Hard hang -help!

While connecting to internet (Internet Explorer 6) , home page starts to load,stops and hangs.PC becomes totally unresponsive-wont even respond to "end task ".Neither will it shut down -start, shutdown etc. Only way to shutdown and restart is by shutting off power.Restarts ok but same thing happens over and over.Same fault if I try connecting with Outlook Express.Every program that does not require an internet connection is working.No error messages.
Win XP HE -Dell Dimension 8300. Any suggestions,
Thanks, Seamus.

 

Seamus Hi
I dont know XP , hang in there and someone will reply.

couple questions , what type of connection and who is your ISP
do you have a router ,firewall, any other problems even if they seam unrelated ?

By the way you mention the problem I assume you are on another PC ? or is this random and your here now ?

IS XP all up to date ? and IE ?

Lonny

 

Lonny, I am on office pc. Problem not random, only started yesterday but is "permanent ". No other problems whatsoever until now.However Pest Patrol (from Zone Labs) was uninstalled shortly before problem began. Using dialup modem 56kb - ISP is Unison (I'm in Ireland). No problem establishing connection. Am also running Zone Alarm Pro and Norton Antivirus 2003. XP andIE up to date.
Seamus.

 

Seamus

The fact that this began after Pest patrol was removed possibly indicates a gremlin, that it had been holding at bay, is now loose.

Can you recieve email by going directly to your email without loading Internet explorer?

If so send me an email at mflynn@lexcominc.net and I will send you SpyBot and HijackThis by attachment. These should cleanup the problem.

Additionally it will confirm that it is a browser only problem if you can in fact send and recieve email OK.

Mike

 

Mike, thanks for your advice. I can not access my e-mail as the same thing happens with Outlook Express.Iam on my office PC at the moment and can only access my home e-mail through Mail2Web.

 

OK, I am off to work now so I will try to check in from there (but may not have time) but it sounds as if Dialup Networking is trashed.

If I cannot check in today I will post some fixes tonight unless you get it fixed before then.

Mike

 

Mike, thanks-would appreciate any guidance you can give. You may not hear from me until Monday or Tuesday as I am leaving the office now and will be travelling on business until then.
Seamus.

 

OK Seamus

Lets give it the shotgun.

First reset the TCP/IP stack.

Start-run
type (or copy and paste)

netsh int ip reset c:\resetlog.txt
________________________________________________

Next reinstall internet explorer

Start-run
type (or copy and paste)

rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %windir%\Inf\ie.inf

Reboot and test.

Mike

 

Mike. Away from base, unable to try the above. Update- a friend - suggested turning off ZoneAlarm Pro-after which everything appeared to return to normal.However after about ten minutes I tried to Hotsync my Palm Tungsten (requires internet connection) - disaster - total hang. Unable to even turn off PC except by turning off power. After turning on again as before- total hang with anything to do with internet and only way to turn off was by power shut off. Hope this helps- catch up with you as soon as I can. Many Thanks. Seamus.

 

Seamus

The procedures I recommended would correct both IE and the TCP/IP stack if needed, and will do no harm if not needed.

I would not have turned off the firewall yet as it may have allowed a gremlin to phone home and invite friends over to play. Turn it back on.

Lets do a preliminary cleanup, do the following:

Configure CleanMgr to max settings
Go to Start-Run and type

cleanmgr /sageset:1
The above need only be run once (these settings will be remembered as the default until another sageset is ran).

It will present a menu select all except compress, then

Go to Start-Run and type

cleanmgr /sagerun:1
As long as /sageset above has been ran on this computer from now on the /sagerun is the only thing that needs to run.

Since you removed Pest patrol. You may need to clean Spy/Adware. Pest patrol is so so in this area but get the best, SpyBot. And a close second is Adaware

Spyware and adware removal

SpyBot http://security.kolla.de/index.php?lang=en&page=download
Run this twice delete all it finds, "ALWAYS" run this before AdAware.
Leave all it wants to leave after the second run.

To config SpyBot properly do this, as soon as installed, download and install updates choose all updates but skins and languages.

Then click settings-scan priority and select "Time Critical (blocks everything else) ". Then slide to the bottom of this page and under Expert settings check "Show expert buttons in.... "

Then Settings-filesets and check the bottom three items also so that all on this page are checked.

Then

AdAware 6.0 http://www.lavasoftusa.com/
Run only after SpyBot!
Make sure to configure to Max settings, all files and compressed files. Delete all it finds.

Next get HiJackThis: http://www.tomcoyote.org/hjt/

This program is stand-alone does not need installing. It is ready to run. Put it in a folder in C:\Program files called HiJackThis.

Then run it. Click Scan (do not Fix), at the bottom of the screen click the Save log. It will want to save the log, name it hijackthis, click OK. You will now have the log on the screen, copy it and paste it back in a message to us.

Next

Still in HiJackThis, Click Config, then Misc tools, then Generate a Startup List. When this list is on screen copy it and paste it back to us in another separate post.

With the info from the 2 lists above we can advise you specifically from there.

Let me know.

Mike

 

You might be able to get into the Various Firewall setups and look for a list of what has been allowed to connect/been blocked to the net.

Look for a reference to the specific program and delete it. It may still belooking for the former Firewall.

I found when removing ZA that this list stayed behind. I never had a problem when unistalling Norton Internet security or Kerio. But did with ZA.

I also found some things in a HOST file in the Windows folder to be complicating matters.

It might also help to do Regedit and remove references to the Firewall that VERY LIKELY remained behind.

Also I found out the hard way. If a Firewall is not disabled and the machine restarted so that it does not even restart at boot up it may cause problems. Windows does have problems removing in use programs.

I have also had a case where I had to reinstall the offending program shut it down completely and then uninstall it. Some times it worked and other time it did not.

BillyBob

 

BB I don't think he has uninstalled, just turned off for testing purposes.

Mike

 

From original post

That is what I based my thoughts on.

Also when I am changing Firewalls I always pull the Machine to Router plug untill I get the new install.

BB

 

OOPS !!! Correction required.

From original post

This should read From an earlier post

BB

 

Yeah now he did uninstall Pest patrol but not the Firewall, he just turned it off to test if it was the problem.

10-4 on turning router off to deal with firewall, uninstall, reinstall or what ever!

Mike

 

Some possibilities. Some thoughts. Real or imagined.

If Pest Patrol is from ZA. Zone alram is from the same place.

The two may possibley SHARE some files.

Pest Partrol was uninstalled thereby possibley denying ZA itself access to files that now may not exist.

Under circumstances as I see them ZA may well not have been working properly anyway after the removal of Pest Patrol. Even if it did say it was active.

At least I myself would not trust it.

BillyBob

 

Mike,
Did all of the above - finally!. On the "rundll32.exe- etc." - message - The File "IEXPLORE.EXE" on Windows XP Home Edition Service Pack 1 CD is needed.
Tried several times to find it using Win XP CD which came with PC but kept receiving message "cannot find ---etc." This CD includes Service Pack 1.
Installed and ran Spybot, Adaware and HiJack exactlly as instructed - no problems.
I will forward Scan Log and Startup list in quick succession. One final thing, before I did all of the forementioned , I turned on Zone Alarm Pro again as I understood from your previous post that you would prefer this. However at the end of all the tests , nothing seemed any better, so I uninstalled and reinstalled ZA Pro and put all settings to default. Unbeleivably everything "seems" to be back to normal. (dare I say it!). I am actually on the PC at the moment for the first time in a week.
Looking forward to hearing from you.
Seamus.

 

Logfile of HijackThis v1.95.1
Scan saved at 20:40:08, on 21/07/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37800.190787037
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/dj/qdiagh.cab?306

 

StartupList report, 21/07/2003, 20:40:36
StartupList version: 1.52
Started from : D:\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
D:\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Seamus\Start Menu\Programs\Startup]
PowerReg SchedulerV2.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Digital Line Detect.lnk = ?
ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ATIModeChange = Ati2mdxx.exe
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
CTDVDDet = C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
UpdReg = C:\WINDOWS\UpdReg.EXE
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
CTHelper = CTHELPER.EXE
AsioReg = REGSVR32.EXE /S CTASIO.DLL
CTSysVol = C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
DVDSentry = C:\WINDOWS\System32\DSentry.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\LOGON.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

HP Usg Login.job
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[DmiReader Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SYSPRO~1.DLL
CODEBASE = http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB

[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37800.190787037

[QDiagHUpdateObj Class]
InProcServer32 = C:\WINDOWS\System32\qdiagh.ocx
CODEBASE = http://h30043.www3.hp.com/dj/qdiagh.cab?306

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 5,155 bytes
Report generated in 0.016 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Great Seamus

Zone Alarm got constipated, you gave it a laxative and all is well! I also looked at the posts you sent and see no real problems.

Good to GO!

Mike