PC slow to start up and sometimes blank screen

krishna

We have a Dell 4600i PC. It has a 3.00 gigahertz Intel Pentium 4, 16 kilobyte primary memory cache, 1024 kilobyte secondary memory cache. Also 1Gb RAM (2x 512MB). I installed a Samsung F3 1TB Model: HD103SJ hard drive last year following some support I had on here for problems with the PC hanging, etc. (see this thread) https://forums.moneysavingexpert.com/discussion/2740848
The original hard drive and a WDC WD1600JB-75GVA0 160GB is still installed as a secondary drive but rarely used.

With the new install of XP Pro on the new hard drive, everything improved significantly. Over last couple of months we have been having another problem. On start up, the computer freezes for some time while displaying the NOD32-AV startup banner. When I say freezes, I mean the clock even stops. This stays like this for around three minutes, then everything works normally. This happens EVERY time we start up. Also, occasionally on startup the screen stays blank. The only way to recover from this is to force a shutdown of the computer and restart. Then, usually, everything works normally. And sometimes, if the computer has been left idle and shut down the monitor, moving mouse or pressing keys fails to bring it back to life, and again we have to force a shutdown and restart to get screen working again. The screen is a Samsung SyncMaster913N that behaves itself well if plugged into anything else, so I am fairly sure the problem is with the PC.

Any suggestions on what to do to try to resolve these problems?
Thanks

jackj

install ccleaner and clean your pc and also the registry. and remove the unwanted programs from the startup. if you still having problem then restore it.

gonzo127

https://forums.moneysavingexpert.com/discussion/2436849=

always a good place to start

RussJK

I wouldn't use a registry cleaner - the only significant change a registry cleaner is likely to cause is a negative one.

Do you have any other antivirus programs installed? Run Appremover (www.appremover.com) and let it scan for security programs, and remove anything that isn't NOD32. Also run the second scan type, 'Check For Failed Uninstall' to see if any remnants are sticking around.

Try following closed's mini guide as best you can as it covers most of what you'd be advised to do, and will save everyone some time/effort. The obvious exception that you should ignore steps 4 & 5, since you've paid to use NOD32. Post the commit charge figures as in step 1, and feel free to to post a HijackThis log here AFTER you've followed everything in that thread.

pineapple

I've been using ccleaner for years without a problem. I would trust this above others. I also recommend spybot for the 'tools' function. It's an easy way to view start up items - often with a comment about whether it is needed and gives the option to untick temporarily.
I'm assuming you already did virus checks.

krishna

Followed closed's instructions and that seems to have resolved the slow startup problem. Excellent!

I also had a problem with google links being forwarded to ad sites. Should the above resolve that? Nothing found on malware scans.

Now to do the same on my netbook. Works fine, but no harm in trying to squeeze out a little extra performance.

Yes, I've used ccleaner for years without problem. Tried ncleaner last year and it totally messed things up. Still, better to be careful with the registry I guess.

closed

scan with tdsskiller

delete c:\windows\system32\drivers\etc\hosts

post a hijackthis log

RussJK

krishna wrote: »

Followed closed's instructions and that seems to have resolved the slow startup problem. Excellent! I also had a problem with google links being forwarded to ad sites. Should the above resolve that? Nothing found on malware scans.

That's more significant than just 'slow startup'. Are you still getting the search hijack? What malware scans have you run?

The usual places for hijacks are in the browser proxy, the DNS settings, and in the hosts file. If that isn't it, then it may be a rootkit.

1. Look for standard hijacks:

• Go into the connection settings of Internet Explorer or Firefox etc, and make sure there aren't any proxies selected - or if you use a proxy, then double check it. For example, Internet Explorer should look something like this (http://www.users.on.net/~russ/connection.png).
• To make sure the Hosts is clean, use something like HostsXpert (http://www.users.on.net/~russ/hx.exe) and run it as Administrator. A clean hosts file should look something like this (http://blog.priveonlabs.com/media/blogs/priv/hosts.GIF). A hosts with malware-related changes such as a google redirect may look something like this (http://www.users.on.net/~russ/dodgyhosts.jpg). Use Hostsxpert to 'restore MS hosts' if you need to, making sure the lock icon is open on the top left.
• To check the network and wireless adaptors, then go into Network connections from the Control Panel, until you find the adaptors, and go into TCP/IP settings of any adaptors there and make sure there is nothing in the DNS part - it should look something like this (http://www.cguy.net/wireless_networking_guide/images/Internet%20Protocol%20TCP%20IP%20Properties.jpg).

If you have to remove a dodgy DNS, proxy, or Hosts setting, then afterwards press Start > Run, and type in 'IPconfig /flushdns' to clear it.

A HijackThis log would find all that for you, so someone else can see what system settings are changed. Save this to the desktop (http://www.trendmicro.com/ftp/products/hijackthis/HijackThis.exe), and then hold down LEFT SHIFT and RIGHT CLICK on it and select 'Run as Administrator', run a system scan and save log, and post here.

2. Look for malware and rootkits

• Install the latest Malwarebytes Antimalware in case you can't update it (http://www.malwarebytes.org/mbam-download.php), try to update it, then run a Quick scan (not full) and clean anything it finds. Post a log either way.
• TDSSkiller is a quick way to eliminate a certain kind of rootkit, but potentially can make the computer unbootable (http://support.kaspersky.com/downloads/utils/tdsskiller.exe). The log is found on the root of drive C.

These are just the first steps.

krishna

Don't seem to be getting the search hijack anymore, but here is the HijackThis log file in case I have missed anything

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:29:36, on 10/05/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\sipgate X-Lite\sipgateXLite.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version6\TeamViewer.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Mozilla Firefox 3.6\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox 3.6\plugin-container.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Krishna & Augene\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [XSC SIP Client] "C:\Program Files\sipgate X-Lite\sipgateXLite.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-30ADC5552151} - C:\Program Files\PlotSoft\PDFill\DownloadPDF.exe
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (Egg Money Manager Digital Safe) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1286211434093
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1291168660875
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.165.202,93.188.160.173
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 93.188.165.202,93.188.160.173
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.165.202,93.188.160.173
O18 - Protocol: amisie - {183A003A-3D01-4E94-A2C5-AD0108C68370} - C:\Program Files\AMIS\IeDtbPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

--
End of file - 5976 bytes

closed

nameservers are pointing to ukraine

http://www.ip-adress.com/whois/ukrtelegroup.com.ua

if you want speed, switch from nod to avast 6 free, follow instruction regarding ctfmon, and install cleanmem

You've also got canon,teamviewer,sip software constantly running

where did this come from?

C:\Program Files\AMIS\IeDtbPlugin.dll

what fixed the hijack? tdss?

krishna

Thanks for all the help. This is brilliant.

What can I change the nameservers to? I use XILO as my ISP.

Not sure what fixed the hijack. It stopped after I ran through your excellent 60 mins message. I the ran tdss and it found something and cleared it.

I understood Nod32-AV was supposed to be the leanest AV software. I'm not running Eset Smartsecurity, just the AV programme. Is Avast really faster? Is it as reliable? Apart from this hijack, I've not had any problems for years.

Need the sip software running, but I guess I could just use the canon stuff and teamviewer when needed. AMIS is software for reading DAISY books (digital talking books mainly used by visually impaired people)