PCTech Forums

by **Borogorn** » Tue Aug 31, 2004 1:32 pm

Hi

Just recently, my PC keeps on freeezing up on me.. this could be when Im surfing the net, playing online games... whatever, just keeps on doing it. This obviously makes me have to restart the computer incorrectly, which then prompts the disk checker, checking for consistency. It says the usual - highly recommended to run the test babble... but automatically cancels.... this is frustrating, as I think It needs to run this test, just for the sake of being safe...

Now, my real question here is... what is the command in the Start/Run Prompt? (If you click Start, then run that is

) I know you have to add a /f somewhere to 'fix' the problems if there is any, but cant think what the actual thing you have to type is...

Any help much appreciated

Boro

by **Geekgirl** » Tue Aug 31, 2004 2:09 pm

Hey Borogorn :wave:

Can you not press Control-Alt-Delete to restart your computer? Or are you using the reset button?
You can run the error-checking utility if you double-click My Computer. Right-click the hard disk drive and click properties.Then use the error checking.

OR

Go to Start | Run.
To restore all Chkntfs default settings, enter Chkntfs /d.
If there are multiple hard drives in the system, enter Chkntfs /x <drive letter>:. This excludes the drives you don't want to check. Make <drive letter> the letter(s) of the drive(s) you want to exclude.
Enter Chkntfs /t:0 to set the countdown to zero.
Type Chkntfs /c <drive letter>:, where <drive letter> is the letter of the drive you want to check.

hope this helped

by **Borogorn** » Tue Aug 31, 2004 3:36 pm

Hello again

Yea, that did help

... the command that I forgot was /chkdsk /f...

To answer your other question - no I couldnt press Ctrl-Alt-Del to Restart... because the computer was totally frozen up...., so, just had to use the reset button.

Im still curious as to why the check always 'auto-cancels' ....

Anyone had this type of thing before? It says, press any key to quit the check, but Ive just had a new keyboard - so cant be a sticky button or anything,,,, just really confused

Thanks again

Borogorn

by **Cactus** » Tue Aug 31, 2004 4:41 pm

To test hard disk or volume integrity

Method 1:

In the Run dialog box, in the Open box type:
cmd

Start the Chkdsk tool, which detects and attempts to resolve file system structural corruption. At the command prompt type:
chkdsk drive: /f

Method 2:

Double-click My Computer, and then select the hard disk you want to check.
On the File menu, click Properties.
Click the Tools tab.
In the Error-checking box, click Check Now.
In Check disk options, select the Scan for and attempt recovery of bad sectors check box. You can also select the Automatically fix file system errors check box.

Is there a Specific STOP ERROR code you can post?
It will be something like :

0x24
or
0x0000000007b

Cactus

by **Borogorn** » Tue Aug 31, 2004 8:20 pm

Hello

Ive been Defragging my PC all day... (took from 10 am.. until about 7 Pm!) oops... but eventually I got round to checking the chkdsk /f command in 'Run'. It seems there is some problem with the whole checkdisk scan... as this 'auto-cancels' too. after hitting enter... instead of the MS-Dos promt saying what system file type and whatnot... it just blinks on, then off.... ass if to say, 'Test has been aborted' as I get on every startup.... is there anything like this known? Its a bit frustrating.... though, given the state of my Hard drive (proven by the defrag time) It may just have just been that, generating enough 'lag' to crash my system, do you think?

Regards,

Boro

by **Geekgirl** » Tue Aug 31, 2004 8:56 pm

Unless you got a HUGE h.d.d (unmentionably huge) it shouldnt take that long. Did you defragment in Safe Mode?

I will look into this particular error you are getting. I myself have not run into this before.
Hopefully another friendly forum geek will have some info for you :wink:

by **Borogorn** » Wed Sep 01, 2004 12:39 pm

Hello

Nah My HDD is only 80gig... It used to take ages on one of my older PC's too... but, no I didnt do it in Safe mode. Should I have?

Ive just had to restart PC again, due to a crash, even after running the chkdsk checker. I dont know whats caaused it, or what could possibly be on here that I havent found... Ive got Spybot, Adaware, AVG and Hijack This, Which incidentally, I'll post a lgofile of.

Thanks for the help...

Borogorn

...... My Hijack file

Logfile of HijackThis v1.97.7
Scan saved at 12:38:54 PM, on 9/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\WinZip\Wzqkpick.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Lesley Clare\My Documents\Installers\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.lteyzkzcruuoxn.net/EXWVmFl2b ... 8VbuF.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C91B9EB-EC9F-185E-C6AA-C675E1421C69} - C:\PROGRA~1\EGGSLO~1\htmping.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [campsafe] C:\PROGRA~1\ELSEOP~1\drv each face.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Win32 Classes -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... mv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... .282025463
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_GB.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B77052-7E56-4173-B0A6-5198A38203EF}: NameServer = 195.92.195.94 195.92.195.95

by **Geekgirl** » Wed Sep 01, 2004 1:28 pm

Hi Borogorn

Could you please use and scan your computer for viruses.

After you have done that delete the version of HJT that you have and Please Download the newer version of and post a new logfile.

(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. A good place to make a folder would be in My Documents,
as this is where it will save the backup files needed if there's a problem.)

We will look at your logfile shortly

by **Borogorn** » Thu Sep 02, 2004 2:59 pm

That link to housecall doesnt seem to wrok GG...

It comes up with 'page not found'...

I'll try any other online scanners, but whenever I use them, They always seem to want me to pay to subscribe to them....

Boro

by **Geekgirl** » Thu Sep 02, 2004 3:13 pm

Works for me Borogorn....
Go to Google type in Trend Micro and click 4th link down :wink:

by **Borogorn** » Thu Sep 02, 2004 3:52 pm

Right, after much faffing, I managed to get it.... had to go through IE instead of mozilla though... it found 3 trojans, one fo which was located in an IE file, so couldnt be deleted. How can I go about deletin this one, as the link doesnt seem to like mozilla - it prompts me to d/l some netscape software, of which I have nothing on my computer.

I'll go and download the newer HJT, and post a new logfile here..... Brad, Get ready

Boro

by **Borogorn** » Thu Sep 02, 2004 3:57 pm

Logfile of HijackThis v1.98.2
Scan saved at 3:58:56 PM, on 9/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\WinZip\Wzqkpick.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Documents and Settings\Lesley Clare\My Documents\Installers\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fhlyqepmwkzzxwo.com/EXWVmFl2 ... 8VbuF.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C91B9EB-EC9F-185E-C6AA-C675E1421C69} - C:\PROGRA~1\EGGSLO~1\htmping.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [campsafe] C:\PROGRA~1\ELSEOP~1\drv each face.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Win32 Classes -
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_GB.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B77052-7E56-4173-B0A6-5198A38203EF}: NameServer = 195.92.195.94 195.92.195.95
O18 - Filter: text/html - {383E4302-74A8-44CF-BA54-CC3A38E8736B} - C:\Documents and Settings\Lesley Clare\Local Settings\Application Data\microsoft\internet explorer\V0.15.dat

by **brad** » Thu Sep 02, 2004 10:10 pm

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

htmping.exe
face.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fhlyqepmwkzzxwo.com/EXWVmFl2 ... 8VbuF.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {6C91B9EB-EC9F-185E-C6AA-C675E1421C69} - C:\PROGRA~1\EGGSLO~1\htmping.exe
O4 - HKLM\..\Run: [campsafe] C:\PROGRA~1\ELSEOP~1\drv each face.exe
O16 - DPF: Win32 Classes -
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_GB.cab
O18 - Filter: text/html - {383E4302-74A8-44CF-BA54-CC3A38E8736B} - C:\Documents and Settings\Lesley Clare\Local Settings\Application Data\microsoft\internet explorer\V0.15.dat

Go to Control Panel / Add/Remove Programs and remove the following if they are there:

ELSEOP This is abbreviated
EGGSLO This is abbreviated

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" and rename them, in order to delete some Files/Folders)

C:\WINDOWS\SYSTEM\blank.htm
C:\Documents and Settings\Lesley Clare\Local Settings\Application Data\microsoft\internet explorer\V0.15.dat
C:\PROGRAM FILES\ELSEOP This is abbreviated
C:\PROGRAM FILES\EGGSLO This is abbreviated

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad

by **Borogorn** » Thu Sep 02, 2004 10:19 pm

D'oh - sorry me being totally dumb here, how do I turn off system restore?

Boro

by **brad** » Thu Sep 02, 2004 10:24 pm

Right Click "My Computer" / Properties / System Restore tab.
Select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

brad

PCTech Forums

Disk checker

Disk checker

Who is online