Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Computer freezing-HJT log

Status
Not open for further replies.

fenix

Technical User
Mar 29, 2001
436
0
0
US
Hi, I'm running in safe mode because my xp pro won't boot up. It gets the the XP splash screen with the status bar then after about 15 seconds goes to a graying blank screen with only a mouse pointer. Sometimes the pointer moves and sometimes it freezes after movng it for a few seconds.

I was thinking I might have bad memory or a failing HD, but I've been running in safe mode for 2 days straight with no issues until a few minutes ago when I wrote this whole post out everything froze and I had to do another hard shut down. When it freezes I get a continuous noise out of the tower: a continuous beep that sounds like it is coming through the little speaker that gives you bios error codes.
If I can get to the end of writing this and post it, here is my HJT log for an expert to look at and advise if there are issues. At first I thought it might be a failing h ard drivfe or bad memory, but maybe it's the remains of 2 trojan viruses that I removed about 4 days ago in 2 seperate incidents. Used AVG to remove them. Here's my log
------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:44:50 AM, on 3/7/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [SPC1300] C:\WINDOWS\vspc1300.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O15 - Trusted Zone: O15 - Trusted Zone: bar1.nxcore.net
O15 - Trusted Zone: bar2.nxcore.net
O15 - Trusted Zone: ameritrade01.streamer.com
O15 - Trusted Zone: ameritrade02.streamer.com
O15 - Trusted Zone: ameritrade03.streamer.com
O15 - Trusted Zone: ameritrade04.streamer.com
O15 - Trusted Zone: *.streamer.com
O15 - Trusted Zone: apis.tdameritrade.com
O15 - Trusted Zone: O15 - Trusted IP range: 204.58.27.34
O15 - Trusted IP range: 204.58.27.35
O15 - Trusted IP range: 204.58.27.42
O15 - Trusted IP range: 204.58.27.43
O15 - Trusted IP range: 204.58.27.50
O15 - Trusted IP range: 204.58.27.51
O15 - Trusted IP range: 204.58.27.58
O15 - Trusted IP range: 204.58.27.60
O15 - Trusted IP range: 204.58.27.199.200.9.1
O15 - Trusted IP range: 199.200.9.39
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} - O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - O16 - DPF: {339234B4-4E14-4280-B8B4-8BAE5AF99063} (Chess Object) - O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - O16 - DPF: {D6526FE0-E651-11CF-99CB-00C04FD64497} (Microsoft MSChat Control Object) - O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - O16 - DPF: {F773E7B2-62A9-4524-9109-87D2F0BEFAA4} (ChessControl Class) - O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
O23 - Service: lxdx_device - - C:\WINDOWS\system32\lxdxcoms.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--
End of file - 9533 bytes
 
The HJ log was kind of a waste as you're trying to start in the middle of troubleshooting instead of the beginning.

Start with the memory test and move onto the hard drive test. You can run them both after creating the bootable Ultimate Boot CD.
Then install and run MalwareByte's Anti-Malware and see what pops up there.

Run a Chkdsk after that and see if anything has changed in terms of booting/running in normal mode.
 
OK, went to that website and don't really want to pay $49.95 for Windows repair/cleanup etc. Also I found no references to memory or hard drive checking on that website.

I did not know that my logs can't be analyzed until I test my memory and hard drive. Is that what you are saying ?

Do you know of any websites that test ? I know crucial can tell you what kind of memory you have installed but not sure if there's any software that does this. (?)

Does freezing up on normal boot up sound like memory or a hard drive to you ?

 
PS-more info...malwarebytes ran a check and found all kinds of errors so I did try to download and purchace it for $29.95, but when I completed the credit card section another verification window popped up and wanted my ATM pin. That's a new one on me. I tried to enter it a few times and the window just stood there rapidly blinking, everything froze and another hard shut down was required.

Any more ideas welcomed.

 
The continuous beep you mention is a worry, have you tried detaching any easily removed hardware, and also setting the Bios to any Safe Defaults setting?


Malware bytes is free to download, there is a "Pro" version that can be purchased, but the free one is more than adequate for a once only scan to remove malware.

Malwarebytes' Anti-Malware


As to $46 for memory testers, try these free bootable programs.


The hard drive manufacturer will have free diagnostic software on their web site to thoroughly check the condition of your hard drive.

You can also run ChkDsk /r from the Recovery Console.

How to install and use the Recovery Console in Windows XP

I am not a Hijack This log analyzer but have a look at these types of entries and make sure you know what they are in there.

Have a look at the 015 entries in your log and make sure you know what ameritrade is all about.

O16 - DPF: {03A0F84E-3E69-4B3E-B4D3-019CB73B57B3} -
O16 - DPF: {D6526FE0-E651-11CF-99CB-00C04FD64497} (Microsoft MSChat Control Object) -
 
Thanks for the reply. I disconnected a usb webcam, no help. I ran malwarebytes fast scan and it found 26 items, including installers and a few trojans, and removed them. I then did a deep scan and it found 3 more installers. I was hoping this was the cause of the freezes but I rebooted as it asked to do and let it go to normal boot: computer froze at the same point; dark gray screen with only a mouse pointer, which then freezes after a few seconds of movement. Restarted and it goes to safe mode w/net no problem or lockups. Less infections but same issue. I'll look into the hardware side and/or reinstall the OS>
 
Does it go into Normal Mode if you try another Keyboard or Mouse?

This is a guide of Beep Codes from the Bios.

Beeps codes are the audio beeps that the mainboard will output when your system has problems. Generally they are used to identify booting problems.

Power On Self Test Beep Codes for AMI and Phoenix BIOS
 
Might be a mouse issue but still not sure.

I dug up 2 old ps-2 kybds. I was using a MS usb wireless mouse/kybd which I removed after shutdown. When I tried each ps2 kybd with a ps2 mouse, I got a rapid beeping on power on. The only continuous beep I found in the bios code tables said, "continuious beeping=Power supply, system board, or keyboard problem". I never had that problem before I went to a wireless kybd/mouse so ... ? I will try to remove the usb from the wireless kybd/mouse module while power is on to see it that changes anything.

Still not sure if it's hardware or software. It just doesn't seem that a hardware issue (mouse, HD, memory) would work in safe mode but not in normal mode. I would think it would act the same in either mode. Maybe I can get my HJT logs looked at in the virus forum.

I tried dianostic start-up items in msconfig, as well as a bare selective start-up but no help with trying those.

thanks



 
When it freezes I get a continuous noise out of the tower: a continuous beep that sounds like it is coming through the little speaker that gives you bios error codes.
sounds like a hardware issue, and in SafeMode most drivers are not loaded, thus certain hardware is not activated, unlike NormalMode...

with all those infections that you had(have), one of which may have damaged drivers or system files, that can cause a wrongful access of a piece of hardware...

I would suggest that you move all your personal data from that drive, then nuke the drive (format it) and reinstall XP from scratch...

once you are installing the drivers and the PC freezes again, then you know definitively that one or more hardware components are damaged...



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"
 
You clicked on the wrong thing - that's an advertisement.

Here's the link to what I was talking about. Get this and do the tests as requested. Yes, we could look at your log and it looks okay, but a hardware issue will trump ANY software issue.

Look down further on the page - lots of links/mirrors. FREE
 
fenix,

Just a quick note here - didn't finish reading the rest of the posts, just skimmed over. It sounds like you have some hardware issues AND SOME MALWARE INFECTIONS.

You at least have some sort of hijack going on - DO NOT proceed to any websites on THAT machine. Use a CLEAN machine to download any antimalware apps.

Also you, said you already entered your credit card info on an order page for malwarebytes, but it asked for your ATM pin? that's definitely a hijack, as no valid business will ask for that. On a non-computer side, purely business/financial, you NEED to keep a close eye on your credit card statements. Report any suspicious activity IMMEDIATELY. Actually, based on that, I'd say if you can do without your card for a week or two, to request they change your credit card number, to make sure you don't suddenly get dinged for a bunch of charges. That may seem overboard, but I'm not so sure in this case.

You said UltimateBootCD wanted to charge $49.95. It's 100% free, so only a browser hijack would tell you that - they sent you to a fake page, hoping you'd try to buy it.

For MalwareBytes, they have a free version and paid version. However, they don't require you to pay up front to download it - even the paid version has a 30 day trial or something like that, I believe.

Do this:
1. From a clean PC, download and burn to CD one of these:
DrWeb Live CD
Avira Rescu CD

2. Boot the infected/damaged system from whichever CD you burned.

3. Post back here with anything found, to help verify it's bad before you try to remove the infections - just to be sure in case of false positives...

4. Remove everything that is not questionable as being false positives..

5. See if that clears up your hijacks..

----------------

However, if you first download UltimateBootCD as mentinoed by goombawaho ON A CLEAN PC, and run it, it will run outside of Windows, so it would be safe to boot the infected machine from, and do some hardware scans, as it does sound like issues there as well.... and it may not even be worth the time of trying to remedy the malware issues... I'd just not even boot the infected PC if at all possible until you've cleaned it or wiped and reinstalled... after verifying the hardware..
 
thanks for the replies. Usb wireless kybd/mouse work fine, it was just the ps2 kybd that caused that noise. I had a suggestion to try ctrl + esc when it is trying to boot but that didn't seem to do anything but it might have cause a BSOD to come up for the first time. The error was a stop called "drvmcdb.sys". I researched it and found that this 85kb file existed in windows as well as in a Sonic (recording software) installer folder. I deleted this one, but it didn't help the boot freezing issue. I googled this file and it said that malware will sometimes disquise itself as this file, but removing it didn't help.

I have everything backed up so I'm probaby going to proceed with the fresh install. DEbit card transactions are normal but I will request a card with new numbers on it.

to kvb, I will try to download DRweb from another computer and run it on infected one and get back. I rather do that then go throuugh about 12 hours of updating 2 Service Packs and 6 years worth of updates

thanks to all
 
Please do the hard drive and memory tests first before you do a complete reload. If you have memory or hard drive issues, you want to address them before you go to the trouble of reloading and having it fail part way through.
 
I rather do that then go throuugh about 12 hours of updating 2 Service Packs and 6 years worth of updates
a fresh install of XP SP3 (slipstreamed) and the 65 plus Hotfixes (after SP3) should not take more than an hour and a half...

slipstreaming the Service Packs is the Key, and you actually only need SP3... use nLite for easy integration of the SP and Drivers...

nLite


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"
 
That is correct - 1.5 hours on a "decent" machine to get it current on all MS updates. It's worse to spend 4 days on a machine and then give up in the end, just to have to reload.
 
BadBigBen said:
a fresh install of XP SP3 (slipstreamed) and the 65 plus Hotfixes (after SP3) should not take more than an hour and a half...
Really?? Even with an XP Pro CD slipstreamed with SP3 (which many don't have), you can really install Windows (let's not forget chipset, video, nic etc drivers needed) and the 65+ updates in 1.5 hours??? Including IE 8? And the .NET's? and the .NET updates?

Wow, takes me closer to 3 hours. Of course, I don't trust running all 65 updates in one shot, and I also get Windows Media Player and a few other "optional" updates, so I'm doing it in 3 or 4 passes... maybe this accounts for the extra time.
 
Yeah, it can be done. Of course you CAN take longer if you want to.

You can slipstream SP3 as well onto the CD. You don't have to use a disk of it, you can simply download it from Microsoft's website.

Also, for your drivers, many of those are slip-streamable as well, not to mention the many driver packs out there. For anyone who will be reinstalling the same system over a time or two, slipstreaming in this way is well worth it.... not to mention you can include your Product ID as well if you prefer...

Man, just talking about this is making me wonder why I never pushed myself to do further testing than I did with slipstreaming. I got it to work once before, it was pretty straitforward, but I overdid it, really. [blush]

Anyway, yeah, 1.5 hours is definitely doable. It depends upon your hardware, your situations and circumstances, your methods, etc..
 
I do it all the time on my job. Your mileage may vary if you're running a Pentium IV 1.0 GHz with 256MB of RAM, buy YES - a decent machine.

I don't even slipstream anything except SP3 and I get all the updates including IE8.

Usually, you would copy (especially on a Dell) the DRIVERS folder that will have all your drivers before you reload and then it's bang, boom, bam.
 
My own impatience may work against me... I do other things during a reload, so maybe the screen is sitting at "Please Reboot" for longer than I realize, giving the illusion of a longer time. And yea, the machines I deal with tend to be not as bad as Pentium IV 1.0 GHz / 256MB... but they are not that much better. The fast ones I deal with dont have XP.

Actually, it seems to be the .NET installs/updates that are a pain... I seem to remember a .NET update (3.5 SP1 maybe?) that takes like 15-20 minutes alone... I will time myself next time out of curiosity :)

 
Hi all,

I reinstalled fresh from the Dell disk. Everything was perfectly normal except I get one single beep (sometimes) when I delete an email or change to another identity.
Computer was getting 11Mbps download speeds and was blazing like I haven't seen in a long time. I started updating and the 2nd update loaded SP2 which seems to have significantly slowed down my internet speed. I'll probably do more updates and SP3 if this computer proves worthy of continued use.

One issue: I sometimes get a single beep (mb speaker) when I delete an email in O.E.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top