - Machine Run","1","iTunesHelper (iTunes)","Apple Inc."
"Power_Gear","C:\Program Files\Generic\Power4 Gear\BatteryLife.exe 1","Registry - Machine Run","1","BatteryLife","ASUSTeK Computer Inc."
"QuickTime Task",""C:\Program Files\QuickTime\qttask.exe" -atboottime","Registry - Machine Run","1","QuickTime Task (QuickTime)","Apple Inc."
"RemoteControl",""C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"","Registry - Machine Run","1","PowerDVD RC Service (PowerDVD)","Cyberlink Corp."
"RunNarrator","Narrator.exe","Registry - Def User RunOnce","1","Microsoft Narrator (Microsoft® Windows® Operating System)","Microsoft Corporation"
"SDTray",""C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"","Registry - Machine Run","1","On Access user interface & tray access (Spybot - Search & Destroy)","Safer-Networking Ltd."
"SpybotSD TeaTimer","C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe","Registry - User Run","1","",""
"SunJavaUpdateSched",""C:\Program Files\Common Files\Java\Java Update\jusched.exe"","Registry - Machine Run","1","Java™ Update Scheduler (Java™ Platform SE Auto Updater 2 0)","Sun Microsystems, Inc."
"swg",""C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"","Registry - User Run","1","GoogleToolbarNotifier","Google Inc."
"VPN Client.lnk","C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico -user_logon","Startup - All Users","1","",""

Many thanks in advance for your help with this.

All best,

Simon

Hello Jimbo and Simon, I am keeping track of this topic and if after fixing this system to run a bit faster there are still problems than come on back to your thread at Safer and we can reopen it and try to get CF to run. Simon, when your ready just send me a PM and I will reopen the thread

Ok Simon from what I see we have some work to do.

One thing I like to check first before moving on, I notice in the Pitstop report it showed a red x on your network adapter. Are you using the Laptop to post and get on line?

If so I still need to check this out, Are you using your wireless connection or LAN connection to get online, and to make sure both adapters are working correctly. Please follow the instructions below.

• Here are the Instructions:
• 1. Click on start
• 2. Then click on control panel and then double click on system icon.
• 3. When system properties appear, then click on the hardware tab, now look under the device manager and look at the network adapters to see if any have a yellow question mark next to it.
• 4. If so then report back here of what you found and if possible take a screen shot of it and post it here.

Jimbo1

Hi Jimbo and Ken, Thanks for checking up Ken and thank you for the response Jimbo. All the network adapters appear to be in good order (no yellow question marks). There is a red cross by the Cisco Systems VPN adapter (I am assuming that is because I am not currently connected to a VPN). Let me know if you still want me to post a screen shot of this. All best, Simon

Ok sorry for the delay of responding, Have a lot going on atm.

1st thing I have a few questions to ask of you.

• A. Have your machine previously been or currently used to connect to a business or other network via VPN?
• B. Have you previously or currently use(d) DropBox online file storage/sync system on this machine?

Please provide this information.

2ND Here are the recommendations for your machine, it will be up to you to decide if you want to do this or not we at WTT cannot make nor force you to do anything.

Word of note here: This is very important, please back up all your data, this is due to a possible need of restoring your files in a event something may or many not happen.

• A. I would like for you to go and download the installer of MSE, and save it on your desktop for later use. From here http://www.microsoft.com/security/pc-security/mse.aspx
• B. Corrupted window files can be a problem after malware removal. The malware removal does not necessarily corrupt the files, the malware often does in the process of removal or before it is removed.

So with that I would need you to do the following.
Open the run Command and enter SFC /scannow and hit enter.

Note: You will need your Windows Installation CD for this due to if sfc finds any problems with your windows files to make repairs. If you do not have your install cd, You may need to beg or borrow an original OS install disk from someone you know.

Covering possible problems you may have with scannow if you do not have an OS disk.
http://www.updatexp.com/scannow-sfc.html

Or here for more explanation and possible problem fixes with scannow if you do not have an OS disk.
http://www.bleepingcomputer.com/forums/topic43051.html

Please post back here with the above results.

May you have a Blessed Day.

Jimbo1

Hi Jimbo, To answer the first questions: yes, I use a VPN every day (though not always at home); and, I also use dropbox to backup/sync files etc. I downloaded MSE, so this is ready to install whenever required (currently sitting on desktop); I had lots of problems with the second procedure. I don't have an OS disc, so I tirelessly tried the ways around this (finding i386 and changing the registry entries accordingly etc., including even changing the location of the servicepack files). I couldn't locate an i386 other than the one in c:\Windows\ServicePackFiles (c.400 MB or so) and another i386 folder which only hah about 200k worth of data in them (clearly not the complete i386). I also found an old XP Home edition restore CD with i386, but since I have professional on this machine it didn't work. I think that short of finding someone with an XP professional CD, which I haven't been able to do so far, that I have exhausted all options (and time) on this front for now… Is there anything else I can do which would have the same result? Many thanks, Simon

Hummm let me get back with you, To run SFC your going to need the Windows XP Pro CD, the above was a possible work around, but sad to say I think Microsoft has geared up its operating system for this very reason. I would like to see if you have possible file corruption or not. Another question to ask do you also use Microsoft Narrator? or used it at one time and if so are you still using it? I am going to ask other techs about this to see what they may have. Jimbo1

Ok I am sorry to pass on this news, but on the SFC scan, I am afraid the only solution to this that you are going have to beg or borrow an original OS install disk from someone you know or buy a install Windows XP Pro Cd if run this scan. Few reason that are 1. If you have file (s) missing this Cd will be needed or corruptions. 2. If a repair Install will be needed, this Cd will be needed, sorry but again as I said this is how MS has things set up. We really need to know if you have possible file corruptions or not before moving on, this is a big step at this point. Jimbo1

Hi Jimbo, Firstly, apologies for the delay in sorting this one out and thank you in advance for your patience. The good news is that I managed to get hold of a copy of the I386 folder (this time for XP Professional) and successfully completed the Scan. Once the scan completed (about 40 mins or so), it simply closed without giving me a log to post. So, at least we can now proceed (and perhaps there is a log saved somewhere providing details of any potential corruption?) I've never used Microsoft narrator, but I think it was initially put onto my PC. Should I uninstall? Please let me know where to go from here. All best, Simon

Well if SFC has not reported anything nor asked for the disk, then it's a good thing, because if something was wrong and needing fixing it would have asked you for it.

Now this is a list of recommendations for your machine, it will be up to you to decide if you want to do this or not we at WTT cannot make nor force you to do anything.

A. Programs That Needs Uinstalling: Reason Hugh Recourse Hogs

• 1. AVG and AVG Security
• 2. Spybot Search and Destroy

After they have been uninstalled, the file that I had you download to your desktop, here is the link in case you needed it again http://www.microsoft.com/security/pc-security/mse.aspx
After you installed it, I would think it may be best to let it do a full scan in case Ken545 needs to see something if it picks up anything.

This is the program many Tech's here now using and recommend, and plus its less of a resource hog on the machine.

If you still want to use Spybot Search and Destroy, I can give you instructions of how to set this up as a manual scanner, you already have a good Malware scanner installed on your system Malwarebytes Anti-Malware.

Once that part has been done proceed with Section B.

B. Disabling programs using CodeStuff Starter
Ok seeing that you use drop box and VPN, leave that alone. We still may come back to that VPN thing tho.
1. Using CodeStuff Starter disable the following listed below.

• A. - "Adobe Reader Speed Launcher",""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"","Registry - Machine Run","1","Adobe Acrobat
  SpeedLauncher (Adobe Acrobat)","Adobe Systems Incorporated"
• B. - "RunNarrator","Narrator.exe","Registry - Def User RunOnce","1","Microsoft Narrator (Microsoft® Windows® Operating System)","Microsoft Corporation"

When you have done the follow listed above, run CodeStuff Started again to get a new list and then post it back here, also post back any result of what MSE may have found for Ken545 and see how the machine is running at this point.

Thanks and may you have a Blessed Day,

Jimbo1

Hello, I uninstalled SpyBot and AVG. I'm happy to use Malwarebytes if that does a similar job. The old version of AVG used to be light and effective, but I have noticed with the new version that it is a major resource hog! It drives me crazy when it suddenly decides to update and essentially takes over, no matter what I was doing. MSE looks good so far. Regarding the scan results (5 hours later), it found: Win32/PowerRegScheduler, which it claims is a medium threat level and was removed. It also found potentially unwanted software with unwanted behavior as: containerfile:C:\Program Files\palmOne\register.exe file:C:\Program Files\palmOne\register.exe->[RSRCEmb] So I will go ahead and delete these, as they are not needed. The new CodeStuff scan is: Name,Value,Section,Enabled,Description,Company "Adobe Reader Speed Launcher",""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"","Registry - Machine Run","0","Adobe Acrobat SpeedLauncher (Adobe Acrobat)","Adobe Systems Incorporated" "ctfmon.exe","C:\WINDOWS\system32\ctfmon.exe","Registry - User Run","1","CTF Loader (Microsoft® Windows® Operating System)","Microsoft Corporation" "Dropbox.lnk","C:\Documents and Settings\ttzcwd\Application Data\Dropbox\bin\Dropbox.exe","Startup - Current User","1","Dropbox","Dropbox, Inc." "EPSON Stylus C66 Series","C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"","Registry - Machine Run","1","EPSON Status Monitor 3","SEIKO EPSON CORPORATION" "ERUNT AutoBackup.lnk","C:\Program Files\ERUNT\AUTOBACK.EXE %SystemRoot%\ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow","Startup - Current User","1","","" "HControl","C:\WINDOWS\ATK0100\HControl.exe","Registry - Machine Run","1","HControl (ATK0100)","" "High Definition Audio Property Page Shortcut","HDAShCut.exe","Registry - Machine Run","1","High Definition Audio Property Page Shortcut v1.0a (Microsoft® Windows® Operating System)","Windows ® Server 2003 DDK provider" "igfxhkcmd","C:\WINDOWS\system32\hkcmd.exe","Registry - Machine Run","1","hkcmd Module (Intel® Common User Interface)","Intel Corporation" "igfxpers","C:\WINDOWS\system32\igfxpers.exe","Registry - Machine Run","1","persistence Module (Intel® Common User Interface)","Intel Corporation" "igfxtray","C:\WINDOWS\system32\igfxtray.exe","Registry - Machine Run","1","igfxTray Module (Intel® Common User Interface)","Intel Corporation" "iTunesHelper",""C:\Program Files\iTunes\iTunesHelper.exe"","Registry - Machine Run","1","iTunesHelper (iTunes)","Apple Inc." "MSC",""c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey","Registry - Machine Run","1","Microsoft Security Client User Interface (Microsoft Security Client)","Microsoft Corporation" "Power_Gear","C:\Program Files\Generic\Power4 Gear\BatteryLife.exe 1","Registry - Machine Run","1","BatteryLife","ASUSTeK Computer Inc." "QuickTime Task",""C:\Program Files\QuickTime\qttask.exe" -atboottime","Registry - Machine Run","1","QuickTime Task (QuickTime)","Apple Inc." "RemoteControl",""C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"","Registry - Machine Run","1","PowerDVD RC Service (PowerDVD)","Cyberlink Corp." "RunNarrator","Narrator.exe","Registry - Def User RunOnce","0","Microsoft Narrator (Microsoft® Windows® Operating System)","Microsoft Corporation" "SunJavaUpdateSched",""C:\Program Files\Common Files\Java\Java Update\jusched.exe"","Registry - Machine Run","1","Java™ Update Scheduler (Java™ Platform SE Auto Updater 2 0)","Sun Microsystems, Inc." "swg",""C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"","Registry - User Run","1","GoogleToolbarNotifier","Google Inc." —————————————————————— Update on how the computer is running: last time I re-booted the boot process still seems quite sluggish. This time, there quite a long delay on the login page after I have entered the password and windows takes a while to load up (which wasn't the case a few months ago). No freezes so far though Many thanks! Simon p.s. I forgot to mention that I deleted the VPN entry on the CodeStuff, as I am sure it wasn't necessary. If there is a problem with VPN I can just un-install and re-install the software….hope that I haven't gone too far with that one…

Just to let you know I have not forgotten about you, got a little tied up and will get back to you soon, just keeping you posted on this. Jimbo1

Hello, Thanks for letting me know - no problem. It gives me time to provide an update on the most recent boots as well: as I mentioned previously, it is very slow getting from the password screen to a fully loaded windows (and, finally, the windows music). The last time I booted it stuck on displaying only the network drive icon on the task bar and then finally loaded without various icons in the task bar (only drop box and the internet connection actually). It has frozen on the network drive icon before as well… I hope that is detailed enough… Let me know whenever you get the chance, but no huge rush. All best, Simon