In serious need of help

[Rizla]

I don't come here very often, but i'm near enough praying that someone will know how to help me with this...

 

 

 

 

 

 

 

I turned my computer on this morning (after shutting down properly last night), and it's taken about 3-4 minutes to start up. I'm then faced with my desktop background, and (eventually), desktop icons. Around half of these icons load their images, the rest are just blank, but none of them can be clicked. I can't right click, the taskbar is locked as if it's loading (an egg timer comes up when i hover over it), the clock is just stopped and has been for over 20 minutes. The only thing i can open is task manager, to shut my computer down.

 

 

 

I called the helpdesk of the company that made my computer, and they've told me to do a factory restart. THIS IS SOMETHING I WANT TO AVOID. I'm now in the process of moving everything i want to keep from the C to D drive, but i'm extremely concerned that i'll end up losing something important (i work from home, so this computer literally contains EVERYTHING).

 

 

 

Does anyone have any (and i mean any) ideas? I'm on a different computer at the moment but i can't access anything on the one with the problem - it's currently in safe mode so i can backup the important files.

 

 

 

 

 

 

 

side note: if anyone from dw see's this, poke hannibal towards the topic :P

[Hannibal]

Sometimes I magically discern that someone has a computer problem without being poked about it :P

 

 

 

 

 

 

 

Unfortunately, I really don't know what is the cause of all this. There are lots of possibilities. I'd try a virus scan if at all possible, as well as Ad-ware scans etc. etc. Apparently you can still get into safe mode - did you try to back up recently changed files and use a System Restore point? (Yes, I'm aware that those should keep your files, but I just don't trust Windows when it comes to that...)

 

 

 

 

 

 

 

Also, was there *anything* out of the ordinary you did with your computer before what happened this morning? Install software, accidentally bump into it when coming home, anything?

 

 

 

If not, you have a decent chance that it's a hardware problem. Did you try to check the disk from safemode? (lots of faults in harddisk r/w is often a cause for slowness). Additionally, you may want to try to enable logging during XP startup... I don't know how to do that out of the top of my head - Google around or wait until I'm home again (currently at uni).

 

 

 

Also, if more people from #dw see this, poke Merc, GSW, Pyro and rick` about this too :-)

[Mercifull]

/me ponders loading a generic reply....

 

 

 

 

 

 

 

---

 

 

 

Please Scan your PC with your anti virus again with the latest defenitions, if you dont have antivirus (i really hope you do) then you can scan with Housecall

 

 

 

Please also download, if you havnt already done so, Ad Aware SE and Spybot S&D.

 

 

 

Scan with both those programs and remove any spyware and/or keyloggers if they show up.

 

 

 

Please also post a Hijckthis log in your thread.

 

 

 

---

 

 

 

 

 

 

 

lol, well basicly Riz i dont think its a spyware issue but lets just be safe and try it anyway. I cant say ive really heard of anything like your problem before.

 

 

 

Ill have a think about it and have a word with you later on irc or summit (if you can get on there)

 

 

 

If worse comes to worse you can always do a repair install with the windows cd, you wont lose any files but you will have to download about 2 years worth of patches from windows update lol.

[____]

I've had this problem before...

 

 

 

 

 

 

 

1. I got no idea how it happened.

 

 

 

2. I got no idea how it fixed itself either.

 

 

 

 

 

 

 

I'd wait close to 15 minutes for my desktop to load THEN I could do stuff.

 

 

 

However you don't seem to be able to do anything at all - basically...

 

 

 

 

 

 

 

do what matt suggested, and if you can: open task manager and start removing crap as the process starts (im progs, system monitors, etc) and see how you go.

 

 

 

 

 

 

 

I have found that sometimes a process just starts milking my cpu and nothing else gets a chance to load much :\

[Rizla]

Cheers for the input guys. Just finishing the backing up process, then i'll do the scans, post logs and go from there. Formatting really is gonna be a last resort so i'll try whatever i can when i'm done backing up.

[insane]

This problem happened to me... except multiply the time taken to load things by 5. 1 hour to load, 30 minutes for desktop icons etc...

 

 

 

 

 

 

 

I ran a diagnostic and one of my harddrive blocks was permacorrupt and windows ingeniously decided to use that block for a critical process.

 

 

 

 

 

 

 

So my laptop is currently at Dell getting a new harddrive.... :-\

[Chris]

:| Yeah... Because no one pointed Chris from #dw in this direction. You know the only one out of the whole lot of us who actually works in a PC shop...

 

 

 

 

 

 

 

Meh, sounds like what rick has already pointed out. The processor sounds like it's getting looped. Go into task manager and have a look at the processes if there is one in particular that's up high 50%+ like all the time, try and cancel it. Hell cancel everything that it'll let you until it works again.

 

 

 

 

 

 

 

You might also want to try booting from an official Windows XP CD and running "Chkdsk /p" and "Chkdsk /r". Very helpful little commands.

 

 

 

 

 

 

 

Try what matt said aswell. Repair installation.

 

 

 

 

 

 

 

Apart from that, I can't be arsed helping.

[Rizla]

Done an adaware scan, spybot scan, and regular virus scan. Here's the HJT log:

 

 

 

 

 

 

 

Logfile of HijackThis v1.99.1

 

 

 

Scan saved at 17:29:11, on 27/09/2005

 

 

 

Platform: Windows XP SP2 (WinNT 5.01.2600)

 

 

 

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

 

 

 

 

 

 

Running processes:

 

 

 

C:\WINDOWS\System32\smss[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\system32\winlogon[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\system32\services[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\system32\lsass[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\system32\svchost[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\System32\svchost[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\Explorer[Caution: ExecutableFile]

 

 

 

C:\Program Files\mIRC\mirc[Caution: ExecutableFile]

 

 

 

C:\WINDOWS\system32\ntvdm[Caution: ExecutableFile]

 

 

 

C:\Program Files\CA\eTrust Antivirus\InocIT[Caution: ExecutableFile]

 

 

 

C:\PROGRA~1\MOZILL~1\FIREFOX[Caution: ExecutableFile]

 

 

 

C:\DOCUME~1\HOMEUS~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis_199.zip\HijackThis[Caution: ExecutableFile]

 

 

 

 

 

 

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

 

 

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.broadband.blueyonder.co.uk

 

 

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by blueyonder

 

 

 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,

 

 

 

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

 

 

 

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

 

 

 

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

 

 

 

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

 

 

 

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

 

 

 

O4 - HKLM\..\Run: [CHotkey] mHotkey[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [ledpointer] CNYHKey[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [Dit] Dit[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon[Caution: ExecutableFile] -s

 

 

 

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]" -osboot

 

 

 

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd[Caution: ExecutableFile]"

 

 

 

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus[Caution: ExecutableFile]"

 

 

 

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]"

 

 

 

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime

 

 

 

O4 - HKCU\..\Run: [ctfmon[Caution: ExecutableFile]] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile]

 

 

 

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine[Caution: ExecutableFile]" boot

 

 

 

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf[Caution: ExecutableFile]

 

 

 

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

 

 

 

O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

 

 

 

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

 

 

 

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

 

 

 

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL[Caution: ExecutableFile]/3000

 

 

 

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

 

 

 

O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html

 

 

 

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

 

 

 

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

 

 

 

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]

 

 

 

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]

 

 

 

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

 

 

 

O14 - IERESET.INF: START_PAGE_URL=http://www.broadband.blueyonder.co.uk

 

 

 

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab

 

 

 

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/ ... 0_0_44.cab

 

 

 

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

 

 

 

O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/A ... ngctrl.cab

 

 

 

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab

 

 

 

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab

 

 

 

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnme ... loader.cab

 

 

 

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile]

 

 

 

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag[Caution: ExecutableFile]

 

 

 

O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile]

 

 

 

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution: ExecutableFile]

 

 

 

O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc[Caution: ExecutableFile]

 

 

 

O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT[Caution: ExecutableFile]

 

 

 

O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask[Caution: ExecutableFile]

 

 

 

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]

 

 

 

O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09[Caution: ExecutableFile]

 

 

 

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc[Caution: ExecutableFile]

 

 

 

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets[Caution: ExecutableFile]

[weezcake]

I don't see any suspicious items in the hijack log. Have you tried booting in safe mode, and seeing what happens? Or perhaps Windows System Restore?

[Rizla]

I don't see any suspicious items in the hijack log. Have you tried booting in safe mode, and seeing what happens? Or perhaps Windows System Restore?

 

 

 

 

 

 

 

I'm in safe mode (with networking) as we spe..... errrrr type. I can access anything i would normally use (firefox, IE, IRC, msn messenger), i can save files, create new files, everything seems to be fine.

 

 

 

 

 

 

 

Windows system restore is next on my list of options. I'll probably do this in the morning.

[xyrec]

Hmmm....seems odd for something like this to happen so suddenly. I've seen a computer that someone brought in to the school where I took A+ training and it took over 15 minutes to boot. The reason for it's slow speed became apparent quickly once we got it to load though. It was crammed full of spyware and adware. Every 30 seconds aol would attempt to dial, there were shortcuts to porno in the start shortcuts and even in the programs list. Adaware found like over 500 items....even after we did everything we could think of the pc was still slow as a drunken sloth.

 

 

 

 

 

 

 

In case you do have to format, do you have a cd or dvd burner? If you do, you outta be able to burn all your stuff from work that you need to keep, then after you format just copy the stuff back onto the pc. It'll be good either way since then you'll have a hard backup incase the computer totally poops.

[Mercifull]

@xyrec: riz will always be able to try a repair install before a complete format. that way he wont lose any files.

[shortkid111]

Hmm.... from what hijackthis says... O10 is bad...

What to do:

 

 

 

It's best to fix these using LSPFix from Cexx.org, or Spybot S&D from Kolla.de.

 

 

 

Note that 'unknown' files in the LSP stack will not be fixed by HijackThis, for safety issues.

 

 

 

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

 

 

 

 

 

 

 

Something to try...save the stuff that you want... uninstall everything that you recognize you know that can be reinstalled... I think outside programs can hijack behind a known program...

[____]

mdnsnsp.dll is used by Air-Tunes.

 

 

 

iTunes usually throws a [cabbage] when you mess with it from what I know of it.

 

 

 

If Rizla doesn't use it he can disable the process from running but that isn't going to fix his problem.