Unstable computer after virus attack and reinstallation of XP

recently my computer got infected with a virus and when i shut it down one time, all i got was the blue screen of death saying SESSION5_INITIALIZATION_FAILED. could not boot up windows in any way, shape or form. tried to reinstall xp sp1 with my recovery disk but during installation showed 3-4 files that xp could not find somehow. anyways, my computer could finally boot up but it was lethargicly slow and unstable, freezing up after 10 mins of use and shutting down programs once i opened them. after deleting all the spyware and malware from my computer with some help from this forum ( i had new win32 gaelicum virus among other thinigs) my hijack log seemed clean but my computer is still very much unstable. some examples include: - slow startup - can't use windows media player - internet explorer works for about 10 minutes then freezes up - hard drive making noise when i am not performing any apparent operations - lsass.exe runs and gives me a countdown before it involuntarily shuts down my computer - i got this message a few times "application error - the instruction at 0x77f5led3 referenced memory at 0x909006e3. the memory could not be read" then shuts down due to lsass.exe - or ""application error - the instruction at 0x77f52109 referenced memory at 0x00000000. the memory could not be read" then shuts down due to lsass.exe - after each of these events, i press start, shutdown, restart, but it freezes up and i need to cold boot the computer… been doing this ALL day after 10 mins of usage with this thing i have a dell laptop using windows xp sp1 any help would be greatly appreciated! should i reinstall windows again now that it's virus-free (apparently) also, when i reboot in safe mode, all these multi(0)partition files run up the screen and stops at agp440.exe file then pauses…

Hi Strobie,

Quite often, problems like what you describe are due to Heat, RAM failure, Hard Drive failure, power supply failure, "missing or corrupt" files in the Operating system, and too many applications and programs loading at StartUp.

Even though it's a laptop, do what you can to clean out the dust bunnies, and insure that you are getting vigorous fan activity and air flow. What's the ambient temperature where the machine is located? Is the machine located on a flat hard surface with no clutter blocking air-intake and air-exhaust?
Feel the air flowing out the exhaust. It should we warm, but not so unpleasant that you pull your hand away.
Feel the bottom of the machine. It should be warm, but not so unpleasant that you pull your hand away.

Running processes from your HJT log:
VERY few of these need to be running from StartUp!
Use MSCONFIG to disable unnecessary applications and processes.
Use http://www.answersthatwork.com to help you decide what you can disable.

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

How much RAM does that machine have?
How much Free Space do you have on the Hard Drive?
How long has it been since you Defragged?

Hopefully, you lsass.exe file is located in the C:\Windows\System32 folder
Please run a search with "show hidden files and folders" selected and uncheck "Hide protected operating system files"
After your search is concluded, reverse those two view settings.

Please check for "warnings" in your Device Manager
If you find yellow or red warnings, then right click on the driver item and Select - Remove
Then reboot and allow Windows to "find new hardware" and "install software for new hardware"

Please Run: System File Checker
(Start - Run - (type) sfc /scannow
Have your Windows installation CD handy, because SFC will need it to copy and replace any missing or corrupt operating system files.

Please download, install, and Run Everest 2.20 (free)
(download here: http://www.majorgeeks.com/download4181.html)

In Everest, go to Motherboard - Sensors Copy and paste the Temperature and Voltage information in the large right hand panel

Please complete or answer the above actions and questions and post your results in your next reply.
If the above fixes your problem, then we can celebrate.
If not, we'll take the next steps to test RAM and Hard Drive.

Best Regards

EDIT: You will probably not be able to use an external CD/DVD drive for completing a Repair or new installation of Windows since it will most likely be a USB device that is dependant on the operating system and drivers to enable USB.
(I am not recommending Repair installation or over the top installation at this time. Just answering the question you put to Micah in your other thread.)

hi, thanks for your quick reply. i will reply to your questions in bursts here then edit as my system might freeze up any minute. ok here goes! as far as airflow and temperature are concerned, i think it's fine because my laptop was operating without ever freezing up or crashing previous to the virus infection + reinstallation. my computer is on a table by itself that is uncluttered and now it's summer so i have the fan here circulating around the room and it is pointed at the laptop too. aircon is on too! oh, how would i clean out the dust bunnies on this thing?? wow, i checked that answers that work website but it seems quite long and i'm not sure if i should be searching for… the process .exe ?? from my log which programs do you think are definite keepers for start up? RAM = 640mb total Free space on HD = 3.5 GB out of 60 GB total Defragged = last month, eventhough to run it efficiently it said I need 15 GB of free space but I ran it anyways. lsass.exe i have not been able to use the search function after the reinstallation, it starts up then says that window explorer must shut down. so i manually searched the folder and find that it's still in the system32 folder. device manager i clicked on device manager and no warnings showed up. system file checker i ran this and put in my cd into the computer's drive as it wouldn't run on my external one. i finally got it to run on the computer's drive after 5 minutes or so. it took a long time for the check to complete, but once it was done, it closed and didn't show any messages! is this normal or is it because my computer was frozen at that point? because my other programs weren't functioning after that point and i had to cold boot again. but nothing popped-up during the check, is that a good sign? everest i couldn't find temp and voltage under MOTHERBOARD but under COMPUTER i found some temp readings as follows 41C = CPU 55C = GPU 42C = Hitachi…. and under CPU PYSICAL INFO, the voltage reading CORE VOLTAGE 0.956 - 1.484V Thanks again and I hope this helps!

3.5GB (free space) out of 60GB Total could be a serious contributor to your problem.
(Windows and various applications like to "spread out" when in operation and need lots of hard disk free space)
I truly doubt if you've gotten a good defrag with your Hard Drive being so full.
Lots of System and other files are probably scattered all over the place, requiring additional seek/read/write cycles to find even one file. Multiply that by the dozens or hundred of files in any one Application, and you are seriously overworking your Hard Drive.

Let's see what we can do to remove as much as possible that you don't need/use on a regular basis.
And how about running a cleanup to get rid of Temp, .tmps, Temporary Internet Files, and cookies.

Safest method for cleaning up is to do it manually, but there are a few GREAT programs you can use as well.
CleanUp! 4.50 … http://www.stevengould.org
ATFCleaner … http://www.atribune.org/content/view/19/2/
CCleaner …http://www.ccleaner.com/download/
(I use CleanUp!4.50 myself)

Here's the routine to do it manually:

To clean out all the temporary files and cookies on your system.
Go to
Start - Run - (type) "cleanmgr" without the quotes.
Let it scan your system for files to remove.
Check these three boxes and then press ok to remove:
Temporary Files,
Temporary Internet Files,
Recycle Bin.

Then GoTo:
Start - Find/search - Files or folders - in the named box, type: *.tmp
When the list is generated, choose
Edit - select all - File - delete.

Note: If you cannot delete them all at once because you have too many, then click and hold ctrl and highlight a batch of them at a time. Once highlighted, R-click over the highlight and select delete.

Then use
Start - Run - (type) "%temp%" (without the quotes).
Delete the entire contents of that "temp" folder
(use Edit - Select All - press "Delete", click "Yes").

Then,
Empty your Temporary Internet Cache completely.
Close all instances of Outlook and Internet Explorer,
then use "Control Panel - Internet Options - General tab and click the "Delete File" button.
When prompted place a check in: "Delete all offline content", then click OK.

Then, use Windows Explorer to clean out ALL the other temp folders on your system
(navigate to the folder, (as listed below)
use "Edit - Select All", press "Delete", click "Yes"

* C:\Documents and Settings\\Local Settings\Temp\
* C:\Documents and Settings\\Local Settings\Temporary Internet Files\
* C:\Documents and Settings\\Local Settings\Temp\

* C:\Windows\Prefetch\

* Empty your "Recycle Bin".

You can save a "ton" more space by setting your System Restore to use only about 3% or less than 2 GB.
You're not likely to benefit from terribly old restore points and ordinarily only need a few hundred MB.

System File Checker doesn't give much information, except if it identifies missing or corrupt operating system files. You'd have to be watching at the time when it tries to access the CD to copy and replace to even know it happened. Maybe there is a log, but I'm not sure how to access it.

640MB RAM is more than I was anticipating and should be fine for most applications except gaming and video editing.

Sorry, you're right. Everest displays Temperatures and Voltages in Computer - Sensors
Those Temps would be high for a Desktop but are probably within tolerance for Laptop.

Physically look into the vent opening where the exhaust fan is to watch that fan spin. Is it…spinning?
How about visible dust accumulation at the same vent exhaust.
How about at air-intake locations, if any.

In AnswersThatWork you can "look up" each application or process alphabetically, one by one in Task List.
For Example:
For nwiz.exe click on N then scroll down and you will find nwiz.exe almost at the bottom.
AnswersThatWork has a nice blurb about the many options that nVidia provides via nwiz.exe, and then recommends that you can disable nwiz.exe if you don't use any of those options. I almost always disable it.
I suggest you do the manual "look-up" yourself so you know what you're turning off and what will/will not work as a result. If later, you find you want something active again, no problem, just go to MSCONFIG again and replace the checkmark.

Please review again in Device Manager.
Right-Click on My Computer - Select Properties - Hardware Tab - Device Manager
The yellow or red warnings usually show in the main tree view, but you can double-click on each item to expand the view to see the drivers and check for warning tags

Let's see how much Free Space you can acquire before we take any further steps.
That Hard Disk could be pretty choked.

I look forward to hearing about your progress.

Best Regards

okay, i deleted all the *.tmp files that i could find. the search feature didn't freeze up this time - a positive sign. i did the steps you listed manually because i read on the cleanup website that it could possibly delete some system files on xp. i also deleted the internet files and cookies and reduced my system restore to 3%. also cleared up some startup files that aren't necessary using that site as a guide. i noticed one file - the RUNDLL32.EXE that shows up on start up was a sign that there was something wrong with another file on my comp. any ideas on this? so now i have a whopping 4.3 GB of free space! my computer does seem to run faster and crashing less frequently. i also deleted and reinstalled some files that were corrupted by the virus/reinstall like windows media player and ewido.

Great Work Strobie, Reclaiming nearly 3/4 of a gig by removing the trash can help alot! But not nearly enough. Do you have data and media files that you could backup by: Save to your External CD writer? Please try to get close to that magical 15gig number for Free Space. Then Defrag. Then we'll run SFC again. Then I'll give you a routine for running CHKDSK to examine your Hard Drive. If you eventually need to do a Repair Installation of the Operating System, you will need the extra free space for two reasons. One, a Repair installation would possibly fail due to lack of space, even if your CD/DVD drive was working well. Two, if you can't get the CD/DVD unit working/repaired/replaced, then you will have to "copy" the i386 folder information from your Installation CD onto your Hard Drive and run the reinstall from the Hard Drive. That takes a ton of space. You're doing good and working in the right direction! Keep us posted with your progress. Best Regards EDIT: the RUNDLL32.EXE issue is "not necessarily" malware related, but it is worth further investigation. You may have installed various Application programs that insist on "checking for updates" via a bundled "backdoor" routine embedded in the Application. For instance RealAudio like to "call home" frequently, as do many other legitimate Applications. It could even be MS MediaPlayer, if your have the options for "check for licensing" enabled. (I don't.) Please concentrate on the Hard Disk Free Space issue first, then you can look more carefully at other issues.

okay i got the HD to 15GB of free space for the first time in 2 years maybe! ran the defrag. all seems to be running okay now. no error messages or crashes. what's the next step in checking the HD?

Hi strobie,

Good Work!

all seems to be running okay now.
no error messages or crashes.

You may be at a point where the best move is to declare victory and go on to enjoy your now well functioning machine.
A good principle to follow is: "If it ain't broke, don't be fixin' on it."

What/Which, if any of the previous listed or new symptoms are you noticing?

Do you still have the annoying/worrisome sounds emanating from your Hard Drive.
If that is why you would want to continue with more steps, I can go with that.
Otherwise……Enjoy.

Run your System File Checker (sfc /scannow) again at this time.

Additionally,… Is there a good reason why you are not running the SP2 upgrade of your XP?
SP2 will likely assist in resolving present and future problems with XP on your machine, and definitely make it more secure when you are interactive with the internet.
(comment most of the early "conflicts" produced by the MS upgrade to SP2 have been resolved)

There are at least two primary approaches to examining your Hard Disk.
The Windows utility CHECKDISK is native to your operating system and will find and accomodate for a variety of "bad sector" problems that may or may not exist on the surface of your Hard Disk's surface.

To Run CHKDSK:

Set the order to boot from the CD Rom 1st and the Hard drive 2nd.

Put your Windows CD in the tray, then "Exit with Saving" the settings (far right tab)

1. Boot with your windows CD
2. Type R to Enter the Recovery Console
3. Enter the Administrator password (if there is one)
4. Type: chkdsk c: /r and press Enter << 5. Once completed (if no errors of unrecovery) Type: chkdsk c: /p and press Enter
6. Type: fixboot c: and press Enter
7. Boot Normally (reset your boot order to Floppie first, Hard Drive Second, CD ROM third)

Alternative:
The manufacturer of your Hard Disk will have a "Diagnostic Tool" or "Disk Fitness Test" available at the manufacuter's website. It generally involves downloading the Diagnotic/Test as an .iso or .exe, and then creating a Floppy Disk routine to Run the Diagnostic/Test.
Information from that Diagnostic/Test may provide you with "predictive" clues about the current status and future life span of your Hard Drive.


If you have decided to "declare victory". Be sure to keep your Security utilities up to date and run them regularly. Delete your Temps and Temporary Internet Files, on a regular (weekly basis). Run Disk Defrag on a routine (weekly basis). Visit MS Update regularly (weekly) and allow the critical updates.

AND, upgrade to SP2!

Best Regards