Vista PC acting strange

[goombawaho]

Got a Vista SP2 machine that is acting strange. 64 BIT - 4 GB RAM

0. Explorer crashes and restarts a couple minutes after getting to the desktop (every boot cycle).

1. Executables (process explorer, MS word) don't want to launch. No errors - they just don't launch. It's like the machine is on downers.

2. PC sits there for 5 minutes or more before it will shut down - hard drive light churning away.

What I've done:
1. Removed a virus using MalwareByte's and ComboFix, so I believe 100% the system is clean. It was running poorly before the malware, but I don't have a direct comparison because I wasn't there.

2. Reduced startup items with Autoruns down to very little

3. Cleaned out temp files and registry with CCleaner

4. Ran SFC /SCANNOW from ADMIN CMD prompt.

5. Checked the Event Viewer but nothing really juicy in there ("Explorer crashed" - yes I knew that!!!)

Things I was thinking of doing tomorrow:
0. Memory Diagnostic Test
0.5 Check Disk
1. Vista Startup Repair from F8 menu or Vista CD
2. System Restore (don't really want to do that)
3. Reload from Recovery Partition (don't really want to do that)

Any other ideas???? I'm pretty stumped. Help BadBigBen/KJV/Linney or anyone else. I need some brainiac thinking.

 

[BadBigBen]

Goom,

you pretty much have it covered, the first thing that jumped to my mind was a memory problem...

a second thought would be a Registry corruption...

and the third, you got covered as well, with point 0.5...

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

Okay - will run mem test and then a check disk just because of all the bad shutdowns.

What are you recommending for "registry corruption" if a chkdsk doesn't do anything - System Restore?

 

[linney]

What is it like from Safe Mode, or from Normal Mode but with a different user?

Fix a corrupted user profile

http://windowshelp.microsoft.com/Windows/en-US/help/769495bf-035c-4764-a538-c9b05c22001e1033.mspx

Did you try MalwareByte's via Safe Mode, it might find a few more things (in Safe Mode) than in Normal Mode?

 

[BadBigBen]

> What are you recommending for "registry corruption"

First I would use CCleaner or ERUNT (or both) to scan and fix the registry...

and restoring the registry would simply entail going back to a previous restore point (which you said you'd wish to avoid)...

ERUNT
The Emergency Recovery Utility NT

http://www.larshederer.homepage.t-online.de/erunt/

but in the end, it may be more prudent to go ahead and do Step 3...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

Ok - no more updates or advice as I'm head off to do the business. I'll update later.

Safe mode seemed to be better (almost normal behavior) when I ran Combofix from it yesterday. I don't think I did any damage with the malware removal and SFC /SCANNOW should have fixed that anyway.

I'm going to do these in the following order:
check the memory
run chkdsk
try startup repair
try shutting off everything non-madatory with Autoruns
try a system restore
reload

 

[goombawaho]

Okay - it was caused by the following:

HP CUE Device Discovery Service (HPQDDSVC) hanging repeatedly. I shut the service down permanently and things were much better.

Also disabled the WMPNSCFG.exe from starting up via registry entry.
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\HME
added DWORD DisableDiscovery and set value to 2

 

[BadBigBen]

Good job, Detective Goom... ;-)

thanks for posting what the trouble was...

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

Yeah, I was on the verge of the computer equivalent of smashing with a hammer (full reload), but the Windows Reliability and Performance Monitor showed me how many times the one HP service had hung so that made me suspicious of it.

Funny - that's the second time in two weeks that service has caused a problem. The other was "disappearing printer" on XP.