Comp freezes when I start apps...

**smitty** · July 1st, 2004, 10:46 AM

Hello, I hope someone might be able to help. It seems that my computer has decided to start freezing when I run just about any application. I can surf the net, get email and play windows games like solitare, etc. But once I start something like Counter-Strike or Ventrillo or any other program that takes resources, it freezes and won't unfreeze until I reboot.

I checked all 3 sticks of ram individually and the same thing occurred. One of the sticks wasn't even in my comp when it happened. I don't see how it could be the power supply, being that it's new and is not showing any signs of trouble. I did place all 3 sticks in the first slot only, so after reading many other posts on here, I am wondering if I should try slot 3 or what.

What I was doing:

My buddy has the same comp, I built them at the same time. Well his seems to boot a ton faster than mine. He told me he went into BIOS and clicked "Load Optimized Defaults" and it screamed. OK, so I tried it the other night and it seemed to have done a little something. So I did it again last night. Don't know why, just did it a second time. Anyway, I load up and go to get on Vent and it froze. I reboot, try again, freeze. OK, so here I think I did something wrong. I go back to BIOS and "Load Fail/Safe Defaults", same thing. Only this time, when I rebooted I could see nothing. LOL, it seems fail safe loads the PCI vid as default. I have AGP. So that adds some frustration. I fix that. I go through ALL my BIOS settings, make sure they are set how they should be. It still happens. I give up and go to bed.

OK, so that's what happened last night. That's where I am now. Oh ya, my sound has also taken a crap too. I was running my sound through a Creative SB Live! Value. I disabled the onboard sound.

I should mention that for the past couple weeks I have been fighting Spyware crap on my system. I run NoAdware, Spybot Destroyer and I still get crap popping up and my home page hijacked. I have run a virus scan in the midst of this battle and come out clean. I just can't seem to find the damn culprit no matter what I uninstall or what prog I run to get rid of em.

I am getting ready to try a reinstall and see if that does the trick. But now this crap with the freezing came up and I am at a loss.

I should probably inform you of my system:

AMD 1700+ XP on a:
Gigabyte GA-7VAX mobo
VIA KT400 chipset
333/266/200 MHz FSB
RAM Max capacity : Up to 3GB by 3 DIMM slots
1 x AGP slot (8X/4X); 5 x PCI slots
On board Realtek LAN
On board Realtek Sound
Thermaltake VOLCANO 9 Cooler
768MB Ram - Generic (512MB 2100 266, 256MB 2700 333)
GeForce2 MX440 64MB AGP Video
WD 160GB HDD
Creative SB Live! Value sound card
Windows XP Pro OS

There she is, hope this helps anyone to help me, maybe please.

Thanks,
Steve

**geoscomp** · July 1st, 2004, 10:56 AM

Well, to start with, get rid of noadware and download adaware..if the spybot program you are referring to is Spybot S&D, make sure you have the newest version..1.3 and that both adaware and spybot are updated properly..if they don't find anything, try HijackThis and post a log. You might also want to try an online virus scan, if what you meant was that you used your installed antivirus to scan.

**smitty** · July 1st, 2004, 12:11 PM

OK, I got rid of Noadaware and downloaded adaware. After running it there were 163 objects it removed. The Spybot S&D is up to date as well as the Adaware.

OK, so that helped with my infestation. You mentioned that I should use an online virus scan. Do you or anyone else have a suggestion?? I use a client installed Norton 2003. It is up to date, I have it set to do a live update at every boot up.

Anyway, thanks a million for the lead on adaware. Do you think this will help fix my freezing problem??

**geoscomp** · July 1st, 2004, 12:19 PM

well, it certainly can't hurt..noadware is a pretty suspect program in it's own right..

as far as online virus scanners..the thought is that an installed virus scanner may be suspect if there is a virus existing on the machine already
Trend Micro has a good on, as does Panda..

trends is here:
http://housecall.trendmicro.com/hous...start_corp.asp

panda's is here:

http://www.pandasoftware.com/actives..._principal.htm

**smitty** · July 1st, 2004, 12:38 PM

I definately agree that anything to improve the system of clean it will help. I guess I'll just continue the barrage and see where it goes from there. Thanks for the links to the virus scan as well. I would have Googled it, but would have been unsure of the results anyway and would have asked.

Thanks again,
Smitty

**NooNoo** · July 1st, 2004, 01:14 PM

don't forget to post your hijack log

**smitty** · July 1st, 2004, 01:47 PM

Originally Posted by NooNoo

don't forget to post your hijack log

For definate!!!! I am running the first virus scan online right now and have been for some time. Once it completes I will get that up here. I'm running through VNC doing this from work, so it's a little slower.

**smitty** · July 1st, 2004, 04:13 PM

OK, I have run Adaware and it cleaned up alot. I ran the Panda and Housecall virus scanns and they each found something that is now cleaned. Here is the Hijackthis log, I hope it helps, cuz it lost me:

Logfile of HijackThis v1.97.7
Scan saved at 5:07:30 PM, on 7/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\iqqarf.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\My Documents\Downloaded Programs\HiJack This\hjtlog.exe
c:\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sinzclan.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.sinzclan.com/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 81.211.105.69 lender-search.com
O1 - Hosts: 81.211.105.68 hot-searches.com
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5886A6DC-AAF4-45E9-979A-8E5E6DEE30E7} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [udrzogxsj] C:\WINDOWS\System32\iqqarf.exe
O4 - HKLM\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: RemindU - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0 .htm
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: RemindU (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\setup.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...ctor/swdir.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...996.6695601852
O16 - DPF: {BD9B72E4-DC9C-4922-80E9-2D3315E3AADC} (UAClientControl Control) - http://www.ultimatearena.com/UAClientControl.ocx
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/Sha.../bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?312

**geoscomp** · July 1st, 2004, 04:30 PM

hmm..it had to be that one, didn't it?

first thing is to put hijack this in it's own folder..otherwise, you will have all sorts of backups all over your desktop

You have two choices..you have a particularly nasty bit of malware that mutates as you try to remove it. If it were my computer, I would reformat and reinstall..but if you want to try and fix it, the fix is:

Go offline and remain offline until this procedure is complete.

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find Network Security Service.
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Clcik Apply then OK. Exit the Services utility.

Hit the Ctrl + Alt + Del key simultaneously to bring up the Task Manager. Click on the "Processes" tab. Find and stop these two processes if they are there:

ntfy32.exe
msqx32.exe

Restart to safe mode.

How to start your computer in safe mode (http://service1.symantec.com/SUPPORT...01052409420406)

Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Rerun Hijack this, and fix the following:
C:\WINDOWS\System32\iqqarf.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sinzclan.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.sinzclan.com/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 81.211.105.69 lender-search.com
O1 - Hosts: 81.211.105.68 hot-searches.com
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5886A6DC-AAF4-45E9-979A-8E5E6DEE30E7} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [udrzogxsj] C:\WINDOWS\System32\iqqarf.exe
O4 - HKLM\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe

O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: RemindU - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0 .htm
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: RemindU (HKCU)
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?312

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Next navigate to the C:\Documents and Settings\*******\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Now click the "Delete Cookies" button and click OK.

Empty the Recycle Bin

--------------------------------------------------------------------------------

**geoscomp** · July 1st, 2004, 04:41 PM

Also delete everything in the prefetch file. reboot and immediately run an online virus scan again. rerun spybot and adaware. do all windows critical updates. rerun hijack this and post the log. You will have to reinstall the google toolbar after this btw

**smitty** · July 1st, 2004, 04:44 PM

geoscomp,

Thanks for the help again. It figures that it couldn't be something easy. I am going to try and fix it but have a feeling that I may just reinstall everything. At least if I do that, I have the capability of grabbing my files and settings so it won't leave me hanging.

One more question, you wrote "Rerun Hijack this, and fix the following:". When you say fix the following, what exactly do you mean? Do I delete it from the registry or is there another method?

Thanks again for all the help you have given me!!!

Smitty

**geoscomp** · July 1st, 2004, 04:46 PM

Originally Posted by smitty

geoscomp,

Thanks for the help again. It figures that it couldn't be something easy. I am going to try and fix it but have a feeling that I may just reinstall everything. At least if I do that, I have the capability of grabbing my files and settings so it won't leave me hanging.

One more question, you wrote "Rerun Hijack this, and fix the following:". When you say fix the following, what exactly do you mean? Do I delete it from the registry or is there another method?

Thanks again for all the help you have given me!!!

Smitty

with hijack this, when you have finished a scan, you can check the items you wish to fix..then click on the fix button at the bottom. make sure that you don't have any browser windows open when you do that.

Good Luck!!

**smitty** · July 1st, 2004, 06:45 PM

well I fixed the freezing problem. It seemed that every prog I used with sound froze. So, I disabled my sound card and am back to using my onboard sound. It works. I am guessing I have a bad card or an IRQ conflict. As to the virus issue, I will fix that tonight when I get home from work and can do it live, not over VNC.

Thanks for your help again. I'll post the new hijackthis log when I have it to see if there's anything else I need to worry about!