TechSpot

Computer keeps freezing up

By Aphrodite
Jan 22, 2009
  1. From viewing similar previous posts, I see it is helpful to post my computer specification:

    Operating System: Microsoft Windows XP Professional

    Model: Dell Dimension E521

    BIOS: )Phoenix - Award WorkstationBIOS v.6.00PG

    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+, MMX, 3DNow (2 CPUs)

    Memory: 1982MB RAM

    Page file: 484MB used, 3391MB available

    DirectX Version: DirectX 9.0c (4.09.0000.0904)

    Graphics: NVIDIA GeForce 6150 LE


    My computer freezes randomly (It's never when I do something specific), preventing me from doing anything for 10-15secs at a time. Also, when shutting my computer down, it will not shut down and instead remain on the "Windows is shutting down" screen until I manually shut it down.

    Any help would be appreciated - if you require further information then please ask and I will do my best. :)
     
  2. CCT

    CCT TS Evangelist Posts: 2,653   +6

  3. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Thanks for the response - and my apologies for such a late reply.

    Here is the logfile:

     
  4. mflynn

    mflynn TS Rookie Posts: 2,655

  5. Aphrodite

    Aphrodite TS Rookie Topic Starter

    All done :) hope this helps!
     
  6. mflynn

    mflynn TS Rookie Posts: 2,655

    Not a lot of help!

    To be positive you have no Malware do the below. Better Safe than sorry!

    Run SpyBot update run the Immunize feature. No Scan for now as the below will do it better.

    Boot to Safe Mode with networking and do the below attach the logs.

    Do the TechSpot 8 steps: http://www.techspot.com/vb/topic58138.html

    Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

    Most importantly update MalwareBytes and SuperAntiSptware!

    Before you scan with SuperAntiSpyWare do the below:

    SuperAntispyware extra config

    After installed double-click the icon on your desktop to run it.

    Update the program definitions.

    Click the Preferences button.

    Then Scanning Control.

    In Scanner Options make sure all boxes are checked except #3 Ignore System Restore.. are checked:

    MalwareBytes extra config

    After update but before running
    Click settings and confirm all are Checked.

    I repeat Update these 2 programs.

    Run them and attach their logs.

    Mike
     
  7. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Installing a Firewall

    In response to your last post, you told me to ask you before installing a firewall.
    I'm going to install Zonealarm (I previously had Comodo on my laptop but became annoyed at the amount of pop-ups it gave to authorise programmes) - is there anything in particular I need to do once installed?
     
  8. mflynn

    mflynn TS Rookie Posts: 2,655

    Lets do the 8 Steps first. Sometimes installing something while infected can cause problems.

    And I will need to help you completely uninstall COMODO, if it is not correcly uninstalled ZA may have problems installing.

    If you are clean I will help you switch Firewalls. So step up and do the 8 Steps!

    Mike
     
  9. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Comodo was installed on my laptop (this is my desktop), so if you could possibly reply with instructions as to how to completely wipe Comodo off the system, then that would be helpful.

    I'll crack on with the 8 steps now.

    Many thanks.


    EDIT:

    Once installing ZA my computer is awfully slow in safe mode - is this normal?
    This is preventing me from accessing the internet on my pc (i'm currently on my laptop)
    Any help would be appreciated.




    EDIT:

    After un-installing ZA, everything seems to be in order. Once ZA was installed, it came up that "TrueVector Service" was not functioning and had to close - after searching this, I discovered that this was to do with ZA. Would it be easier to just install COMODO or is there a solution?

    I'm now continuing with the other steps.


    EDIT:

    Just attempted to install Super Antispyware (step 5) - a mesesage box appears stating that the system administrator has set policies to prevent this installation - when I log onto the "Administrator" account on my pc in safe mode, it still shows this.

    Also, I receive the same error message box when trying to update Java (step 6)


    So, all that's left is to install ZA, Super Antispyware and update Java - before I am able to move on,
    Any help would be much appreciated.
     
  10. mflynn

    mflynn TS Rookie Posts: 2,655

    Oh ye of little faith!:)
    Oh boy ZA is hard to completely clean we will get back to it!

    For now lets get it so you can install the Malware tools

    Boot to Safe Mode networking and do the below.

    Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

    Then paste to the black screen of an open command prompt. All may not apply so ignore errors.
    Code:
    @echo off
    cd\
    :: Fix associations
    ftype exefile="%1" %*
    ftype batfile="%1" %*
    ftype cmdfile="%1" %*
    ftype comfile="%1" %*
    ftype scrfile="%1" /S
    ftype regfile="regedit.exe" "%1"
    ftype piffile="%1" %*
    ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
    ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    
    assoc .exe=exefile
    assoc .bat=batfile
    assoc .cmd=cmdfile
    assoc .com=comfile
    assoc .scr=scrfile
    assoc .reg=regfile
    assoc .pif=piffile
    assoc .lnk=lnkfile
    assoc .inf=inffile
    assoc .vbs=VBSFile
    assoc .js=JSFile
    
    sc stop TDSSserv.sys
    sc delete TDSSserv.sys
    :: Above sc commands first stops then deletes service if it exists
    ::
    reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
    reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
    ::
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
    ::The above reg commands first unloads the reg keys then deletes these keys.
    ::
    Attrib -h -s -r tdss*.* /s
    del  tdss*.* /f /q /s
    :: The above two lines first clears protective attributes then 
    :: deletes all files on Drive beginning with the name tdss
    
    :: Remove AntiVirus2009
    attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
    attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
    attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
    attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"
    
    del "%UserProfile%\Desktop\Antivirus 2009.lnk" /f /q
    del "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk" /f /q
    del "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll" /f /q
    del "%UserProfile%\Start Menu\Antivirus 2009\*.*" /f /q
    
    rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"
    
    attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
    rd /s/q "c:\Program Files\Antivirus 2009"
    
    attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
    attrib -h -s -r c:\WINDOWS\system32\scui.cpl
    attrib -h -s -r c:\WINDOWS\system32\winsrc.dll
    
    del c:\WINDOWS\system32\ieupdates.exe /f /q
    del c:\WINDOWS\system32\scui.cpl /f /q
    del c:\WINDOWS\system32\winsrc.dll /f /q
    
    reg delete HKLM\SOFTWARE\swearware /f
    reg delete HKCU\Software\Wget /f
    reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f
    
    reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
    reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
    echo Finshed ripping out Antivirus 2008-9
    :: Fix associations
    ftype exefile="%1" %*
    ftype batfile="%1" %*
    ftype cmdfile="%1" %*
    ftype comfile="%1" %*
    ftype scrfile="%1" /S
    ftype regfile="regedit.exe" "%1"
    ftype piffile="%1" %*
    ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
    ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    
    assoc .exe=exefile
    assoc .bat=batfile
    assoc .cmd=cmdfile
    assoc .com=comfile
    assoc .scr=scrfile
    assoc .reg=regfile
    assoc .pif=piffile
    assoc .lnk=lnkfile
    assoc .inf=inffile
    assoc .vbs=VBSFile
    assoc .js=JSFile
    exit
    exit

    Once the above is complete reboot again into Safe Mode networking and continue with the 8 Steps.

    Mike
     
  11. Aphrodite

    Aphrodite TS Rookie Topic Starter

    I'm afraid that I'm still receiving the same error message box stating "the system administrator has set policies to prevent this installation". That appears when I attempt to update Java and attempt to install SuperAntiSpyware onto my system.
     
  12. mflynn

    mflynn TS Rookie Posts: 2,655

    Did you do the copy paste in my last post?

    Mike

    EDIT and what about MalwareBytes antimalware? Will it install?
     
  13. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Yes I did the copy paste into a dos command box, and nothing changed.

    And MalwareBytes installed perfectly, I'll attach the log here.
     
  14. mflynn

    mflynn TS Rookie Posts: 2,655

    OK Boot to Safe Mode with networking and do the below.

    Download SDFix to Desktop.

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.
    =========================================
    Download ComboFix

    NOTE: If you have had ComboFix more than a few days old delete and re-download.

    Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Or here: http://subs.geekstogo.com/ComboFix.exe

    Double click combofix.exe follow the prompts.

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.

    Mike
     
  15. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Here are the logs attached as requested.

    Just wanted to note also that when I try to restart my computer with the restart button, it freezes upon startup. Therefore, I have to shut it down manually and then switch it back on.
     
  16. mflynn

    mflynn TS Rookie Posts: 2,655

    So it goes thu shutdown and turns itself off?

    What if you use Start-Shutdown and don't use the button?

    But we are now clean so lets do some cleanups to try and help the Shutdown issue.

    Run CCleaner from the 8 Stepsagain twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

    Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

    KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
    Fantastic cleaner.
    -------------------------------------------------------------------------------------
    The issues can and are likely found is in System Restore so do the below

    Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

    Then Start-Programs-Accessories-System Tools-Disk Cleanup
    Click OK to accept C:
    Select all Boxes
    Then click More Options
    Here click System Restore and OK to "Are you sure" and the OK to Run.

    As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

    It clears what is known as Shadow copies which are used by specialized back up programs.

    This is if you have the Volume Shadow Copy running which is the default.

    Do this and use the mouse to shutdown windows instead of the Switch.

    Let me know the results.

    Mike
     
  17. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Sorry for not being clearer - when I restart the pc I use the mouse through the start menu, and then it freezes upon loading again.

    I'll still carry out the steps you told me to and edit this post when finished.


    EDIT:

    Despite our misunderstanding, that seems to have solved that problem. Although it is sometimes slow to shutdown/restart, it is successfully doing it via mouse click.

    Also, since carrying out at least 4 of those 8 steps (as I am unable to install certain programmes), my computer has yet to freeze up on me (touch wood!)

    Is there anything else you would advise me to do? I know that I need to fully remove ZA and get a firewall on my PC.

    Many thanks again!
     
  18. mflynn

    mflynn TS Rookie Posts: 2,655

    Ok ZA next!

    But first tell me what programs will not install.

    And they may install since we fixed something so try again and tell me what will not run.

    Not being able to run some things is a sing there may still be an issue we missed!

    In fact give me an overall status report of how computer works.

    Mike
     
  19. Aphrodite

    Aphrodite TS Rookie Topic Starter

    SuperAntiSpyware still will not run, showing the same error message "the system administrator has set policies to prevent this installation". Now I log in to the "Administrator" account on safe mode with networking and I still get the same problem.

    Same as above with updating Java (the installer downloads but java will not update)

    Although my computer is responding to shutdown and restart click commands through the start button, it is very reluctant to do so - taking up to 5 minutes to respond. Also, on startup (once restarted) my computer remains in the position shown in my (rough) drawing. The bar indicates my computer loading, half full meaning loading and full meaning loaded. (see attached). However, at this stage if I press the button in and restart it manually then the startup operation runs smoother. I am reluctant to do this on a regular basis as I fear it will damage my computer, but out of curiosity I found this the fastest way to restart my computer when this happens.

    Concerning the restarting issue, it does not seem to occur when I restart/shutdown from safe mode with networking and it does not happen everytime. I would say 1-2 times out of 3 tries this would happen.

    Since you have kindly helped me, my computer appears to have stopped freezing on a regular basis. I have been able to use my computer how I used to without any freezing problems.
     
  20. mflynn

    mflynn TS Rookie Posts: 2,655

    OK the good news is we can and will get Windows fixed to install etc.

    The bad news is the screen you sent is not windows but the BIOS which starts before windows.

    We will look at that after we fix Windows? And it may be something you may have to live with!

    Do the below..

    Download Dial-A-Fix (DAF)
    The download http://wiki.djlizard.net/Dial-a-fix#...C_and_articles
    Info on DAF if you want to read it http://djlizard.net.nyud.net:8080/software/Dial-a-fix-v0.60.0.24.zip

    Have XP CD available in case DAF needs a file.

    Check all boxes on the screen (clear any restrictions if it shows any)
    Then click GO!

    When the entire page is finished click the HammerHead at bottom to go to the second DAF page.

    Here 1 at a time do the below
    Flush DNS
    Flush Icons
    Process Idle Tasks
    Repair Permissions
    Reset WMI/WBEM (not reinstall)
    Watch for any File not found or other errors and make note as this may lead to the fix!

    Reboot retest!

    Try to install SuperAntiSpyware to test, if it installs update and run attach log.

    Mike
     
  21. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Well the restart was smooth with no delays upon load (a bit slow to shutdown but I can cope with that)

    SuperAntiSpyware is still not installing, showing the same error message when I try to install it.

    When I ran DAF it said that a file was missing (here is the dialog):

     
  22. mflynn

    mflynn TS Rookie Posts: 2,655

    OK we will get it! Just be patient and work with me at your own pace. I might say you are doing an excellent job.

    Just so I can be sure can you get me a screen of the install error for SAS!

    Send me the DAF log. First screen to the right of the hammer.

    Look in Add/Remove programs and see if it has SuperAntiSpyware and if so uninstall it? While there cleanup Add/remove of any old unused or useless programs. Also uninstall ALL Java start with the newest (by revision number) down to oldest.

    Reboot here!

    Clean and update Java
    Cleanup old Java and update to newest version this program will do it all for you.

    Download JavaRa http://prm753.bchea.org/JavaRa.html

    Unzip it, run it.

    Chose Cleanup old versions. Give it a minute and after it pops up the log file you will see what it removed. It may not find any if the uninstall worked!

    Then click "Additional tasks" and check "remove Useless JRE files and Remove JavaRa log files. It may not find any here either!

    Now go here: http://www.java.com/en/download/manual.jsp
    Download and then install. Watch for any check boxes to install Yahoo toolbar etc and uncheck.

    After that run JavaRa Search for Updates again using Justchk to confirm you are up to date.

    After that run JavaRa remove older versions again. This time the Log file should be empty.

    Then

    Left Drag mouse and Copy for Pasting all text in the box below.
    Make sure the slider bar goes to bottom from the @ to the end of the second exit.
    Then paste to the black screen of an open command prompt.
    Code:
    @echo off
    cd\
    attrib shdocvw.dll  >"%USERPROFILE%"\Desktop\shdocvw.txt
    exit
    exit
    Attach back the shdocvw.txt from your desktop then you can delete it from desktop.

    Mike
     
  23. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Good news - SuperAntiSpyware has installed and I've scanned my system.
    The adware which showed up has been quarantined and removed.

    I've attached the log for this and also for DAF.

    I'm getting on with the rest now :)
     
  24. mflynn

    mflynn TS Rookie Posts: 2,655

    Yes get me the SAS log!

    But I need to know what knocked it loose to give me insight to your issue.

    I need the DAF log as requested in the other post.

    I also need to know the results of cleaning up Add/Remove and installing Java and the JavaRa etc!

    And the copy paste operation to get me the shdocvw.txt

    Mike
     
  25. Aphrodite

    Aphrodite TS Rookie Topic Starter

    Right, the SAS and DAF logs are above.

    The Java uninstalled great, JavaRa found no previous versions and then Java installed fine. (no error messages!) Therefore, the logfiles of JavaRa were all empty.

    I've attached the shdocvw.txt

    Thanks again, you've sorted out so much already.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...