[andie666]

Acer Aspire AX3300
AMD Phenom II X3 710 Processer 2.6GHz
Geforce 9200 + G210 Hybrid SLI
4GB DDR3 (3.75GB Usable)
Windows 7 Ultimate x64
Prolite E2208HDSV Monitor

I'm having a few problems which have come up in the last few days, I have made no software changes apart from adding a bluetooth adaptor and would be grateful for any assistance with these problems.

A few days ago I noticed on the screen some strange lines within the screen, I can only describe these as watery, rain like lines which flow diagonally across the whole of the screen. They all "flow" in the same direction at once but the angle at which they flow across the screen does change. The monitor is a Prolite E2208HDSV and is only 3 months old. I have checked the connections, run windows update and also checked for any driver updates for my graphics card and monitor but these all come back clear saying everything is updated and I have the latest versions. I tried to take a screenshot but as the lines have no solidity I can't capture it on image. The lines are not there constantly, they seem to come and go and change direction at will. Confused I is!

My second problem is the speed at which my system boots, this has increased dramatically from about 30 seconds to 2-3 minutes, it seems to hang at connecting to the internet which is a LAN connection. I have only 3 programs set to run at startup and these are:

Sidebar
Avast5
EvtMgr6(Logitech/setpoint)

My third problem occurs once the system has booted, in idle status before I run any programs my RAM usage is between 28% and 33%, it never falls below 33% where before it hardly showed any usage after boot, 1-2%.

I have enclosed a hijack this log and a process explorer log, the only thing I can figure out is that it I think it is the svchost.exe using the RAM but am not sure why this has gone up so much or if there are processes within it which i can kill and disable safely.

Any help or advice is most gratefully received, it's so frustrating as you can normally backtrack to figure out problems but these ones have got me stumped.

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 01:36:12, on 22/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
F:\Program Files\Alwil Software\Avast5\AvastUI.exe
F:\Users\Andrea\AppData\Local\Google\Chrome\Application\chrome.exe
F:\Users\Andrea\AppData\Local\Google\Chrome\Application\chrome.exe
F:\Users\Andrea\AppData\Local\Google\Chrome\Application\chrome.exe
F:\Users\Andrea\AppData\Local\Google\Chrome\Application\chrome.exe
F:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin .dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - F:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - F:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast5] "F:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] F:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] F:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] F:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://F:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - F:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - F:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - F:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - F:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - F:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - F:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - F:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - F:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - F:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - F:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - F:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - F:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: lxbk_device - - F:\Windows\system32\lxbkcoms.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - F:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - F:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - F:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - F:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - F:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - F:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - F:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - F:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - F:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - F:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - F:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - F:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - F:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - F:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - F:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - F:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - F:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - F:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8684 bytes

Process Explorer results are attached as image.

Thank you in advance just for reading if you got this far, bit of a long post I know but I am flummoxed!

Andrea

[andie666]

Here is a photo of the screen so you can see the "quivery lines" running across it.

[rainforest123]

A :
I'm not a malware removal expert, but the multiple "file missing" entries in the HJT log are not typical.

Boot to safe mode? How is your problem?

I have made no software changes apart from adding a bluetooth adaptor

Uninstall it, as a test.

Try a different monitor.

Is your AX3300 still under warranty? If so, contact Acer.
Is the monitor still under warranty?

If you purchased the items using a credit card, check with the cc company, to find out if they have a warranty extension policy. Some cc companies will extend the original warranty, by up to a year.

If the AX3300 has VGA & DVI outs, try the other.
Try a different computer to monitor cable, if said cable can be disconnected from the monitor.

RF123

[andie666]

Hi rainforest, thank you for replying.

I've followed your advice and here's what I've tried so far..

Uninstalled all the bluetooth software and cleaned the registry. - no change
Connected my old crt monitor using a different vga cable. - no change
Gone through safe mode and run a malwarebyte scan - no malware found, strange lines do not appear in safe mode but ram usage is still high at 25% idle.

Both the monitor and tower were bought within the last few months, think we can eliminate the monitor being the problem now though. They are within warranty so I still have the option of returning to base for service but I really want to avoid that as I need the system for work.

The only thing that you suggested that I haven't tried is using a dvi cable as I haven't got one, the monitor only has a vga input though.

With the missing file references in the HijackThis log, I was told by a friend that HijackThis isn't fully compatible with Windows 7 and this is how it returns results for files that are not recognised. really not sure about that though.

Still confused here, so any more help from anyone will be massively appreciated. Thank you :-)

[rainforest123]

a :
Thanks for the reply.

You are welcome.

no malware found, strange lines do not appear in safe mode but ram usage is still high at 25% idle.

No offense intended to you, but no malware scanner will catch every piece of malware, every time.

I was told by a friend that HijackThis isn't fully compatible with Windows 7

As I wrote, I am not a malware removal expert. Thanks for that information.

Uninstalled all the bluetooth software and cleaned the registry. - no change

Be cautious with reg cleaners. The # of problems at TGF caused by reg cleaners vastly [ this is a guess ] outnumbers the # of issues solved by reg cleaners.

strange lines do not appear in safe mode

The issue, then, is not hardware, unless the issue is intermittent; your boot to safe mode may have co-incided with the no problem period.

also checked for any driver updates for my graphics card and monitor but these all come back clear saying everything is updated and I have the latest versions.

What / Who said that?

The method I recommend for updating video drivers.
Download the latest drivers from nVidia or ATI [ depends upon which graphics card is installed; nVidia in your case. ]

Download Driver Sweep from Guru3D.
http://downloads.guru3d.com/Guru3D--...load-1655.html

no installer download here
http://downloads.guru3d.com/Guru3D--...er)_d1672.html

When installing, RIGHT click the files. Left click "run as administrator"
Note: DS comes in2 forms; an installable program & an executable that runs without installation.

Control panel > "large icons" in upper right > programs & features
Open nVidia drivers.
Select the video / graphics.
Uninstall it.

VERY IMPORTANT
Boot to safe mode.

Run Driver Sweep

Reboot to safe mode.

Install the drivers you downloaded.

Boot to normal mode.

Test.
Information, with some images at http://www.sevenforums.com/tutorials...nstalling.html


*********************************

My second problem is the speed at which my system boots, this has increased dramatically from about 30 seconds to 2-3 minutes, it seems to hang at connecting to the internet which is a LAN connection.

Compare boot time to safe mode with boot time to your selective startup.

What firewall are you using? Sometimes, a FW has to be uninstalled to determine its culpability. Disabling it often, in my experience, is insufficient.

What kind of network connection do you have; ethernet or wireless?

If wi fi, switch to ethernet as a test.

If ethernet, disconnect the ethernet cable before booting to your selective startup.

For grins, start > search
type: msconfig.exe
Left click it, in the results area.
The system config utility will open.
You should see "selective startup" indicated.
Check the "services" and "startup" tabs for items either checked or unchecked. Make a list. Do not rely on "the first 6 things are unchecked" because the order often changes. Don't ask me; I wasn't in the meeting.
Select "normal startup".
Reboot.

Reboot again. On this occasion, measure the time it takes to boot.

Consider re-configuring your router.

***********************************

My third problem occurs once the system has booted, in idle status before I run any programs my RAM usage is between 28% and 33%, it never falls below 33% where before it hardly showed any usage after boot, 1-2%.

Provide screen shots of that which you are using to determine these numbers.

screenshot

On your keyboard, look for a key labeled "print screen" OR "PrtSc" OR "PRN SCN" or some variation.
When you want to capture that which is displayed, press the print screen button.
Open Paint [ start > programs / all programs > accessories > paint [ rarely MS Paint]
Maximize Paint
left click "edit"
Left click "paste"
file > save as.
Save the file to any location of your choice.
File name: your choice, for example: "filename"
save as type: left click down pointing arrow. Left click jpg / jpeg
Left click "save" / "ok".

The file name has now been saved as filename.jpg [ or filename.jpeg ].


Return to the thread.
Left click "go advanced".

Left click "manage attachments"
left click "browse"
browse to the location, on your computer, where you saved "filename.jpg"
Left click filename.jpg
left click "open"
left click Upload"
close window of upload screen after the file has been uploaded.

enter text into the reply area.
left click "submit"


If there is information on the screen that you don't want to display, you can use the eraser [ looks like a bar of soap, left column, 2nd from the top. You can remove large areas by clicking on the dotted outline column button, top, right column, then drag your mouse while holding down left mouse button ] to surround that which you don't want displayed. Then, press "delete" on your keyboard. Then save.

Edit:
Check your Windows update history for updates that might have been installed at the time your problems began. Check your ant virus update history as well. I have no idea as tohow you would do that.

RF123

[Phantom010]

With the missing file references in the HijackThis log, I was told by a friend that HijackThis isn't fully compatible with Windows 7 and this is how it returns results for files that are not recognised. really not sure about that though.

Actually, HijackThis isn't fully compatible with the 64-bit version of all operating systems.

[rainforest123]

P 0:
Yes, as previously noted.

Quote:
I was told by a friend that HijackThis isn't fully compatible with Windows 7

As I wrote, I am not a malware removal expert. Thanks for that information.

, #4 & #5, above.

RF123

[andie666]

Thank you for confirming that Phantom, I wasn't sure about it either. Is this the reason the files are not being recognised in HijackThis?

The RAM hog is definitely the svchost, I'm pretty new to 7 so am not sure what the idle usage should be.

I've attached screenshots of the running processes and the services running under svchost, this is in idle state and as you can see it's sitting at 24%, that is the lowest it goes. I suppose at least my ram is being utilised instead of sitting idle!

** I should of mentioned before that it was a dual boot system, out of curiosity I booted into the other partition which is running Vista (the os the system came with). The RAM usage on that partition is also running very high at 44% idle and again it seems to be the svchost hogging it?? Is there a hardware problem that would cause this to happen in both partitions?

Looks like I've got to get on the phone to Acer anyway as the I'm getting the "version not genuine" error, it's an oem edition though and when I run the Genuine Diagnostics it says it's genuine... sigh. **

[Phantom010]

Your screenshot is not showing the process hogging that 34% CPU. What makes you think it's svchost.exe?

I think it would be preferable to download and run the free Process Explorer. You'll be able to precisely identify the culprit. By right-clicking on the process showing high CPU and selecting Properties… > Threads tab, you'll be able to pinpoint the thread that's hogging CPU within the process.

Process Explorer doesn't require any installation. Simply run the executable file once downloaded. Then, configure the Process Explorer window to your liking. You can even replace the Task Manager (CTRL+ALT+DEL) by clicking on Options > Replace Task Manager. You'll get a lot more features and details than with the Task Manager.

[andie666]

Thanks Phantom, I already ran process explorer and posted a screenshot in my first post. I thought it was svc as this is what appeared to be using the most ram.

Rainforest asked me where I got my RAM usage figures from which is why I posted my task manager results.

[Phantom010]

Originally Posted by andie666

Thanks Phantom, I already ran process explorer and posted a screenshot in my first post. I thought it was svc as this is what appeared to be using the most ram.

Rainforest asked me where I got my RAM usage figures from which is why I posted my task manager results.

Sorry, I forgot about that first post where Process Explorer was clearly shown.

[Phantom010]

I'm still curious as to what is hogging that CPU. Looks like you might have a hidden process.

[andie666]

it's baffled me, I'm pretty stubborn when it comes to beating pc problems and just can't figure this one out. It's especially weird that I've got high usage on both os's.

Are there any other programs out there that could explain where it's being used up?

[Phantom010]

Hidden processes are often related to rootkits.

I'm not saying your computer is infected but a malware removal expert could help you make sure your computer is clean.

I'm not permitted to help you look for and remove rootkits or any other forms of malware. Therefore, if you are interested, please click on Report and kindly ask to be moved to the Virus & Other Malware Removal forum. From there, be patient. You should get an answer within the next 48 hours. These guys are really busy!

[andie666]

May be getting somewhere slowly now.. Malwarebytes found nothing, windows defender found nothing but Ad-aware has just found a trojan..Trojan.win32.Generic!SB.0. It's now been quarantined but the usage is still high after rebooting.

Thank you for all your guidance so far.. I will head over that way and patiently wait for assistance.

On a lighter note I did open up my tower and clean out the fan which had accumulated a stupid amount of dust and fluff in just a few months, this seems (everything crossed!) to have eliminated my strange ghostly lines.

Still gotta ring Acer tomorrow about the Vista not being genuine..what joy! :-)

*I should also add that after re-installing the network controller the system is no longer slow booting and the hang when connecting to the network has gone, just the hog left to find.*