LAPTOP HELL

[grim_reefer]

there is a problem with our laptop

my brother called last night saying that it was shutting/had shut itself off, and when trying to load it back up it is EXTREMELY slow, the user account screen takes a while before you can click on anything - and when windows loads it is unbareably slow - taking 15-25+ minutes to load up everything, and is still the same afterwards.

i have tried starting windows in safe mode, which was fine, and used system restore incase anything from the internet had messed it up. but its still the same and didnt display the usual system restore message about wether the restoration was succesful or failed!

my brother also said he "thinks" there was a message from the Symantec/Norton Anti-Virus saying that someone had tried to HACK the computer!! if this is the case then maybe thats why System Restore cannot correct it

the only other major problem with the laptop is that it often does not switch back on 'properly' when you restart it or turn it off then back on too soon, and have to wait with it off for about 5 minutes before it will load anything (even BIOS) when the power is turned on - p.s. it has always been like this since we bought it

i have checked the running processes list and windows\current version\run in the registry, and not seen anything that i think is suspicious or unusual. i have also brought up the system resource meteres (CTRL+ALT+DEL) when it is running slow and the CPU is CONSTANTLY at 100% and the page file increasing steadily!!! is that normal for just starting windows :huh:

[grim_reefer]

is it normal for the CPU usage to be so high during windows starting and all the background applications loading??

and besides that, what could be causing this problem? the laptop is un-usable in its current state

[pacman123]

with cpu that high you could have virus.........

[grim_reefer]

there doesnt appear to be anything running unusal. i will show the list of running processes here though.. surely if it is a virus it would have to be running (and in the process list) to be making the CPU usage that high?

if it was "hacked" there could be files damaged/edited/missing/extra files which are well-hidden or interlaced with the other system files and not be picked up by the virus protection,

cannot get online in safe mode so cannot update the virus protection with latest definitions or do an online virus check

[grim_reefer]

i doubt it can be a virus that runs in windows anyway because it is even slow to load up the "starting windows" and user account selection screen - which comes up before anything loads?

[grim_reefer]

it wont even load up anything after you select the user account and it slowly responds and loads up your "desktop picture"; but right now thats all its loading, it wont even load up anything else, but the processor is working away.. this was happening before but EVENTUALLY i got it to load when i managed to get the winXP CTRL+ALT+DEL window up - but as i said it was unbareably and never actually finished loading its just that slow

[expertec]

Could you possibly get a Hijackthis log?

[grim_reefer]

ccEvtMgr (SYSTEM)

csrss (SYSTEM)

explorer (FishNet)

lsass (SYSTEM)

mdm (SYSTEM)

Navapsvc (SYSTEM)

services (SYSTEM)

smss (SYSTEM)

spoolsv (SYSTEM)

svchost (SYSTEM)

svchost (SYSTEM)

svchost (SYSTEM)

svchost (NETWORK SERVICE)

svchost (LOCAL SERVICE)

system (SYSTEM)

System Idle Process (SYSTEM)

taskmgr (FishNet)

wdfmgr (LOCAL SERVICE)

winlogon (SYSTEM)

once you can get the running process list up (which takes a while after the empty desktop loads) this is what the list is made of

also once this comes up, the computer generally starts loading the icons, and the background processes, and the start taskbar, very slowly (taking up to and over half an hour to finish loading everything) during this period the running processes obviously changes loads..

i decided to end the task for the svchost consuming the most memory usage (because im sure these files can be corrupted by viruses and not do what they are supposed to) to see if it would speed it up

however, after doing this ive recieved new error messages - and i dont know if they are simply because i closed the svchost file, or are to do with the actual problem!! the error messages are: Windows File Protection Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. Insert your Windows XP Home Edition SP1 CD now

and from Symantec virus protection: Settings Alert Some Symantec product settings have been changed by an unauthorised program. This can indicate that an attacker or a virus is attempting to disable your protection. To avoid problems, settings will be reverted to the previous configuration and your system will be restarted. Click OK to continue

are these because i closed a svchost file, or are they serious/accurate? has files been changed by an attacker (not necessarily a virus) and thus there is no virus to detect, and the computer is trying to operate with inccorect/altered system files :unsure:

[grim_reefer]

after everything finally settles down on the computer. the processes left running are:

AOLDial

ccApp

ccEvtMgr

ccRegVfy

csrss

ctfmon

ESB

explorer

firefox

keyhook

khooker

lsass

mdm

msmsys

Navapsvc

opwareSE2

pctspk

services

sistray

smss

spoolsv

STImgBrowser

svchost

svchost

svchost

svchost

svchost

SynTPEnh

SynTPLpr

system

System Idle Process

taskmgr

wdfmgr

winlogon

however, two processes "AOLacsd" and "firefox" appear to be repeatedly opening the process several times and increasing the memory usage once the windows start up gets to this stage

yes i can post a hijack this log, ill need to download it here first then put it on the laptop. i take it that it will work in safe mode?

[expertec]

Yeah, Hijackthis is good with safe mode. :)

[grim_reefer]

Logfile of HijackThis v1.98.2

Scan saved at 18:24:45, on 15/11/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\Administrator.MIKE-WR8DXUFI93\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [siS KHooker] C:\WINDOWS\System32\khooker.exe

O4 - HKLM\..\Run: [ESB] C:\WINDOWS\System32\ESB.exe

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe

O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe

O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"

O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"

O4 - Global Startup: Adobe Gamma Loader.lnk = ?

O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe

O4 - Global Startup: Digimax Viewer 2.1.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1098062692994

O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} (loader Class) - http://home.earthlink.net/~riharpat/dploader.cab

[expertec]

Don't see much in your HJT log.. try this instead:

Download ServiceFilter

Extract all the files from the zip. (It will not work without this).

Double click the ServiceFilter.vbs file and let it run.

You will get a file called POST_THIS.TXT, copy the contents and post them here.

[grim_reefer]

i will do that tomorrow when i have the laptop with me

on a side note - my aunts computer is infested with multiple spyware/viruses i think, it has all the popups coming up and running quite slow. ive looked at the running process list and can see the blatent viruses without actually checking anything out.. sometimes its just obvious innit ;) such as "scvhost"..

one of the popup windows looks impressively like a windows message about improving your computers performance but obviously is not and is a popup from spyware/a virus because its just one big button, no matter where you place the mouse over it - i tried to explain that to them!!

anyway. i copied the list of running processes beacuse it will be quicker easier to check for the easiest way to remove it all - rather than doing all the checking and removing manually by myself :) and i did a hijackthis while i was there. maybe i should start a new thread for that one? or post in the hijack this forum?

[grim_reefer]

HERE IS THE LOG:

The script did not recognize the services listed below.

This does not mean that they are a problem.

To copy the entire contents of this document for posting:

At the top of this window click "Edit" then "Select All"

Next click "Edit" again then "Copy"

Now right click in the forum post box then click "Paste"

########################################

ServiceFilter 1.1

by rand1038

Microsoft Windows XP Home Edition

Version: 5.1.2600 Service Pack 1

Nov 16, 2004 14:56:17

===> Begin Service Listing <===

Unknown Service #1

Service Name: SwPrv

Display Name: MS Software Shadow Copy Provider

Start Mode: Manual

Start Name: LocalSystem

Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this ...

Service Type: Own Process

Path: c:\windows\system32\dllhost.exe /processid:{9a478d8b-c3dd-4847-8677-0ed04fc3c725}

State: Stopped

Process ID: 0

Started: False

Exit Code: 1077

Accept Pause: False

Accept Stop: False

---> End Service Listing <---

There are 83 Win32 services on this machine.

1 were unrecognized.

Script Execution Time: 53.88672 seconds.

[grim_reefer]

im afraid i may know the cause but not the damage done or the solution to the problem - my brother was downloading something but selected open instead of save to disk (he thought this would be the better option as it wouldnt be "saved" - not realising it is much worse to run a harmful program than to store it, also not realising the fact it would be saved in a temporary folder anyway with the open option).. and wel, as soon as it finished downloading (and run) is when the computer shut itself down, and that is basically what started it

it may be a virus that is undetectable by some virus detectors as it is not a common virus on the internet that has affected anyone else or spreads - and 'could' have been written specifically as an attack/attempt to hack the computer in some way, as i believe it was someone he was talking to that sent it to him... and it is not the virus that is slowing the computer down (because it appears as there is nothing unusual running) but the damage/alterations it may have made to system files

i have no idea what sort of damage has been done if this is the case! or what will repair it, short of reinstalling windows :unsure:

anyway, the ServiceFilter log is posted if it is any help

[grim_reefer]

i dont know where to go with this

[expertec]

The services log hasn't showed up anything.... do you have the windows CD this machine?

[grim_reefer]

yep, do you think a windows repair installation is in order? if so, it shouldnt affect anything else installed already should it

[expertec]

Thats what I was thinking, programs should be OK but you will need to re-install any windows updates.

[grim_reefer]

which is the best way.. to put the disc in at system boot and do it with the option there in windows xp setup (in dos)?? i know id tried reinstalling windows featuers before with the disc while windows was running (through control panel or a setup file on the disc or something) and it went through the usual stuff but then asked for the O.E. code which i dont have 'cause it never came with one :( was pre-installed and just a dell copy of the cd

[expertec]

What is an OE code? :dummies3:

[grim_reefer]

oops i mean like the serial code number lol

[expertec]

If it's a laptop there should be a sicker on the underside with the code on.

[grim_reefer]

nah, there isnt one :( will it be fine to use the windows setup repair install at system boot with the cd?

[grim_reefer]

the windows repair installation fixed the problem with everything running ridiculously slow and the processor usage has gone back to a usual 10% - instead of overloaded! however the sound driver needed reinstalling... windows media player 10 needed rolling back before a fresh intallataion was done (i guess when windows repaired, it changed settings and registry keys back to how they are for the version of wmplayer that came with WinXP HomeEdition SP1a, because all wmplayer10 said was "there is an internal error".. even after being reinstalled)

for some reason the internet connects right away every time now, whereas before it could not work for dozens of tries, every time it would just be making the phone tone for number not recognized after dialling.. now it is fine!

not everything has been tested yet so i dont know if there is anything else that aint gonna work yet or not

anyway, there were two other devices in the device manager not working, other than the sound, and they were both visible once you selected "show hidden devices" and are SERIAL and OMCI from the "non-plug&play drivers". when you bring up the properties, both say "This device is not presentr, is not working properly, or does not have all its drivers installed (code 24)" but there is no option to update the drivers!! do you have any idea what i should do about this?

--------------

AFTER USING PHOTOSHOP ALBUMS, THE PROBLEM HAS RETURNED:

things have gone bad again, my brothers girlfriend was using the laptop to alter photos for printing on Adobe Photoshop Album and im not sure if she was keeping loads of massive images open or not but the computer had gone back to being really slow, the CPU usage at 100% and photoshop album's mem usage in the running processes was maybe over a GB! anyway i couldnt close photoshop or photoshop album and in the end had to turn the power off. now when it is switched back on its ridiculously slow still (and like it was before) and the CPU usage over 100%

whats happening, its like the memory isnt being freed or something

but even in the running process list, it isnt ridiculously high.... just the CPU usage shouldnt be at 100% and obviously it shouldnt be this slow, and photoshop album shouldnt have caused it to start again :unsure: