Computer keeps freezing up

Status
Not open for further replies.
A

Aphrodite

From viewing similar previous posts, I see it is helpful to post my computer specification:

Operating System: Microsoft Windows XP Professional

Model: Dell Dimension E521

BIOS: )Phoenix - Award WorkstationBIOS v.6.00PG

Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+, MMX, 3DNow (2 CPUs)

Memory: 1982MB RAM

Page file: 484MB used, 3391MB available

DirectX Version: DirectX 9.0c (4.09.0000.0904)

Graphics: NVIDIA GeForce 6150 LE


My computer freezes randomly (It's never when I do something specific), preventing me from doing anything for 10-15secs at a time. Also, when shutting my computer down, it will not shut down and instead remain on the "Windows is shutting down" screen until I manually shut it down.

Any help would be appreciated - if you require further information then please ask and I will do my best. :)
 
Thanks for the response - and my apologies for such a late reply.

Here is the logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:40, on 27/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 4126 bytes
Click to expand...
 
Not a lot of help!

To be positive you have no Malware do the below. Better Safe than sorry!

Run SpyBot update run the Immunize feature. No Scan for now as the below will do it better.

Boot to Safe Mode with networking and do the below attach the logs.

Do the TechSpot 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

Most importantly update MalwareBytes and SuperAntiSptware!

Before you scan with SuperAntiSpyWare do the below:

SuperAntispyware extra config

After installed double-click the icon on your desktop to run it.

Update the program definitions.

Click the Preferences button.

Then Scanning Control.

In Scanner Options make sure all boxes are checked except #3 Ignore System Restore.. are checked:

MalwareBytes extra config

After update but before running
Click settings and confirm all are Checked.

I repeat Update these 2 programs.

Run them and attach their logs.

Mike
 
Installing a Firewall

In response to your last post, you told me to ask you before installing a firewall.
I'm going to install Zonealarm (I previously had Comodo on my laptop but became annoyed at the amount of pop-ups it gave to authorise programmes) - is there anything in particular I need to do once installed?
 
Lets do the 8 Steps first. Sometimes installing something while infected can cause problems.

And I will need to help you completely uninstall COMODO, if it is not correcly uninstalled ZA may have problems installing.

If you are clean I will help you switch Firewalls. So step up and do the 8 Steps!

Mike
 
Comodo was installed on my laptop (this is my desktop), so if you could possibly reply with instructions as to how to completely wipe Comodo off the system, then that would be helpful.

I'll crack on with the 8 steps now.

Many thanks.


EDIT:

Once installing ZA my computer is awfully slow in safe mode - is this normal?
This is preventing me from accessing the internet on my pc (i'm currently on my laptop)
Any help would be appreciated.




EDIT:

After un-installing ZA, everything seems to be in order. Once ZA was installed, it came up that "TrueVector Service" was not functioning and had to close - after searching this, I discovered that this was to do with ZA. Would it be easier to just install COMODO or is there a solution?

I'm now continuing with the other steps.


EDIT:

Just attempted to install Super Antispyware (step 5) - a mesesage box appears stating that the system administrator has set policies to prevent this installation - when I log onto the "Administrator" account on my pc in safe mode, it still shows this.

Also, I receive the same error message box when trying to update Java (step 6)


So, all that's left is to install ZA, Super Antispyware and update Java - before I am able to move on,
Any help would be much appreciated.
 
Oh ye of little faith!:)
Lets do the 8 Steps first. Sometimes installing something while infected can cause problems.
Click to expand...

Oh boy ZA is hard to completely clean we will get back to it!

For now lets get it so you can install the Malware tools

Boot to Safe Mode networking and do the below.

Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

Then paste to the black screen of an open command prompt. All may not apply so ignore errors.
Code: 
@echo off
cd\
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile

sc stop TDSSserv.sys
sc delete TDSSserv.sys
:: Above sc commands first stops then deletes service if it exists
::
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
::
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
::The above reg commands first unloads the reg keys then deletes these keys.
::
Attrib -h -s -r tdss*.* /s
del  tdss*.* /f /q /s
:: The above two lines first clears protective attributes then 
:: deletes all files on Drive beginning with the name tdss

:: Remove AntiVirus2009
attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"

del "%UserProfile%\Desktop\Antivirus 2009.lnk" /f /q
del "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk" /f /q
del "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll" /f /q
del "%UserProfile%\Start Menu\Antivirus 2009\*.*" /f /q

rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"

attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
rd /s/q "c:\Program Files\Antivirus 2009"

attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
attrib -h -s -r c:\WINDOWS\system32\scui.cpl
attrib -h -s -r c:\WINDOWS\system32\winsrc.dll

del c:\WINDOWS\system32\ieupdates.exe /f /q
del c:\WINDOWS\system32\scui.cpl /f /q
del c:\WINDOWS\system32\winsrc.dll /f /q

reg delete HKLM\SOFTWARE\swearware /f
reg delete HKCU\Software\Wget /f
reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f

reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
echo Finshed ripping out Antivirus 2008-9
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile
exit
exit


Once the above is complete reboot again into Safe Mode networking and continue with the 8 Steps.

Mike
 
I'm afraid that I'm still receiving the same error message box stating "the system administrator has set policies to prevent this installation". That appears when I attempt to update Java and attempt to install SuperAntiSpyware onto my system.
 
Did you do the copy paste in my last post?

Mike

EDIT and what about MalwareBytes antimalware? Will it install?
 
Yes I did the copy paste into a dos command box, and nothing changed.

And MalwareBytes installed perfectly, I'll attach the log here.
 
OK Boot to Safe Mode with networking and do the below.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike
 
Here are the logs attached as requested.

Just wanted to note also that when I try to restart my computer with the restart button, it freezes upon startup. Therefore, I have to shut it down manually and then switch it back on.
 
So it goes thu shutdown and turns itself off?

What if you use Start-Shutdown and don't use the button?

But we are now clean so lets do some cleanups to try and help the Shutdown issue.

Run CCleaner from the 8 Stepsagain twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner.
-------------------------------------------------------------------------------------
The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.

Do this and use the mouse to shutdown windows instead of the Switch.

Let me know the results.

Mike
 
Sorry for not being clearer - when I restart the pc I use the mouse through the start menu, and then it freezes upon loading again.

I'll still carry out the steps you told me to and edit this post when finished.


EDIT:

Despite our misunderstanding, that seems to have solved that problem. Although it is sometimes slow to shutdown/restart, it is successfully doing it via mouse click.

Also, since carrying out at least 4 of those 8 steps (as I am unable to install certain programmes), my computer has yet to freeze up on me (touch wood!)

Is there anything else you would advise me to do? I know that I need to fully remove ZA and get a firewall on my PC.

Many thanks again!
 
Ok ZA next!

But first tell me what programs will not install.

And they may install since we fixed something so try again and tell me what will not run.

Not being able to run some things is a sing there may still be an issue we missed!

In fact give me an overall status report of how computer works.

Mike
 
SuperAntiSpyware still will not run, showing the same error message "the system administrator has set policies to prevent this installation". Now I log in to the "Administrator" account on safe mode with networking and I still get the same problem.

Same as above with updating Java (the installer downloads but java will not update)

Although my computer is responding to shutdown and restart click commands through the start button, it is very reluctant to do so - taking up to 5 minutes to respond. Also, on startup (once restarted) my computer remains in the position shown in my (rough) drawing. The bar indicates my computer loading, half full meaning loading and full meaning loaded. (see attached). However, at this stage if I press the button in and restart it manually then the startup operation runs smoother. I am reluctant to do this on a regular basis as I fear it will damage my computer, but out of curiosity I found this the fastest way to restart my computer when this happens.

Concerning the restarting issue, it does not seem to occur when I restart/shutdown from safe mode with networking and it does not happen everytime. I would say 1-2 times out of 3 tries this would happen.

Since you have kindly helped me, my computer appears to have stopped freezing on a regular basis. I have been able to use my computer how I used to without any freezing problems.
 
OK the good news is we can and will get Windows fixed to install etc.

The bad news is the screen you sent is not windows but the BIOS which starts before windows.

We will look at that after we fix Windows? And it may be something you may have to live with!

Do the below..

Download Dial-A-Fix (DAF)
The download http://wiki.djlizard.net/Dial-a-fix#...C_and_articles
Info on DAF if you want to read it http://djlizard.net.nyud.net:8080/software/Dial-a-fix-v0.60.0.24.zip

Have XP CD available in case DAF needs a file.

Check all boxes on the screen (clear any restrictions if it shows any)
Then click GO!

When the entire page is finished click the HammerHead at bottom to go to the second DAF page.

Here 1 at a time do the below
Flush DNS
Flush Icons
Process Idle Tasks
Repair Permissions
Reset WMI/WBEM (not reinstall)
Watch for any File not found or other errors and make note as this may lead to the fix!

Reboot retest!

Try to install SuperAntiSpyware to test, if it installs update and run attach log.

Mike
 
Well the restart was smooth with no delays upon load (a bit slow to shutdown but I can cope with that)

SuperAntiSpyware is still not installing, showing the same error message when I try to install it.

When I ran DAF it said that a file was missing (here is the dialog):

Error -2147319780 was encountered while trying to register C:\WINDOWS\system32\shdocvw.dll. The error text is: Error accessing the OLE registry.
Dial-a-fix currently has no suggestions for this error code. Please email dial-a-fix@DjLizard.net with a copy of the log pane and any details you can provide about this error.
Click to expand...
 
OK we will get it! Just be patient and work with me at your own pace. I might say you are doing an excellent job.

Just so I can be sure can you get me a screen of the install error for SAS!

Send me the DAF log. First screen to the right of the hammer.

Look in Add/Remove programs and see if it has SuperAntiSpyware and if so uninstall it? While there cleanup Add/remove of any old unused or useless programs. Also uninstall ALL Java start with the newest (by revision number) down to oldest.

Reboot here!

Clean and update Java
Cleanup old Java and update to newest version this program will do it all for you.

Download JavaRa http://prm753.bchea.org/JavaRa.html

Unzip it, run it.

Chose Cleanup old versions. Give it a minute and after it pops up the log file you will see what it removed. It may not find any if the uninstall worked!

Then click "Additional tasks" and check "remove Useless JRE files and Remove JavaRa log files. It may not find any here either!

Now go here: https://www.techspot.com/downloads/6463-java-se.html
Download and then install. Watch for any check boxes to install Yahoo toolbar etc and uncheck.

After that run JavaRa Search for Updates again using Justchk to confirm you are up to date.

After that run JavaRa remove older versions again. This time the Log file should be empty.

Then

Left Drag mouse and Copy for Pasting all text in the box below.
Make sure the slider bar goes to bottom from the @ to the end of the second exit.
Then paste to the black screen of an open command prompt.
Code: 
@echo off
cd\
attrib shdocvw.dll  >"%USERPROFILE%"\Desktop\shdocvw.txt
exit
exit

Attach back the shdocvw.txt from your desktop then you can delete it from desktop.

Mike
 
Good news - SuperAntiSpyware has installed and I've scanned my system.
The adware which showed up has been quarantined and removed.

I've attached the log for this and also for DAF.

I'm getting on with the rest now :)
 
Yes get me the SAS log!

But I need to know what knocked it loose to give me insight to your issue.

I need the DAF log as requested in the other post.

I also need to know the results of cleaning up Add/Remove and installing Java and the JavaRa etc!

And the copy paste operation to get me the shdocvw.txt

Mike
 
Right, the SAS and DAF logs are above.

The Java uninstalled great, JavaRa found no previous versions and then Java installed fine. (no error messages!) Therefore, the logfiles of JavaRa were all empty.

I've attached the shdocvw.txt

Thanks again, you've sorted out so much already.
 
Status
Not open for further replies.

Similar threads

D
Is it possible to stop my PC from locking up?
Replies
3
Views
2K
Cycloid Torus
Cycloid Torus
Ladybug91
My Computer keeps shutting down and freezing
Replies
4
Views
2K
bazz2004
B
B
Finding compatible RAM for old motherboard
Replies
4
Views
6K
captaincranky
captaincranky

Latest posts

Back