[spudnik]

bugging the POOP outta me.

i will attach a hijackthis logfile

i should mention i AM computer literate, and have a lot of experience with fixing other people's computers... but this one i cannot find the solution for ANYWHERE.

brand new PC, built from scratch on my own, problem reared its ugly head Saturday round noon my time.

logfile:

[ozrom1e]

Welcome to TSG....

Please post the system specs for this computer and also post the HijackThis log file on the open forum instead of a zip file. Thank you.

[spudnik]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7:37:59 PM, on 04/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ben\Desktop\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4244 bytes

system specs:
MSI M2N-SLI Deluxe with Athlon x64 dual 4600+
Dual Nvidia 7600GS
ULTRA DDR2 2048 MB ram (2GB pagefile)
Windows XP pro

thanks for the welcome

[ozrom1e]

I am a little bit concerned about the size of the page file

ULTRA DDR2 2048 MB ram (2GB pagefile)

This is a bit large and might cause a lag in the processing time after all it is located on a hard drive which is a little bit slow to begin with.

[spudnik]

the 2gb pagefile is the default values set during installation.

knowing the dangers, i would be leary to truncate to 1gb. i play a lot of BIG games (5-12 gb) but i will try turning the PF down.

BRB

[spudnik]

reduced min PF to 512, max 1536.

no change.

[Jedi_Master]

Originally Posted by spudnik

bugging the POOP outta me.

i will attach a hijackthis logfile

i should mention i AM computer literate, and have a lot of experience with fixing other people's computers... but this one i cannot find the solution for ANYWHERE.

brand new PC, built from scratch on my own, problem reared its ugly head Saturday round noon my time.

logfile:

Howdy folks...

spudnik...

Well...

If it were mine I'd check the Event Viewer and try and match the time it starts to lag, to any entries in Event Viewer...

Something could be running at the time it starts to lag (like any automatic updates, disk scans ect ), might try also disabling the Indexing Service...

***edit to add***

Try keeping Task Manager open and monitor the process and see if there are any using any CPU time at the time of the lag...

[spudnik]

task manager shows that the explorer.exe which is called approximately 3-4 times per minute only uses 1% of CPU each time, but on the 4th call comes a lag spike.

event viewer only shows activity in System and Application - in system there are 8 entries by the source System Control Manager within one minute for my DVD tray when i pop in a DVD (to test the frequency of the spikes and the severity). other than that, there are no apparent "application" activities to nail a perceived lag time of 5 seconds every minute.

further, the task manager shows only one system process, and nothing is listed as local/network service. all other entries are user-less ....

[Jedi_Master]

task manager shows that the explorer.exe which is called approximately 3-4 times per minute only uses 1% of CPU each time, but on the 4th call comes a lag spike.

Well now...

That's interesting...

Explorer should in normal operation should be only called once ( unless other programs in the background are calling it , ie: AV system scan, ect...)...

The only thing I see as strange is this...


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


Looks like M$ Office is loading this 5 times for some reason (why I don't know), what you can try is following the instructions from here...

http://support.microsoft.com/default...;EN-US;q282599

And see if it helps...

[spudnik]

Thanks, Jedi_Master. although i do not have any Microsoft Office products installed. i changed up the part about the Language bar, but i dont have any Office products.

if i removed the last 4 entries in HJT, might i do more harm than good ?

[Jedi_Master]

That's strange...learn sometihing new every day, I've only seen it associated with Office...

If it were mine I'd follow the instructions in the link I provided above first...

And see if it helps...

Problems such as this is, don't really know what is going on, just got to start from what looks as strange/not seemingly right and go from there...

[spudnik]

thank you again Jedi_master. after following the instructions in your link, it appears the problem still persists (having only been able to follow steps 2 and 3, it would appear the attempt was semi-vain to begin with).

i do wonder if removing 4/5 of those ctfmon.exe entries using HJT would help.

before i wreck my system, can anyone advise?

[Jedi_Master]

Have you tried going into Task Manager and ending all explorer processes and starting just one ?

[spudnik]

there is only one explorer.exe process running at 24,028k

the only time i have ended that process has resulted in a loss of my start menu and all desktop icons. i needed to CTRL+ALT+DEL and restart via that menu.

what i do have multiples of is svchost.exe (i have 5 copies running all with different memory sizes)

[dvk01]

well with NO antivirus installed anything is possible

* Run Kaspersky online virus scan Kaspersky Online Scanner.

After the updates have downloaded, click on the "Scan Settings" button.
Choose the "Extended database" for the scan.
Under "Please select a target to scan", click "My Computer".
When the scan is finished, Save the results from the scan!

Note: You have to use Internet Explorer to do the online scan.

Post a new HiJackThis log along with the results from Kaspersky scan

Note: Kavscan is a scanner only & won't fix anything but will normally find the most infected files so it's report gives us a good place to work from

You must use IE for the scan to work

and page fiel should be between 1.5 & 2 x system ram so a 2gb page file is too small

I would set it as system managed and let windows decide how big it should be. Many lags & hangs and caused by artificially creating a problem by restricting page file sizes