Sys hangs in safe mode at agp440.sys

Edit Note: 7/20 - thread moved from XP to Security now that it contains a Hijackthis log. Newt


Hi all, I'm in Denver today helping my son on his computer which is getting very slow. There are a couple of issues going on.

His computer has begun to run slower and slower as time goes on.

When I run chkdsk /f I get an error saying it can't run because the volume is in use by another process. When I tell it to run after reboot I don't know if it runs or not. So thought I would run it in safe mode. When I try to boot in safe mode the system hangs at the driver agp440.sys.

I tried running sfc /scannow but the system hangs at agp44.sys.

I did a google on agp440.sys but found no answers. I'm thinking the driver is corrupt but can't find out how to replace it.... the driver is distributed by MS.

Would appreciate any direction y'all can provide. Leaving for Corpus Christi on Tuesday AM so don't have alot of time..... of course, who does

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;324764

Only problem with doing this is you'll have basic video driver. I'd check into the video card first. Go and get the driver updates for it. (agp440.sys is video)

 

I agree that chkdsk and sfc are certainly a great idea to run at this point.

After that, since the symptom you mention, His computer has begun to run slower and slower as time goes on. is a usual effect of spyware, you want to make sure the system is as clean as possible. Ad-aware and Spybot (from Quicklinks in my signature) for starters and let them remove all the bad stuff they are able to find. Dump the contents of each Temp folder on the PC and the TIF (temporary internet files).

After all of that, generate a log with Hijackthis (quicklinks again) and post it here. At that point, this thread will be moved to the security section.

 

Thanks guys, downloaded the latest and greatest from Nvidia and was able to boot in safe mode. That didn't help me run chkdsk as it still says the volume is in use by another.....

Will post back after running AdAware and spybot and hijackthis....

 

Hijackthis Log

We're running with XP Home and all updates are installed on a Compaq Presario 6024US.

The following is the Hijackthis Log:

Logfile of HijackThis v1.98.0
Scan saved at 8:17:42 PM, on 7/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\WINDOWS\System32\Promon.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\UltimateZip 2.7\uzqkst.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Kirk\My Documents\My Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search-itnow.com/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search-itnow.com/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://my.myway.com/my.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe "
O4 - Startup: UltimateZip Quick Start.lnk = C:\Program Files\UltimateZip 2.7\uzqkst.exe
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Identities &, - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditIdent.html
O8 - Extra context menu item: Passcards &. - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditPass.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Identities - {45DB34C3-955C-11D3-ABEF-444553540000} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditIdent.html
O9 - Extra 'Tools' menuitem: Identities &, - {45DB34C3-955C-11D3-ABEF-444553540000} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditIdent.html
O9 - Extra button: Passcards - {45DB34C3-955C-11D3-ABEF-444553540001} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditPass.html
O9 - Extra 'Tools' menuitem: Passcards &. - {45DB34C3-955C-11D3-ABEF-444553540001} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditPass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Advisor - {4C099C97-B2BE-403F-84EA-A45E07769444} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (HKCU)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...pple.com/abarth/us/win/QuickTimeInstaller.exe
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab

 

If the drive you're trying to run chkdsk on is the drive Windows is installed on you won't be able to do it without letting it schedule it to run on boot because it's always in use by Windows. Try letting it run on startup and see what happens.

 

Thanks Zander, I have told it to run on the next startup but I've done this about 6 times now and it only ran once. I want to run it again to insure errors have been fixed and so far it doesn't run at startup even though I say yes when it offers to do this....

 

Is it's possible it runs and you just don't see it? Check in msconfig on the boot.ini tab and see if NOBOOTGUI is checked. If so, uncheck it. It has the side effect of also not showing chkdsk while it runs. You can also look in the event viewer in the application part to see if it ran or not. Should be in an entry named winlogon.

 

Zander, I still haven't been able to get chkdsk to run at startup. When checking the Event Viewer under winlogon it says: "The shell stopped unexpectedly and Explorer.exe was restarted. "

Don't know what is killing it but as 'ol bones in Star Trek would say, "She's dead Jim, dead. "

 

Right click my computer and choose properties. On the advanced tab click on the settings button under startup and recovery. See if the line that says automatically restart under system failure is checked. If so, uncheck it and then schedule a chkdsk, restart the computer and see if you get an error message. If you do, write it down and post it here.

 

The Automatick restart was checked and now is unchecked, I then told chdsk to run at reboot and restart the puter. Still recieve the same error message. "The shell stopped unexpectedly and Explorer.exe was restarted. "

Isn't this interesting...

 

Hello Jim,

I notice that ZA is running. If v5.0, gave XP's users a lot of problems. One symptom was not being able to run chkdisk.

http://www.windowsbbs.com/showthread.php?t=31176&highlight=chkdisk

Regards - Charles

 

OK. Progress. There is some junk shown in the Hijackthis log that needs to go. Some I know about but others where I'm not sure so will wait and let one of the HJT pros give suggestions on that.

ZA could well be causing many of the problems. Not sure but I think if it were me I'd remove it and see if things get better. There are versions that aren't causing problems. I think 4.5 was fine and there may be a 5.x version that has the bugs killed off. Don't use it and not sure.

Chkdsk - boot from the XP CD to the recovery console and run chkdsk /r from there. It will run that way since the HD software won't be loaded.

 

Hi guys.... Son is going to check for ZA upgrade. He doesn't have a XP CD only a recovery disk.

Also this thread will have to go on hold for a few days as son is going into hospital for tests and won't be available.

Appreciate your help and we will be back with you at the end of the week.

Thanks

 

It's quite possible ZA is causing the problem as it adds a service (True Vector Internet Monitor). From what I've read about this problem apparently it's often caused by services added by installed apps. A couple more examples of some that do this are Diskeeper and I know some video cards will also add a service. You can see if it's ZA causing the problem by setting to not run at startup in the preferences section of ZA. When it's set to run at startup the True Vector Internet Monitor service is set to automatic and will always start when you start windows. When it's set to not run at startup the TVIM service will be set to manual and won't start unless you start ZA. If you do this, be sure to first turn on XP's native firewall or disconnect your internet connection if you're on cable or something similar. Also, I'd check in the services (start>run>services.msc) and see if there's any others there that have been added by an installed app. If ZA turns out to not be the problem and there are others, try disabling them.

It doesn't surprise me. I thought about this more after I posted that and realized you never said anything about the system rebooting. I figured I'd leave the post as is though as it's something you should do anyway. Could save a lot of trouble in the future.

Hope everything turns out OK for your son.

 

We finally uninstalled zone alarm and that was the problem running chkdsk. With that out of the way we still have a slow computer. As noted above, we have run adaware and spybot and submitted the log from Hijackthis. Looking for some feedback on the log and/or other actions we should take to find out why his machine is slowing down.

Thanks,

 

Hi Jim

First, if it's an option, I recommend you uninstall MyWebSearch and FunWebProducts in add/remove programs, then scan again with HijackThis and place a check next to the following remaining entries. Close ALL other windows and click fix. (all R1's and R0's)


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search-itnow.com/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/r...&c=1c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cus...://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search-itnow.com/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://my.myway.com/my.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/...IL/PhPSetup.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/f...etup1.0.0.6.cab


Fix all the 08's and 09's you want. They are extra toolbar buttons and menu choices in IE, which looks like it is quite cluttered. Don't use it? Fix it.

Recheck any unknowns you may have unchecked on the startup tab in msconfig and reboot, then delete the MyWebSearch and FunWebProducts folders in C:\Program Files.

Open C:\Temp if present, select all and delete.
Open C:\Windows\Temp, select all and delete.
Open C:\Documents and settings\username\Local Settings\temp, select all and delete. Do this for all usernames.
Open C:\Windows\Prefetch, select all and delete.
Open My Computer, right click Local disk C: and choose properties, then disk cleanup. Check all boxes except compress old files and OK.

Scan the PC with RAV. Check the box to autoclean. If any files are infected and uncleanable, click the report button then copy and paste it here, along with a new HijackThis log.

Additionally, copy and paste the following command into the address bar then hit enter.

javascript:navigator.userAgent

Copt the text of the resulting window and paste it here with your next reply.

 

You wouldn't happen to have a left a CD in the drive, would you?

This "system freeze on AGP44.SYS" problem happened to me also. Not even booting with the "last successful configuration" nor "safe" mode would work. As part of troubleshooting, I carefully observed my pc's visible queues and noticed that around the same time the system lockup would occur, the CDROM drive would spin quite a bit. It then donned on me that I had left a self-loading game disc in the drive. Apparently, the game attempts to load *before* the proper video drivers can be loaded by Windows, thus causing the hang. Simply opening the CD drive drawer immediately allowed Windows to boot normally.

Your problem could be totally different and truly attributed to corrupted drivers, but figured I'd post my experience just in case...

Regards,
Tom