Slow PC

[sriracha]

Hi, I am new to this forum and would be happy if anyone can help me with this problem. (Forgive my english, it is not very good!)

I am using a Windows XP laptop, used it in the office and at home. It is now extremely slow. I have read some threads and have done somethings (maybe right, maybe wrong) based on those threads... I am not good with computers and having difficulty to figure out what these threads are saying.

I have installed Ad-aware and run it regularly, sometimes twice a day and everytime it will find a few critical items. I also do trend micro scan but there are certain things that I can't understand. I also do Panda active scan but it found one adware that it cannot disinfect.

I dont have much program on my PC only microsoft office, lotus applications, Fuji Xerox, Real player, Trendmicro OfficeScan Client and a few more but PC is still slow.

I don't know whether these info will be useful for you to help me.
Please advice further...

Thanks

 

[MFDnNC]

Your English is better than many native speakers - Welcome!

Get MS AntiSpy - http://www.microsoft.com/downloads/...A8BD-DBF62EDA9671&displaylang=en&Hash=RDXMHB6 (XP and W2K only)


check each for definition updates, run, fixing anything it says.

Boot

Then get HiJack This V1.99.1 http://thespykiller.co.uk/files/hijackthis_sfx.exe - double click the DL file and click unzip letting it extract to its default folder C:\Program FIles\HiJackThis, run it from there, DO NOT fix anything, post the log here.

 

[radspanner]

perhaps the following link may be of some use to you



http://www.microsoft.com/atwork/getstarted/speed.mspx

 

[sriracha]

Sorry, I couldn't continue from last week because my modem was not working, and thanks a lot for your kind remarks. I will try to continue again today when everything is settled down, my modem is just up about 15 mins ago... thanks a million again.

 

[MFDnNC]

I lived in Switzerland and Puerto Rico and I can bet your English is better than my French or Spanish - Post back and I'll help!

 

[sriracha]

Thanks again, here is my log file

Logfile of HijackThis v1.99.1
Scan saved at 10:48:40 AM, on 7/12/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\program files\lotus\notes\ntmulti.exe
C:\OfficeScan NT\ntrtscan.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Acer\Notebook Manager\almxptray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\OfficeScan NT\ofcdog.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.0.0.5:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MT....compaq.com/HTML/interactive/h5500/model.html
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hicom-th.com
O17 - HKLM\Software\..\Telephony: DomainName = hicom-th.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = hicom-th.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = hicom-th.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\nasir\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Multi-user Cleanup Service - Unknown owner - C:\program files\lotus\notes\ntmulti.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\OfficeScan NT\tmlisten.exe

BTW, I always received this msg "updates are ready for your computer" but I dare not do it because I may not be able to handle all the technical details given in the instructions.

 

[MFDnNC]

Nothing nasty but fix these with HiJack

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MT...5500/model.html

O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\nasir\LOCALS~1\Temp\hpdj.exe (file missing)

Get these tools and run the last 3

Since nothing is showing lets run this

Download the trial version of Ewido Security Suite http://www.ewido.net/en/download/
· Install ewido.
· During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
· Launch ewido
· It will prompt you to update click the OK button and it will go to the main screen
· On the left side of the main screen click update
· Click on Start and let it update.
· DO NOT run a scan yet. You will do that later in safe mode.

Restart your computer into safe mode now. Perform the following steps in safe mode:


Run Ewido:
· Click on scanner
· Click Complete System Scan and the scan will begin.
· During the scan it will prompt you to clean files, click OK
· When the scan is finished, look at the bottom of the screen and click the Save report button.
· Save the report to your desktop
This will take some time to run!
Post that log and a new HiJack log

 

[sriracha]

Sorry, I got confused again.
When you mean "run last 3" which one are you referring too? Is it an instruction in Ewido or an instruction in your instructions. I hope you will be kind enough to explain, thank you again.

 

[MFDnNC]

I guees you are confused since I didn't post the entries - has nothing to do with Ewido - Sorry - BTW where are you?

SpywareBlaster 3.4 http://majorgeeks.com/download2859.html
SpyBot V1.4 http://www.majorgeeks.com/download2471.html
AdAware SE 1.06 http://www.majorgeeks.com/download506.html
MS AntiSpy - http://www.microsoft.com/downloads/...A8BD-DBF62EDA9671&displaylang=en&Hash=RDXMHB6 (XP and W2K only)

 

[sriracha]

I will answer the easy question first. I live in Thailand and work in Thailand.

Now the difficult part.
1.I dont know how to safeboot the computer. I tried earlier but I got the normal screen again. How should it look like and what should be written on the screen?. To me this is very confusing..... sorry
2. I already have Spybot & AdAware SE in my system and I used them quite regularly.
3. Could the problem be due to me not updating my PC with the updates?

These questions may sound silly to you but I need help...

 

[MFDnNC]

Its not silly if you do not know - Never got there in all of my travels - HK, Taiwan, Japan

To get to safe mode

At the first black screen after a boot or power up start tapping F8 , you will then get a B&W screen - select Safe mode - the simple one not the others

 

[sriracha]

Hi again, I hope I am not bothering you too much..

I did what you asked me to do on the F8 key, got the B&W screen, selected the Safe Mode but could'nt proceed further. Got a response from the system something like
"Windows cannot be started due to Missing or Corrupt file:
Windows root>\system32\ntoskrnl.exe"
Then, I quickly press F8 again and the system normalised itself again but not in safe mode.
Plse assist..
BTW Thailand is a beautiful country with many interesting things, places and people here. Who knows, one day, you'll be here...

 

[Rollin' Rog]

There are some suggestions for resolving the ntoskrnl.exe error here:

http://www.computerhope.com/issues/ch000646.htm

For the performance issue, if programs are also unusually slow to load, open the Device Manager (Control Panel > System Properties > Hardware > Device Manager) and expand the entry for IDE /Atapi controllers.

Select both the Primary and Secondary IDE channels and double click them to access their properties. Select Advanced Settings and note whether either channel says PIO for "current transfer mode". If it does, select the "drivers" tab and uninstall the driver for that channel and reboot.

More on this here, see "workaround":

http://support.microsoft.com/default.aspx?scid=kb;en-us;817472

 

[sriracha]

Thank you so much Rollin'Rog

I checked the IDE thing and my primary says Ultra DMA 5 and my secondary says Ultra DMA2 (which I dont understand at all).

On the ntoskrnl.exe error, I read the document given but I guess with my limited knowlwdge of computers, it is too difficult for me. Furthermore, I am not sure where the CD is now..

Is there anything else I can do?

BTW, the computer is pretty fast when not connected to the internet. It only gets so slow when the connection is on.

Plse help..

 

[MFDnNC]

Not sure of the problem with safe mode, try running Ewido in normal mode even though it suggests safe mode

Do you have the CD for the OS??