[jonathanm]

Hi i was wondering if anyone could shed some light on why my computer is playing up. I recieve an occaisional keyboard error on startup, usually after the computer starts to run painfully slow and requires a reboot. At this point there are two short beeps followed by one beep after. After researching this, i have found that it could be a memory problem but i just need to check. The problem started when i transported my computer and tried turning it back on again so it could have been caused by the disturbance. I have cleaned the computer and check that the majority of components are connected properly. I recently upgraded my psu from a X-pro 400w to the coolermaster 500w

It is solved fairly easily by turning the power supply off waiting a few mins and turning it back on and restarting. However recently it has being going to the BSOD coming up with a ads.sys error. I am wondering whether these two events could be linked.

I would be very grateful if anyone could help me diagnose the problem further and suggest any more info. Thanks!

My computer is
Abit SR7-8X
Pentium 4 2.4ghz (Not overclocked)
512mb crucial ram
256mb radeon 9600
120gb Maxtor diamondmax Hdd
500W coolermaster i-green psu

[The Hound]

You can get Memtest86 here...

ads.sys is probably a driver file--the text of the BSOD screen might help...

Keyboard--USB or ps/2?? You might try another keyboard and see if you still get it.

Let us know how these things go--hard to say at this point if the errors are linked.

[jonathanm]

Its a usb keyboard, have tried others and still did it, the keyboard is working well. I saw that memtest on another thread so im just running it now. Iv only had a couple of the BSODs so il see if there are more and take a note of the error. Thanks for your quick reply!

[The Hound]

I get nothing on ads.sys--nothing on microsoft or google....

[jonathanm]

yeh i did that too, get a load of google share info. I'll have another look if it comes up and i will check my system after the memory test has finished. Cheers

[jonathanm]

Ran memtest, did 10 passes, 0 errors, the memory seems fine. Could it be the motherboard? Any other suggestions?

[The Hound]

In total, the beep code points to memory, memtest is clear. Reseating the memory--you may have done that when you 'checked the majority of components'--would be next on my list, especially after moving the machine was the last thing you did before this all started.

The keyboard error comes and goes, no matter which keyboard. You could try another usb port, and if you are using a pci usb card installed after the machine was bought, I'd reseat that as well. You could also boot to safe mode and uninstall all usb devices, reboot normally and let xp reinstall them, although this might mean issues later with a printer or other usb device that installs its own usb driver (like my hp--with the dot4 usb drivers..)

Still no joy on the ads.sys...

[jonathanm]

Yes i reseated the memory to no avail, i will try the usb issue as my computer has never been too good with some usb devices (device malfunctions etc). Thanks for you help i'll give this a go and see what else happens. Incidently i have purchased some new ram so i will test the new ram in a bit and see if that solves it. Cheers

[jonathanm]

Hi, just had a look at my system files, could have misread the error (it was very late!) so it could have been afd.sys which is a winsock driver. What could cause this kind of error? Could it be related? Cheers

[The Hound]

Okay--slow performance and a winsock issue could be malware...

Download hijackthis here:


http://www.thespykiller.co.uk/files/HJTsetup.exe

Save HJTsetup.exe to a USB flash drive or other removable media, and copy it to the desktop of the troublesome machine.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.

Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click Edit > Select All> Edit > Copy to copy the entire contents of the log.
Paste the log in your next reply.

DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Please then wait for a malware expert to analyze your log and help you to get up and running again...

[jonathanm]

Hi, the log file came back with

Logfile of HijackThis v1.99.1
Scan saved at 17:11:42, on 20/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [mouse] C:\\Program Files\\Trust\\GM-4200 Gamer Mouse Optical\\Panel.exe
O4 - Global Startup: Start Firewall.lnk = C:\WINDOWS\system32\net.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\Media Editing Tools\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\Media Editing Tools\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} (OSAKit2.OSA_Kit) - http://www.newstarsoccer.com/OSAKit2.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.truprint.co.uk/TruprintActivia.cab
O16 - DPF: {4D561B31-49A0-4E2C-8AFF-353468EC669B} (GreasyPalmInstallHelper Class) - http://www.greasypalm.co.uk/bho/update/GreasyPalm.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://arghhh.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D1BDCFB6-22F8-4CBF-A080-85675F2466A2} (UEANetTeam.Scanner) - http://netreg.uea.ac.uk/UEANetTeam.CAB
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay102.hotmail.msn.co...x/HMAtchmt.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

I've seen a few useless entries that might be wasting a bit of my resources, any that i need to fix desperately? Thanks

[jonathanm]

Should i be concerned at any of the results. There are a few programmes which could be slowing it down, but is there anything critical there? Thanks

[The Hound]

I'm not qualified to analyze your hjt log. A malware specialist will check it for you soon as they can...

Did swapping the RAM make a difference??

[The Hound]

Also might check for chipset and bios updates to address the ongoing usb issues...

[jonathanm]

Good idea, the ram appeared to make it better for a while but then did the three beeps at startup with keyboard error, so it could have been that i reset the power supply that did it. Cheers