Gary - anybody - help please?

[1STLITE]

I think my system is having some issues. I have always been pretty good at figuring out what was going on with her, but right now I just don't have the time or the patience to figure out what it is I need to be doing to make things run more smoothly. I usually consult the folks at majorgeeks, but figured I'd just ask here - and ask Gary . I want to replace my system soon, but right now I can't. Last night it even shut down by itself, which really freaks me out.

Let me know what you need to know about it and I will tell you. I appreciate it very much. Right now PS is so slow I can barely work at all, and I have ALOT to get done. I am about to cry - seriously.

Thank you so much!

Dawn

[Kraellin]

just a quick reply before i go to work. it sounds a LOT like a drive going bad. make sure you have everything saved to backups! check windows explorer to see if all your drive letters are showing up and check bios to see if they are showing there also.

[NancyJ]

When did the problems start - did you do anything just before they started?
Are you drives compressed (is the text blue instead of black in the folders list)
If its shutting down by itself check that you have 'automatic restarts' turned off and error loggin turned on in you my computer->properties->advanced-> system settings and startup (or something like that)
If those are on look for an event in the event manager at the time you shutdown and look for a minidump - these will contain vital debugging information

[1STLITE]

They show up in explorer no problem. I can't remember how to get to the bios, so any help there appreciated. And thanks for scaring the crud outta me, Criag. lol - j/k, I appreciate the help.

I have an external Seagate drive that I use for storing photos, etc. I also use it as a scratch disk in PS. IT is connected through firewire. I have always been able to get this machine to run really smoothly, and for the most part you would never know I only have 512 in ram. But over the last week or so this thing has just been running ridiculously slowly. I have trendmicro pc-cillin and it is updated and running as usual. I have not had problems with adware since using that and firefox, quite a while now. I just do not know where to go form here, since nothign seems to have gotten out of wack, at least not as far as my untrained brain can figure.

Last night when it shut down on me, I had just restarted (trying to see if it would speed up a bit - but it didn't, or at least barely did) and as soon as I opened firefox, and started tot type in an addy, it pop - screen went black and then the blue startup screen, and it restarted.

[Jerryb]

hi,
There can be all sort of reasons for some of this issue you have and some of them is probably related to each other....

first, always a good idea to periodically backup your important files just on a routine bases ... you can never tell with pc's when they do fatal crash... with that said...
Now don't know what your it's systems stats are, and we don't know what some of the other issues you have... which maybe the actual causes... also don't if you have recently add/remove software/hardware at about the time your issues start! In general, when trouble shooting a system you want to know all the things that works right and allllll the issues with a system! and a little when problem started.

so for now... a lot of time some basic cleaning up of the system helps in many ways and maybe even cures.... and eliminate problems and help narrow down causes.. you may have already done some of these but I don't know.. if you have done them.. sorry... for being repetitive... smile

1. make sure you purge you internet cache and DEFRAG... that always helps in many ways.
2. of course do a antivirus and anti spyware scan.... malware can cause all sort of problems...!!!!
3. a important one... disable all needless programs that startup at windows boot .. go to you msconfig.exe>startup tab .. you can use these links to give guidelines on what to safetly disable....
http://castlecops.com/StartupList.html

http://www.devcar.com/computers/star...ull%20list.htm

note: disabling needless programs that startup at windows boot, does a few things..
a. it generally improves your overall system speed.
b. it regains some of your precious ram.
c. your system is more stable!!
bottom line everything work better, faster and smoother!

Now these are the basics, in my opinion that should be done...

if the issue still continues... I generally will look at some of the other programs that i keep for startups.... and see if one or two of them causing... and this is generally done by just turning them off temporally... and see what happens... for example... screen savers, firewalls, various virus/spyware scanners...

sooo.. do those things and things should be a lot better if not then need more info and then we start looking deeper into the system....

Oh by the way... I like your work I wish i was half as good as you are with photoshop....

one additional note: this link to a smartcomputing article... now it mentions some of the thing I have on startup but there a lot of other info init that might be valuable to you.......
http://www.smartcomputing.com/editor...S&bJumpTo=True

Originally Posted by 1STLITE

I think my system is having some issues. I have always been pretty good at figuring out what was going on with her, but right now I just don't have the time or the patience to figure out what it is I need to be doing to make things run more smoothly. I usually consult the folks at majorgeeks, but figured I'd just ask here - and ask Gary . I want to replace my system soon, but right now I can't. Last night it even shut down by itself, which really freaks me out.

Let me know what you need to know about it and I will tell you. I appreciate it very much. Right now PS is so slow I can barely work at all, and I have ALOT to get done. I am about to cry - seriously.

Thank you so much!

Dawn

[T Paul]

I believe when things start getting slow it may be a hard drive about to go (of course also run defrag, checked for viruses and spyware as they can cause havic too). At least that is what I just went through and I am currently in the process of reinstalling and updating everything.

Until you get some real help try PC Pitstop (free evaluation of your system).
It also has a free disk health scan. Also check with the manufacturer of your hard drive. They usually have a diagnostic utility you can download and run to check your drive's performance and health. Unfortunately for me, my results told me that my drive was failing.

[Ziaphra]

Is your fan working because it can behave like that when it gets hot...

[Gary Richardson]

Just a couple of things to add.

If you're worried that you may have picked up an infection, post a HJT log here and I'll have a look at it for you.

Create a new folder C:\HJT

Download HijackThis.exe to this folder.

It is important you install it into this folder for the following reasons.

• If you leave it on your desktop, backups can easily get deleted by accident.
• If you put it in a Temp File, HJT and the backups may get deleted if we need to clear out your Temp Files as part of the cure.

Once it is located, Navigate to the folder using Windows Explorer or My Computer, and double click on HijackThis.exe.

• • Before your first scan, we need to check the configuration.
    
    Click on the Config button in the bottom right hand corner and confirm the following are checked.
    • Make backups before fixing items.
    • Confirm fixing & ignoring of items (safe mode).
    • Include list of running processes in logfiles.
    The other items should be unchecked.
• Click the Back button to return to the Scan page.
  
• Click on the Scan button, and wait for the scan to finish (this may take some time depending on the number of items in your log).
  
• When finished the Scan button will turn to a Save Log button, click on this and save the log (by default to the same folder that HijackThis.exe is in).

To paste it into a Forum, do the following.

• Navigate to your Hijack This folder.
• Double click on the hijackthis.log file, a text document will now be open on your screen.
• Click on Edit/ Select All, then Edit/Copy.
• Open the Posting Screen on the Forum
• Right click in the screen, and click on Paste. The text should now be in the message.
• Press Submit.

(Sorry for the patronising tone and "baby" instructions, they're for use on forums where some of the users aren't too clued up).

Have you cleaned out your temp files lately? if they've built up you can have some really wierd effects.

• Click Start > Run and type cleanmgr then click OK.
• This will bring up the Disk Cleanup window.
• Check the following entries.
  • Downloaded Program Files.
  • Temporary Internet Files.
  • Recycle Bin.
  • Temporary Files.
• Click OK.
• When a prompt pops up click Yes.

If you send me a HJT log I can check what's auto starting on your computer and recommend items that don't need to be run at startup (if any).

Did you get any error codes when it crashed? If so can you give details (the more detailed the better).

Lets have a look at the System log.

Right click My Computer, then click Manage.
This will bring up the Computer Management window.
Expand System Tools then click Event Viewer.
Double click System in the Right Hand pane.

Look for any Error indications (white cross on red background).
If found, double click the entry and an Event Property window will open.

We need details from that window, particularly the Event ID.

[Kraellin]

dawn, sorry, but it really does sound like a drive going. my system would suddenly reboot too, just before the drive finally gave out completely. and it was slow as molasses near the end. as it gets worse, things will act even more erratically and you'll find yourself waiting for chkdsk to chk your drives and files are going to be lost. BACK UP NOW!

frankly, i hope i'm wrong, but you have the symtoms.

as for bios, you get into that by when you first turn the machine on, you hit the 'delete' key before it gets to windows booting up. do this as early in the process, after the POST (the POST is a very low level check of the bios and system and will often give a single little beep when done and is always the first thing your system does), just tap the 'delete' key until you get a message or bios actually comes up. READ THE NAVIGATION INSTRUCTIONS! within bios and dont change anything. you just want to see if the bios can still see the drive. if it's showing in windows, it can, but if it stops showing in windows, chances are it's not showing in the bios. i suppose you dont really have to do this. like i said, if it's showing in windows, then it's showing in the bios and most likely if it's not showing in windows then it's probably not showing in the bios. so, you can skip the whole bios thing probably. i just like the confirmation.

if it is the drive and it's your system drive (the one with Windows installed on it), you're in for a bit of a headache, i'm afraid. with the symptoms you're showing, it wont just be one partition on the drive; it will be the electronics or mechanics of the drive itself and will affect ALL partitions on that drive. so, make sure ALL partitions on that drive are backed up!!

if it's the system drive, you're going to have to get a new harddrive and install windows all over again. and that means you're going to lose your registry and have to install all your software again. and again, i really hope this isnt the case. but auto-rebooting and slow as molasses speeds point to one or two main and crititcal things, a drive going bad or too much heat in the system or both. if the drive bearings, for instance, are going bad or the platter is starting to freeze up, you're going to be generating more heat than normal and that's always a bad thing.

and i really hate being the bearer of doom and gloom, but i just went thru this myself.... with the exact same symptoms. and i know T just went thru this also, so i'd take her advice about getting the drive checked.

you might also check your system log files. right click on the 'my computer' icon and pick 'manage' to find your logs. look for a warning or error that talks about bad sectors or blocks on a drive or other problems with a particular drive. this can be something of a pre-warning that something is going wrong.

if your system is anything like mine, you've got maybe (?) a week before complete failure (and that's no guarantee), during which time things will get progressively worse. handle it now, if you can.

and all of this doesnt invalidate anything anyone else has suggested. however, i will say that you shld check your disk FIRST before doing a defrag in this instance. if the drive is going bad, a defrag will likely only make things worse. and do check for viruses and spyware. you might also do a registry cleaning. a very fat registry can slow things down and even cause reboots in rare instances, so you've a lot of things to check here. basically, backup everything now and then see if you cant isolate what is doing all this. just doing 'corrective' things blind is not always a good idea. figure out the nature of the problem and where it is coming from and THEN handle it accordingly.

[1STLITE]

Thank you everybody. I was working as you all were posting with trying to do what I can to figure this out. I don't need a defrag, automatic restarts was turned on, so I turned it off, no viruses or spyware that I can find, although all I have run has been Pc-Cillin's virus and spyware scans, ran the cleanmgr (got rid of some crap, no change in performance)

I got no error reporting or pop-ups when the computer restarted at all, which is why it freaked me out so bad (along with the running slow thing). I have had it crash on occasion, and it was always something that Microsoft would pop up telling me it was some driver or another, and get updated, etc. Nothing like that this time.

In the event viewer, I have a crap load of stuff, but mostly just little blue i's in a balloon. There are quite a few yellow triangles with exclamation points in them. Most of them say they are from WinDefend. Which says something, to me at least, because I thought that was a program that started when Windows started, and it seems like there used to be an icon in the little task bar, but a good while back that icon disappeared. Every now and again, my computer will start to run like crazy, and it is always that program eating up every bit of power. I will cancel it and restart and usually take care of that - should I just do in and delete that program? Is that ok to do, or is that come junk that MS is requiring now?

There is an error on there from the 21st, Source:dhcp EventID:1000
Hmm- looking back there is one of them every day at least back to the 5th. Any idea what that's about? If I am understanding it right it is something to do with my internet connection, says it lost the lease to it's IP address.

Still, no error at the time of the crash.

I hope none of this sounds too dumb to any of you. I can usually figure stuff out myself, but I don't claim to know too much about this stuff. Hope I don't sound like an idiot.

Where do I go form here, besides backing everything up?
Also, could it be the external drive that is the problem? Or when you say drive going bad you are pretty much talking about the internal hard drive, right?

Thanks again, everyone!!
Dawn

[Jerryb]

hi,
it sort of starting to look like that windows defender maybe the major culprit.

windows defender is designed to start at windows boot, it is a antispyware type program.!!

Normally you shouldn't have that many yellow triangles for any given day and since in this case they all deal with windows defender that strong case that is the culprit...

now the causes, could be one or several win defender files are corrupted or that section of the registry (dealing with defender) is corrupted, oooorrrr since you have penicillin and it sounds like it also run a antispyware scan.... could be a major conflict between the two!! ... so the very least I would do is either deactivate windows defender to where it not supposed to startup at boot or uninstall it...!! and then see if that helps your problem.!!

on the event id.... not really sure about it nor am savy about it.. smile however it sounds to me at first there was some sort of interruption with your isp and your system had a problem getting the address..... now i went and did some searching and i found this ink... look a the comments section...
http://www.eventid.net/display.asp?e...e=Dhcp&phase=1

now also I am thinking that maybe this issues is being caused by your other issues with windows defender... or possibly another program

Originally Posted by 1STLITE

Thank you everybody. I was working as you all were posting with trying to do what I can to figure this out. I don't need a defrag, automatic restarts was turned on, so I turned it off, no viruses or spyware that I can find, although all I have run has been Pc-Cillin's virus and spyware scans, ran the cleanmgr (got rid of some crap, no change in performance)

I got no error reporting or pop-ups when the computer restarted at all, which is why it freaked me out so bad (along with the running slow thing). I have had it crash on occasion, and it was always something that Microsoft would pop up telling me it was some driver or another, and get updated, etc. Nothing like that this time.

In the event viewer, I have a crap load of stuff, but mostly just little blue i's in a balloon. There are quite a few yellow triangles with exclamation points in them. Most of them say they are from WinDefend. Which says something, to me at least, because I thought that was a program that started when Windows started, and it seems like there used to be an icon in the little task bar, but a good while back that icon disappeared. Every now and again, my computer will start to run like crazy, and it is always that program eating up every bit of power. I will cancel it and restart and usually take care of that - should I just do in and delete that program? Is that ok to do, or is that come junk that MS is requiring now?

There is an error on there from the 21st, Source:dhcp EventID:1000
Hmm- looking back there is one of them every day at least back to the 5th. Any idea what that's about? If I am understanding it right it is something to do with my internet connection, says it lost the lease to it's IP address.

Still, no error at the time of the crash.

I hope none of this sounds too dumb to any of you. I can usually figure stuff out myself, but I don't claim to know too much about this stuff. Hope I don't sound like an idiot.

Where do I go form here, besides backing everything up?
Also, could it be the external drive that is the problem? Or when you say drive going bad you are pretty much talking about the internal hard drive, right?

Thanks again, everyone!!
Dawn

[1STLITE]

Yeah, I am really thinking it is WinDefend too. Been wondering what was going on with that but too busy to look into it.

Odd thing is, it is not listed in msconfig in startup. Not it or anything like or about it. I went to that site listing the stuff in startup, and nothing that is set to start has anything to do with that. I have always tried to keep the starup clean through msconfig, though.

Gonna go see if I can un-install it.

[Gary Richardson]

Hi Dawn,

Windows Defender is an Anti-Spyware program from M$, if it's giving problems you can safely uninstall it using Add/Remove programs in Control Panel.

OK the EventID:1000 is unrelated to your problem, its related to DNS issues.

Despite your PC Cillin finding nothing, I wouldn't mind seeing a HJT log, might see something in there that's a possible source of conflicts.

[1STLITE]

Thanks, Gary. Wasn't sure if you still felt that was necessary. I will get right on it. Back in a few.

BTW - I un-installed WinDefend through add/remove, etc. Restarted the computer just to see what would happen. This thing is taking forever to shut down and startup is just ridiculous - never used to be that way. After it was done starting up and rested a minute I clicked to start firefox, and it took it 25 seconds just to open that.

Oh I also forgot till just now that the other night when I shut down, I left the room. Came back 20 or 30 minutes later and it still had the blue screen saying Windows is shutting down... Dunno what that was about either.

Ok - off to get that HJT log. Back in a few.

Dawn

And again, Thank you Thank you THank you. Very Very much -

[Jerryb]

hi again,
not all program will list themselves in msconfig.exe>startup... so it not surprising you don't see it there... sometimes the manufacturer don't want you to disable something.. smile....

however look in your services!!! it a different kind of group of startup programs....... M$ may consider it a service and not a normal startup program... you can go to services.msc for example some of my virus scanner software shows up in services and not startup

... also take a look at these services lists

http://www.theeldergeek.com/services_guide.htm
http://majorgeeks.com/page.php?id=12
http://www.yellowhead.com/xpcfg3.htm

Originally Posted by 1STLITE

Yeah, I am really thinking it is WinDefend too. Been wondering what was going on with that but too busy to look into it.

Odd thing is, it is not listed in msconfig in startup. Not it or anything like or about it. I went to that site listing the stuff in startup, and nothing that is set to start has anything to do with that. I have always tried to keep the starup clean through msconfig, though.

Gonna go see if I can un-install it.

[1STLITE]

Gary - just paste it in here, or how do you want me to go about this?

Thanks, Gary. And thanks, Jerry.

[1STLITE]

Well, I am gonna go ahead and post it here. I'd say it looks ok to me, but I am not really sure what i am looking at, at lesat not 100% - LOL.

Logfile of HijackThis v1.99.1
Scan saved at 5:21:17 PM, on 11/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\S3apphk.exe
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE
C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us5.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us5.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us5.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us5.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us5.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us5.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us5.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us5.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us5.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://srch-us5.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us5.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB002" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe



ALSO - I ran a dish check, and nothing came up saying anything on the disk was bad. Dunno if that means anything really, but thought you all should know.

Dawn

[1STLITE]

Hmm - I am thinking maybe it was the WinDefender program that was the problem. I am in PS right now with a full size image and seems to be workign well.

Crossing everything here while I post this - lol.

Dawn

Thanks, Everyone!!

Oh - Gary - I used to have a program on here that cleaned up the registry (I think) I can't remember the name of it- which do you recommend, that's free - lol. Thanks so much!!!

[Gary Richardson]

Hi Dawn,

Sorry I'm a bit late getting back to you, sleep kinda got in the way .

OK had a look through your log, and it's a squeaky clean as I've seen in a long while, certainly no indications there of anything that would cause the kind of problems you were having.

Nothing to remove in Startup that would significantly improve boot time, you run a pretty lean machine.

Does Trend Micro come with a Firewall, (can't keep up with which versions of which programmes do or don't)? If not you need one, the one that comes with Windows is rubbish.

If you need links for Freebies, look in the RetouchPro library (I think I've posted links there).

I see you've also got a HP (Hewlett Packard) toolbar installed, not Malicious, but it does report your browsing habits back to HP (not sure how detailed these are).

If you want to stop it running just run HJT and check this item.

O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL

Close all open windows and click Fix Checked.

Doesn't remove the program, just removes the Registry entry that calls it up, so shouldn't have any knock on effects.

WinDefender is tied in to a lot of Kernel level processes and drivers, so if it had got corrupted it would have had some pretty fundamental effects on your system. It could well be that this was the cause of your problems.

However I'd still back things up just in case it's early signs of a Hardware (disk) problem.


OOPS, almost forgot.

Don't generally recommend using Registry Cleaners too much, as some of them can be a bit over zealous and cause more problems than they solve.

However if used cautiously they can occasionally be beneficial.

I use them only very, very, occasionally, and only after a lot of installs/uninstalls, and never until after I've created a Systems Restore point.

I've used the one below without problems. Not as "severe" as some, but creates backups and does give you a lot of control.

RegScrubXP

[CJ Swartz]

Originally Posted by Gary Richardson

...
Don't generally recommend using Registry Cleaners too much, as some of them can be a bit over zealous and cause more problems than they solve.

However if used cautiously they can occasionally be beneficial.

I use them only very, very, occasionally, and only after a lot of installs/uninstalls, and never until after I've created a Systems Restore point.

I've used the one below without problems. Not as "severe" as some, but creates backups and does give you a lot of control.

RegScrubXP

Well, Gary, I'm going to give RegScrubXP a try on your "say-so", in spite of your other post picturing yourself "wearing a red tin-foil fez to repel the hypnowaves sent by the government or aliens". I'm going to create a Systems Restore point first, but not because of the fez...

[1STLITE]

Cool - thanks, Gary. Well, I think cool. Not too keen on hearing it still may be my drive. Is there any way to know if that is the case? I can't afford to get caught with this thing not working any time before Christmas. I guess it would not be toooo big of a deal if I have to replace it now, since I planned to get a new system after Christmas anyway.

Speaking of which, I think I am going to have one built. My brother does that kind of thing. It costs alot less that way usually,right? My big dilemna right now is I wonder if I should stick with AMD. I think as far as this computer I have now goes, I really lucked up with the AMD AthalonXP. From what I have read it operates better at higher temps than others, and I had no clue of this when I bought it. I really think that considering this environment any other processor would have burned up by now. I have also read that the Athalon Duo's (I think that's what they are called) run better overall than Pentium's. I'd love your thoughts on this.

I was thinking of switching to Mac, but I really don't think that is necessary, is it? Seriously - isn't it mostly just personal preference?

Thanks for everything, Gary and everyone! And Happy Thanksgiving!!

Dawn

[Gary Richardson]

Hi Dawn,

Hardware's not really my field of expertise. If your brother's into building PCs he's probably much more clued up on processors than I am.

The only thing I would advise, is to get the best PSU (power supply unit) you can afford, as the stability of your power supply has more influence on the rest of your computer than you can imagine.

Particularly so if you're operating in a hot climate where the constant switching on and off of fans will put "shock" loads on it.

Choice of PC or Mac is always a personal one, and your usage and finances will dictate which is best for you. I'd say that generally you get more bang for your buck with a PC and spares are cheaper and easier to come by, on the other hand Macs have a good reputation for reliability and stability.

As for checking your disk, keep an eye on your system log (as described in my earlier post) and look for any errors connected to your disk. A disk on its way out will generally kick out a lot of errors. Don't get too paranoid about this, most disks kick out some errors even when they're working fine.

If you open the event properties box by double clicking the error, you will find a link to the Help and Support at M$ which may give you more info.

[Kraellin]

dawn,

well, hopefully my fearmongering was all hot air with no substance. if your system now seems stable and faster after removing windefender, then it may well have gotten corrupted and if, like gary says, it was tied in closely to the kernal routines, then that would make sense. and since you lost your systray icon for it, that may well indicate, along with your now faster speed, that it was corrupted. so, that may be it.

and, as gary mentioned, keep an eye on the system logs. one or two errors dont mean much, but if you get a daily log entry of a drive showing errors, that would be a first sign. if the system reboots itself....and i do mean by itself; it's just sitting there idle and suddenly reboots, then that's a warning sign of a drive going bad. if you're doing something on the machine and it reboots, that's more a sign of poor software.

another sign of a drive going bad would be that when you boot up or reboot you start getting a lot of CHKDSK operations before the machine will boot into windows.

another sign would be if you start getting bios warnings/errors. you'll normally see those in the black and white text screens as you boot up.

every once in a while you might also check device manager and see if you have any yellow exclamation marks next to a device, regardless of if that device is a drive or not. (or any other mark next to a device).

you might also want to get a heat monitor. there are several decent ones and some free. i normally dont bother with these until i start getting unexplained, frequent error on my system. but they can be life savers.

diagnostic and informational programs are also a good idea. Sandra 2000 was a standard for a while... it's probably more like Sandra 2005 or 2006 by now, but that is pretty much the gold standard in system diagnostics. Belarc was a great free system informational program, but they've gone commercial now, so you'd have to pay for that one too. so, if you cant afford those, just the various windows dianostic/information programs can be used. and i'm sure there are other freebies out there. i just happen to be most familiar with those.

drives can go bad in various ways. the usual way is in the mechanical parts of the drive; a motor goes bad, the bearings wear out and so on. the next most common is the electronics, but this is a lot more rare. usually the mechanical will go first. another way is the heads or platter go bad. this is also fairly rare, though still fairly common on cd roms and dvd roms because the heads and patter are exposed where harddrives are sealed.

the mechanical failures are the real killers. this is because the drive is still there and to the bios and to windows, seems like it is working when it's not. and that's the source of the extra heat and errors. when something locks up, juice is still being applied and that causes heat. calls to the drive dont get acknowledged correctly because the drive cant spin, so you end up with tons of loops going on which is why your system slows down. the queues/stacks in the o/s dont get acknowledged and things bog down as a result. and this is why when someone says 'my system is extremely slow and is rebooting itself' i go, 'sounds like a drive going bad'.

one other way to check for bad drives is to run CHKDSK yourself. back up before doing so. if the drive is going bad you can lose data doing this. in fact, if the drive is going bad you probably will lose data. you can run a sort of quick CHKDSK from windows itself, though i was told once that it's more reliable to do this from dos (dont know if that's true or not for sure).

at any rate, if your system is now back to normal after doing the removal of windendender and not showing any other signs of trouble, then that was most likely the culprit and i'm glad

as for building your own or having one built, it used to be the case that there was a tremendous savings there, but now, prices have gone down so much that it's a bit of a toss-up and the margin is very close if not actually more economical to buy 'off the rack'. i still prefer custom rigs, mainly because i dont lock myself into proprietary hardware and there, mainly due to video cards. onboard graphics cards generally suck and that's often what you get in an ecomomical off-the-shelf rig. sometimes you cant even add your own card to bypass the onboard crap. another savings with custom rigs is that if you buy fairly much one type of computer, the ease of saving old parts to a new rig is better and that can cut down your costs when moving to a new machine. i saved several things in my last move. some things will transfer almost regardless, like cd roms and dvd roms, but ram and video cards not always. also, with custom rigs you pretty much know what you're getting. so, usually no big surprises.

amd vs intel is a toss-up. intels may have a slight edge in reliability and heat management, but amd's are usually the speed leaders (though you really have to read the fine print any more). amd's USED to be easier to overclock. not sure that's true any more. amd's used to be cheaper. that may have changed also.

dual-core processors are what's coming into vogue with quad-core coming pretty soon. the more cores, the faster the processing (up to a point, i would think). but for now, dual core is going to be faster than pentiums. it's also going to be more expensive and if all you're doing is photoshop, you dont need it. the current pentiums can handle ps and the likes quite nicely. games are another matter. and, with pentiums now NOT on the cutting edge, you're going to get better bang for the buck there than with dual core.

macs are tempting, especially for 'multi-media' anything. they just do it better. and now that they are running windows stuff quite nicely and quite fast AND reliably, it's even more tempting. and i love their new television ads you WILL pay a higher initial cost and service and replacement is going to be more expensive. i cant really speak to reliability except that mac people tend to swear by mac. and i love the fact that mac takes risks and innovates, where intel/microsoft tend to not... especially microsoft.

so, this is an area you're going to have to study. my ideal would be a mac for my graphic/art work and a pc for internet and gaming and to be able to network them, mostly so i could transfer my graphic stuff to the internet.

so, how's that for bogging you down with information

[Syd]

Gary I have been watching this thread with interest because my computer has been playing up of late as well, although, with the help of some of the advice in this thread I think it may be sorted out now. However, I still have a question. I opened my task manager just to see what programmes were running in the background and with the help of the excellent advice at Answers that work I deleted quite a few unecessary ones and things (touch wood seem to be running a lot smoother now). However there are still one or two tasks that I am not sure about and that even Answers that work don't have any info on. One of them is a programme called Conime.exe .

I googled it and some said it could be a virus and some said that it was a legitimate Microsoft file. I went to the WINDOWS\system32 directory and there it was but how do I know it is the legitimate Microsoft programme running and not the virus. What is the purpose of this programme anyway? Is it because I don't have an English browser as one site suggested? Should I be alarmed. And how do I even go about deleting it. Everyone's advice in this thread has really been excellent.

Sincerely Syd

[Kraellin]

syd,

i have it too. it's short for 'console ime' and is, i'm pretty sure, a microsoft file. i believe it works with the 'console.dll' file. if you really want to be sure, go to microsoft.com and do a search in the knowledge base or even on the entire site and you shld find something on it there.

[Syd]

Thanks Craig I will go and check it out. I just got the impression from this site that there were quite a few viruses out there masquerading as legitimate files and this has got me a bit spooked. How is one ever able to tell the difference?

Syd

[Gary Richardson]

First of all, to find out more about the file, browse to it and right click it.
Select Properties. A properties window will pop up with details of the file, click on the Version tab, if it is a legit Microsoft file it will say so.

If you're still worried about this particular file, check it out at Jottis or VirusTotal.

• Go to VirusTotal or Jotti's, and scan the following file(s).

Conime.exe

• Click on the Browse button at the top of the screen.
• Browse to the file.
• Click OK.
• Click Send, and the file will upload to VirusTotal / Jotti, where it will be scanned by several anti-virus programmes.
• After a while, a window will open, with details of what the scans found.
• Note details of any viruses found.
• Post me the details please.

How is one ever able to tell the difference?

File location is everything, Malware (Virus) files may have the same name, but are usually in a different location to the legit one (Windows does not allow 2 files of the same name in the same directory).

There are occasions when a virus will replace a file, but with system files this is a very difficult thing to do, so such occurencies are rare.

[Syd]

Thanks Gary I will do as you suggest.

"File location is everything..." Yes, that is exactly what the Answers that Work site suggested. What I didn't know how to test was if the programme running in my Task Manager Window was from the Windows\system32 Directory or some other Directory (in which case it would definitely be a virus). But thanks Gary I will scan as you suggested and post the results.

Sincerely Syd

[Gary Richardson]

Hi Syd,

If you've got a copy of HJT, there's a seperate process manager included with it that does show the file paths of the running processes.

Open HJT, click on Config.
Click on Misc Tools.
Click on Open process manager.

Now you can scan down the list of processes to find the one you want, the file path will be indicated.

If you haven't got a copy, one can be downloaded from http://downloads.malwareremoval.com/HijackThis.exe

CAUTION: HJT is a diagnostic tool, it must not be used to remove things unless you KNOW what you're doing. It is a very powerful programme, and in unskilled hands can make your computer into a very lovely paperweight in no time at all.

[1STLITE]

Thanks Craig and Gary. I appreciate all the time you have put into helping me get this sorted out. You guys are awesome!

Whether to buy or build is something I will have to work out in the next couple months I guess. I may just go with a refurbished unit, and work from there.

Well, back to work for me. Thanks everyone!!

Syd - hope you get your issue sorted out.

Dawn