Hijackthis log help please

wannabe_moneysaver

Hello

Following on from my thread yesterday, I have been following the advice on the sticky to try and revive our old laptop. This has went well and I have removed everything I have felt confident that I dont need but I'm still a bit surprised that on the disk fragmenter thing, it shows the machine only has 24% of free space. The only thing, I think, is on the machine, other than the things I have downloaded per the instructions is itunes. I thought id have lots of lovely free memory/space/whatever its called, or am I looking in the wrong place, does this figure not relate to this?!

Here is the Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:31:03, on 29/12/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\PRISMSTA.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [AgentMonitor] C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
--
End of file - 4584 bytes

Commit charge total = 200472
Commit charge peak = 482408
Physical memory total = 523244
Physical memory available = 328804
System cache = 373224

Thanks in advance for any pointers and a huge thanks to closed for the help last night and for the very helpful sticky. I am grateful that the machine even works and it certainly does appear to be faster.

GunJack

re:- the 24% free, how big is the hdd ? if it's an older lappy with a smallish hdd, that could mean you're using 22GB of 27GB, or even 16GB of 20GB. As long as you can keep to around 20% of your hdd free, that should suffice for smooth running.

Your pagefile - have you altered it at all? If not, right-click on My Computer > Properties > Advanced > Performance Settings > Advanced > Virtual Memory > Change and set a Custom Size to 2048MB max and min. (This requires a reboot to change, normally).

for the HJT log, not too much trimming left to do on there. Tick and fix (in HJT) the 016 and 022 entries. If you've been following the sticky then you'll have CCleaner installed. Open it, go to the Tools tab (left hand side), Startup, and disable iTunes helper, VTec launcher, hotkeyAp, LaunchApp, OSD and Wbutton, reboot the lappy and post new commit charge and HJT log.

closed

The sticky is aimed at freeing ram up rather than disk space.

install cleanmem if you haven't already

disable these using msconfig, startup tab

O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [AgentMonitor] C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe

tick and fix these using hijackthis

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/ge...sh/swflash.cab

does itunes need to be on, and vtech software? disabling them from startup using msconfig, will free up ram and make booting faster, you can run the same exe manually via an icon if required without uninstalling them.

check the price of a ram upgrade, if you can get 1GB or more fairly cheaply it will breathe new life into the machine if tweaking doesn't

http://www.crucial.com/uk/

what does windirstat say, have you got multiple partitions, eg a d: data drive

what size is the hard disk, what size are the partitions, and what are the free space and used space figures, all found in explorer

the amount of free space in GB is more important than the percentage, quite often disks are split into multiple drives, which makes the c: drive appear full, but there will be other partitions mostly unused.

wannabe_moneysaver

closed wrote: »

The sticky is aimed at freeing ram up rather than disk space.

install cleanmem if you haven't already

disable these using msconfig, startup tab

O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [AgentMonitor] C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe

tick and fix these using hijackthis

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/ge...sh/swflash.cab

does itunes need to be on, and vtech software? disabling them from startup using msconfig, will free up ram and make booting faster, you can run the same exe manually via an icon if required without uninstalling them.

check the price of a ram upgrade, if you can get 1GB or more fairly cheaply it will breathe new life into the machine if tweaking doesn't

http://www.crucial.com/uk/

what does windirstat say, have you got multiple partitions, eg a d: data drive

what size is the hard disk, what size are the partitions, and what are the free space and used space figures, all found in explorer

the amount of free space in GB is more important than the percentage, quite often disks are split into multiple drives, which makes the c: drive appear full, but there will be other partitions mostly unused.

Thanks GunJack and closed for your replies. GunJack, I have done what you suggest and will post an updated log just shortly, I'm a bit stuck with a couple of the points on closed's post... I am probably being very dense but here goes...

I'm a bit stuck re disabling things using msconfig from start. Does this bring up a box headed system configuration untility? On the Startup tab, there are a few things with the boxes already ticked, is it only the items you mention that I should disable?

The itunes and vtech box weren't ticked so presume i should do that? I didn't realise something started with them during start up. The vtech thing is like itunes/library type thing for the kids innotabs.

Re windirstart, I dont seem to have multiple partitions, it only mentions C:? It lists a whole load of numbers - size, percentage, items, files, should I list these?

On Local Disk (C:) Properties:

Used space 29.2GB, free space 8.04GB and capacity 37.2GB.

Is there anything else I should do, other than the msconfig thing?

Noted re ram upgrade. Can you advise what is a reasonable price for this please?

Thanks very much again for your help and patience.

GunJack

Free up disk space - follow this post, it's slightly different on XP, but same principle and will be fairly obvious what you're doing:-

http://forums.moneysavingexpert.com/showpost.html?p=25746315&postcount=7

NOTE:- when the disk cleanup bringsd up the list of files it can bin, tick all the list EXCEPT the Catalog for Indexing line, and DO NOT tick the Compress Files to save space option.

and also get shut of any old programs/files/etc. you don't need any more.note that when uninstalling progs, it doesn't often delete the file folders from the Program Files folder, you have to do this manually after uninstalling.

for the RAM, run Crucial's online scanner of your lappy, and see what type is in there and if you have any free slots or not

http://www.crucial.com/uk/

wannabe_moneysaver

Thanks for all of that, will go and give it a go. Thanks again.

closed

is it only the items you mention that I should disable?

yes

in msconfig, the ones I suggest should be unticked

--

hijackthis is the other way around, you tick things you want to disable, ie the ones suggested.

does the machine have a d: drive, is it a hard disk partition, or a dvd/cd?

reasonable price depends on you, the age of machine etc. what price does it give, which machine is it.

wannabe_moneysaver

GunJack wrote: »

Free up disk space - follow this post, it's slightly different on XP, but same principle and will be fairly obvious what you're doing:-

http://forums.moneysavingexpert.com/showpost.html?p=25746315&postcount=7

NOTE:- when the disk cleanup bringsd up the list of files it can bin, tick all the list EXCEPT the Catalog for Indexing line, and DO NOT tick the Compress Files to save space option.

and also get shut of any old programs/files/etc. you don't need any more.note that when uninstalling progs, it doesn't often delete the file folders from the Program Files folder, you have to do this manually after uninstalling.

for the RAM, run Crucial's online scanner of your lappy, and see what type is in there and if you have any free slots or not

http://www.crucial.com/uk/

I have followed the instructions in the post. I now have 28.1GB used and 9.10 free.

Re the crucial scan:

Memory Type: DDR PC2700, DDR (non-ECC)
Maximum Memory: 2GB
Currently Installed Memory: 512MB
Total Memory Slots: 2
Available Memory Slots: 0

wannabe_moneysaver

I have now followed everything suggested. When I restarted I got a message saying start up was now in diagnostic or selective startup mode and to choose normal mode and undo changes. I have ticked the button to not show the message again.

Here is the new hijackthis log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:38:42, on 30/12/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lee\Desktop\HijackThis.exe
C:\WINDOWS\system32\msiexec.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
--
End of file - 2727 bytes

Commit charge total: 250940
Commit charge peak: 293948
Physical memory total: 523244
Physical memory available: 267964
System cache: 258546


Closed - the d drive is a dvd/cd drive.

I'll be happy if I know the machine is working to the best of its ability, esp since its ancient!! I have already since a huge difference in its speed, especially in the start up so thanks a million.

I am going to attempt the speed-up guide on laptop no 2 tomorrow! I have also taken your advice re backing up to more than one place and have reserved another external drive which I'll collect tomorrow Thanks so much.

closed

google update service has crept in there, did you install chrome, google toolbar or similar?

delete the google update task from c:\windows\tasks

reserved from argos? often far cheaper elsewhere.

http://www.ebuyer.com/search?sort=price+ascending&cat=393&store=33&cat=393&page=1

wannabe_moneysaver

I wasnt aware that I had, now deleted! Does everything else look ok? I can't begin to tell you how much I appreciate all your help, you are a real saviour giving your time to help people, especially clueless ones like me! Thanks a million.

I have reserved this one from Currys http://www.currys.co.uk/gbuk/western-digital-my-passport-portable-hard-drive-500gb-black-14732336-pdt.html Does it look ok?