HJT Log - Trying to diagnose Win freezing problem

[mixx941]

Hi everyone. I have done several spyware scans, but just to be complete, I thought I'd post a HJT log while trying to diagnose this problem.

Logfile of HijackThis v1.99.1
Scan saved at 8:43:23 AM, on 7/7/2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP3 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\mysql\bin\mysqld-nt.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\CTHELPER.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Atomic Clock Sync\Atomic.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Atomic.exe] C:\Program Files\Atomic Clock Sync\Atomic.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{AAFE6582-67A3-4727-820F-97EB9787A1F2}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.0 (pgsql-8.0) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.0\bin\pg_ctl.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)

-Mark

 

[khazars]

hi, welcome to TSG.


you should go to Microsoft and downoad SP4 for W2k!

http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

you can run these 2 tools if you wish and you should download them, Micrsoft's Antispyware and adaware Se 1.6, here's info on how to use them .


go to this site and download these tools and once you get both
adaware and spybot, update both of them.

Set adaware to do a full system scan and deselect, "search for neglible risk
entries". Click next to start the scan. Delete everything adaware finds.

reboot and now run spybot

Spybot: Search and destroy.

Delete what spybot finds marked in red. After updating spybot hit the
immunize button.

reboot again


With CWshredder close all browsers and programmes and select the FIX button.



Go here and download Microsoft Antispyware Beta. First in the top menu click
File then Check for updates to download the definitons updates.

After updating look in the right side of the main window under "Run Quick
Scan Now" and click Spyware scan options. In that window put a tick by Run a
full system scan and then put a check by all three options below that then
click Run Scan now.

When the scan is finished, let it fix anything that it finds (have it
quarantine the items that have that option rather than delete just in case.
It is a beta program and there may be false positives)

Restart your computer.


All tools can be downloaded at the link below and found on that page!


. Microsoft® Windows AntiSpyware
. AdAware SE



http://www.majorgeeks.com/downloads31.html


. CWShredder

http://www.soft32.com/download_19014.html



download ccleaner

http://www.ccleaner.com/


* Install CCleaner
* Launch CCleaner and look in the upper right corner and click on the "Options" button.
* Click "Advanced" and remove the check by "Only delete files in Windows temp folders older than 48 hours".
* Click OK
* Do not run CCleaner yet. You will run it later in safe mode.


Click on the Issues tab, uncheck both boxes Registry Integrity and File
Integrity
Click the Applications tab, scroll down to the Multimedia section and uncheck
Macromedia Flash Player.

then run the scan under the windows tab.




have hijack this fix these entries. close all browsers and programmes before
clicking FIX.



O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm


Now run ccleaner.

 

[mixx941]

Thanks for the response.

I was checking with HitMan Pro for spyware, but the box just completely freezes up after a few minutes of using it. I don't THINK it's spyware because it's a clean install with only a few programs opened, no IE use, no email, etc....but it could be.

The problem as described in the other thread, is the whole machine freezes after a few minutes of use. I don't think it would stay up long enough to do a SP4 install...and as I said it freezes when even trying to Spybot portion of HitMan Pro.

Thanks.

-Mark

 

[khazars]

Is this the service giving you trouble? Do this and for the other one I think it was. Shut them down and then reboot see if that helps any. It might be incompatible hardware or software on the machine, or since you brought it into your enviroment?


O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)



Click Start > Run > and type in:

services.msc

Click OK.

In the services window find VNC Server
Right click and choose "Properties". On the "General" tab under "Service
Status" click the "Stop" button to stop the service. Beside "Startup Type"
in the dropdown menu select "Disabled". Click Apply then OK. Exit the
Services utility.

 

[mixx941]

Well it's kind of an odd thing. Here is the complete history:

The box was sent to me by someone to run a FTP server, a VNC server, and the playlist for one of my internet radio stations. When I first got it and installed Windows 2000, Windows would either:

1) Freeze on boot every other boot
2) Freeze after a few minutes

After narrowing that down by software, reinstalling Windows, and getting the same results (freezing) in Knoppix, I went looking at hardware. After troubleshooting that, it turned out to be an IRQ confliction between the network card and the motherboard somehow....I switched the cards around in different configurations, and then it started working in both Knoppix and Windows fine.

Over the last week, one of the administrators of the station has been VNCing in to the machine to set things up, as well as uploading things via the FTP daemon. It has been fine during all those times.

Once we put the radio automation software on there, it started to freeze the whole machine after a few minutes of operation. In the past year, I had the same problem with the same software on ANOTHER PC, so I thought that the software was to blame, and have been trying to get it solved with them through their message boards.

Up until last night, the machine was only freezing when the radio playlist software was playing music. Now, it just seems to freeze for any reason, just as it did before when the network card IRQ confliction thing was happening.

So right now it either

1) Freezes on boot after the desktop is shown
2) Freezes after a few minutes of being operational

I am about to try what you said, but I notice it's frozen again after doing nothing but sitting there all day.

-Mark

 

[khazars]

you'd be best posting this in the hardware forum, the w2k/Xp , or maybe the software forum pertaining to the software your using. I really don't know what your talking about here in relation to the servers and so on, so I won't be much use to you!