Slow Loading Applications

[dexterdoo]

When I start an application, it takes the better part of 30 seconds to load. For example, clicking on a Word doc. file now takes 25 secs. to load (in safe-mode the same file loads in 7 secs!) Seems like this problem started after I was attacked by spyware and used Norton,Ad-aware,CWShredder et al to remove it. (I ran these programs while in normal, NOT safe-mode, does that matter???) The computer now appears to be clean and running well except for this slow loading problem. I'm running Win98SE and am trying to fix this without wiping my drive and reloading my tons of software. ( Any suggestions on what to troubleshoot would be greatly appreciated. Thanks in advance! )

 

[oldcomptrguy]

Normal/SafeMode really does not matter when running those spyware removal programs.

It sounds like it just needs to be cleaned a little more. Open in the Safe Mode, go to Programs, Accessories, Systems Tools, and run the Disk Cleanup, Scan Disk (Standard/Auto Fix Errors) and the Disk Defragmenter. Restart the comptr.

Go to

http://www.5starsupport.com/info/startup.htm

and make a copy of that startup programs list. Exit the web.

Go to Start, Run, and type MSCONFIG, Choose Selective Startup and then from the Startup Tab, using that list, uncheck as many applications as possible. Click Apply, OK and restart the comptr.

There are some resource hog programs, such as Go Back or Norton Systems Works which will slow the comptr down.

There is also the possibility of some spyware remaining. Look in Add/Remove Programs and see if there are any applications still listed that you don't want. Also, go to My Computer, C Drive, Programs folder and look the any left over folders. If in doubt, open it and see if its anything you need. If not, right click, delete.

 

[dexterdoo]

One more thing, no matter how many times I remove this from the Startup, it keeps coming back! Anyone know (emphasis on "know")what this is:

C:\WINDOWS\SYSTEM\WdkC.exe

 

[oldcomptrguy]

That is spyware. Download, update and run AdAware.

http://www.download.com/3000-2094-10045910.html?legacy=cnet

If that fails to clear it out go to My Computer, C Drive, Windows Folder/System32 and find WdkC.exe and right click and delete.

 

[dexterdoo]

Ok,I removed that file but like I said before, it gets replaced when I reboot!

Also, everytime I run scandisk, I get an error saying it can't continue because another program is writing to the disk!(and nothing else is loaded & I'm in Safe Mode!) When I re-try, it crashes and I get the Blue Screen of Death! Same thing happens in Safe or Normal mode. Something is still lurking on my hard drive ! I bet whatever is causing this, is causing the slow loading of my applications too. Ad-aware and Norton AV are coming up clean but I think there's still something that they are missing???

I'm going to try Spybot next, just because I haven't yet!

 

[oldcomptrguy]

It sounds like the carrier for the spyware is still installed on the comptr. Do you have any of the following known spyware carriers?

Kazaa, Gator, IMESH, HotBar or other added tool bars, 180Search, Prosearching or other added search vehicles, FunWebProducts, Smileys from Smiley Central, Comet Cursor, BarginBuddy, Virtual Bouncer, most free screensavers/wallpapers. There are hundreds, but these are the ones I see most often.

 

[cdogg]

This site may help:

http://www.geocitites.com/cc210026/spywareinfo.html

Both Spybot and Ad-aware should have options to scan at startup before Windows loads. Doing so should effectively remove the threat for good, assuming either app recognizes it as spyware.


~cdogg
[tab]"All paid jobs absorb and degrade the mind";
[tab][tab]- Aristotle
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884

 

[dexterdoo]

The only toolbar I use is Google. I have KazaaLite installed on D:\ but that's it.

Spybot found 117 items (even after running Ad-aware) but after re-booting, the WdkC.exe file had been re-installed and loading a Word document still took 25 seconds! So basically, I'm still up the creek. ( You would think that,per Scandisk, a program that was running in the background and trying to write to my drive would stick out like a sore thumb ???

 

[cdogg]

First of all, did you try the suggestion to run Ad-aware or Spybot at startup? I know Ad-aware has an option to set it to scan before Windows loads. Also make sure you update it first from within the settings.

If that still doesn't do it, then try this:

1) Go to Start -> Run, type regedit and hit OK
2) Navigate to:
[tab]HKey_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run (also check RunServices)
3) Delete the key that refers to WdkC.exe and close out
4) Go to Start -> Run, type msconfig and hit OK
5) On the startup tab, uncheck everything
6) Hit OK and reboot when prompted
7) Once back up, run both Spybot and Ad-aware again (make sure they're have both been updated).

Good luck!



~cdogg
[tab]"All paid jobs absorb and degrade the mind";
[tab][tab]- Aristotle
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884

 

[oldcomptrguy]

Did I miss read you cdogg? He's running 98 and the Startup Tab contains some mandatory items in order for Windows to boot.

Check out the startup programs list at

http://www.5starsupport.com/info/startup.htm

Uncheck all the unnecessary applications on the Startup Tab.

 

[dexterdoo]

Cdogg, I couldn't find that setting in either Ad-Aware nor SpyBot! Can you tell me where it is ? Also, I was finally able to run Scandisk from the Dos-mode (and it reported that my hard drive is fine) but it still crashes the computer if I run it in Normal mode. So, there's no doubt that some program is keeping my computer from functioning properly... Meanwhile,I'll edit the reg. and remove that file.

 

[dexterdoo]

Each time I deleted WdkC.exe from the reg. it gets replaced when I re-boot! This is the way it appears in System Config.

3@8QN#E2S#486T C:\WINDOWS\SYSTEM\WDKC.exe

 

[TekTippy4U]

dexterdoo;
first;
Do everything while disconnected from Internet, and only the necessary windows open to perform cleaning.

For MS Word
Find Normal.dot and rename .old, reboot (Winword will re-create virgin copy of corrupt template for you).
In "Options" - Turn off the Auto-save feature in Word , and turn off that crappy 'scan for macro-viruses' crud...(it's likely you may have some, along with the other probs)

Start > Run SYSEDIT
>> Search menu >> Find
4-5 windows will open, click the Title Bar on each, one at a time and perform search - type in
3@ and hit enter (first)
WDKC.exe (second)and hit enter, use F3 to continue search.
Delete all instances you may find. Save file changes and exit and reboot

Scandisk needs to finish properly....possible Norton's ver is interfering? Run it in SafeMode (boot into safemode) after DOS mode, but before Normal mode.

When you say;
3@8QN#E2S#486T C:\WINDOWS\SYSTEM\WDKC.exe
appears in System Config...."where" exactly in Sys config?
It looks like a Spoofing vulnerability, in which you constantly are reinfected from a munged WebSite address (from Spyware).....using Broadband?
it's this [3@8QN#E2S#486T] that's reinfecting you, and recreating the file...and very insidious spyware/trojans/worms can make this jumble of numbers and letters change as well on each boot.
If necessary, you may need HijackThis!
Download from here
Got any GATOR, GAIN, COMET, KAZAA crap installed in Add/Remove??? Uninstall that crud.

I could continue to help if the remedies I listed don't work (there are a few things to know, to use hijack correctly), however we have a Virus/Spyware forum specifically for this. Forum760
If you post there....put a pointer back to this thread.
(I'll jump over there as well to see if you've posted, to continue helping)

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[cdogg]

Did I miss read you cdogg? He's running 98 and the Startup Tab contains some mandatory items in order for Windows to boot.

No you didn't. Yes, there are important entries on the startup tab that should ultimately be left checked, but during troubleshooting they are not necessary. For instance, two examples are scanreg (backing up the registry) and LoadPowerProfile (to keep powersave settings). While both are nice to keep, it doesn't hurt to disable them temporarily.

The reason for this suggestion is that perhaps there is another app being loaded that re-creates the WdkC.exe entry each time. Since it doesn't happen in Safe Mode, it's either coming from there or perhaps other system files like system.ini. It's got to be some process being invoked at startup.

dexterdoo,
"[blue]I couldn't find that setting in either Ad-Aware nor SpyBot[/blue]"

In Ad-aware, select "Use custom scanning options" then click Customize. Make sure everything under Memory and Registry is checked then click "General" over to the left. You'll see the option to "Run at Windows Startup". In addition, verify whether you've used the option "Check for updates now" in Ad-aware.


~cdogg
[tab]"All paid jobs absorb and degrade the mind";
[tab][tab]- Aristotle
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884

 

[torturedmind]

i suggest also to delete the entire content of your temporary folders such as the %WINDIR%\TEMP and your internet cache folder. but be careful not to delete the wrong folder or you might end up re-installing everything. i suspect that the app that loads your bogus file is a cmpressed file and maybe hidden in those folders masked as a .TMP file or a .DLL file or a .SYS file. (hell, maybe it was named as one of windows system files!) to delete the contents of your temporary folders, i strongly suggest you use a third party software like the IE Privacy Keeper. you can download a copy of it from

http://www.browsertools.net/downloads/IEPrivacyKeeper.exe

thanks to unhsolutions for this freeware. (yes it's free!) install it, re-boot in safe mode and then... i think you can figure out the rest.

hope this helps. peace!


kilroy
philippines

"Illegitimis non carborundum!"

 

[dexterdoo]

torture, I did delete the contents of the folders you mentioned (that was one of several suggestions that I tried from Microsoft). Something is definitely hiding. I'm not sure what this is: C:\WINDOWS\SYSTEM\ntsysl.exe
It's also in my startup configuration ??? Also,what does IEPrivacyKeeper do?

cdogg, thanks for the tip on Ad-Aware. I'll give it a shot tomorrow (I'm exhausted now) and get back to you with the results.

TT4U, you gave me some serious homework! ) I don't mind cuz i'll do anything to keep from wiping and reloading!!! As I stated above, i'l be working on all of this after a good night's sleep and will definitely report back on the results as soon as I finish everything! Thanks guys - this is an incredible site that I've stumbled across,in my hour of desperation! Good night

 

[torturedmind]

here's what IEPrivacyKeeper does to your pc:

http://www.unhsolutions.net/IEPK/index.shtml

kilroy
philippines

"Illegitimis non carborundum!"

 

[TekTippy4U]

dexterdoo;
there's not really too much to do in my last post

[1] It's usually going to be loading from 1 of 4 places, and 3 of them can be accessed using SYSEDIT
-- Autoexec.bat
-- System.ini
[boot]
shell=explorer.exe (nothing ELSE should be here)
-- Win.ini
[windows]
load= (should be blank)
run= (should be blank)
(note; a legitimate "printer" entry may be located in here sometimes)

You can basically ignore my "search" instructions in SYSEDIT (it was supposed to be a timesaver), and view the files and sections listed above manually, (using SYSEDIT) and edit the text files accordingly to remove only the Bad Entries. Save the Changes. This method will usually stop the malware from loading, but the root cause still needs to be found and killed! (one possible hiding place is below)

[2] the 4th out of 4 usual place is in C:\WINDOWS\Downloaded Program Files folder.....as an ActiveX control (HijackThis will list these as DPF, located at the end of log).

There "are" many more, but these are the usual, and possibly a BHO is the cause.....either way, just D/l and run HijackThis and Post the HJT log as a text file "right here".....the suspense is really not necessary. You need to put HijackThis in it's own folder (ex. C:\My Documents\HJT) - and also "Enable everything" listed in MSCONFIG, so ALL the junk loads, before scanning with HJT. Close all other windows and run HJT
Basics Here

BTW;
torturedmind offers up a good tool - however it , by itself, might not snag your "whole" problem. It will definitely help in the future if you continue using IE.....(some / most of the things it does can be done with "tweaks", but why bother, since it's free)

-- more homework-- ;
See this to change your ActiveX security settings in IE

http://www.mvps.org/winhelp2002/unwanted.htm

and think about switching browsers to Mozilla/Firefox

http://www.mozilla.org

(free) or even Opera (for a fee?).

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[TboneJr]

Hello

Have you tried cwshredder I was having some of the same problems and this really helped a lot.

http://www.majorgeeks.com/download4086.html

See ya

Tbone

 

[TekTippy4U]

hi TboneJr;
I usually recommend CWShredder first thing...however if you read the author's first post, you'll see he used it already (and more than once if you keep on)

BTW....My link got munged somehow (from 7-12) - so I'm fixing it

http://www.mvps.org/winhelp2002/unwanted.htm

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs