XP - Processes vs. Applications

I've got myself an unfortunate rep as the person who can deal with spyware and adware, so I've spent a lot of time lately divesting other people's computers of the little bugs their kids accidentally install. Now I've got myself a good one.

This is a laptop running XP Home without either SP. I've installed and run Spybot, Adaware, and AVG, none of which they had to begin with, although they were using several of the spyware-installers that pose as Spybot and Adaware. Scanning - offline - the real deals managed to clean out a lot of baddies, but the thing is still running poorly, and I can't seem to find what's causing this.

The basic problem, which I know has been going on for some time, is that some of the icons on the desktop don't respond promptly, or do what one expects. Double clicking on Internet Explorer, for instance, doesn't visibly open IE, or at least not for a few minutes. And yes, I mean minutes. However, if I open the Task Manager, IE is running under processes, although it's not open as an application. And sometimes it does eventually open, but not always. The same thing happens with Windows Explorer - long delay before anything comes up, sometimes long after I've given up and gone on to something else.

Does this suggest anything?

 

Hi bently,

You can start by doing selective startups of the apps - which basically means disabling all the apps and then enabling them one at time. You can do this either thru msconfig - on the main panel: Diagnostic or Selective or manually. My preference is manual first.

How does the system run in safe mode?

You should also think about running the system thru on-line virus checks: http://www.windowsbbs.com/links.php and posting a
HJT log and run the startups thru this site:http://www.answersthatwork.com/Tasklist_pages/tasklist.htm For startup programs

Regards - Charles

 

Good ideas - all of them. Right at the moment I'm running Defrag - and finding more of it fragmented than any system I've seen in years. When that's done I'll do a selective startup. I hadn't thought of that. It helps to have a plan.

It seems to me that spyware removal is all a matter of having enough patience to keep at it until you get somewhere. Unlike the guy in the NY Times on Friday who insisted the only answer was to do a complete reformat and start over!

 

Well, having used the Scientific Method in combination with a lot of Google, I think I've finally diagnosed the problem, and I think it's going to be a bitch to fix.

Analyzing the Event Viewer, which takes some doing, I discovered that there have been a bunch of DCOM error 10010s whenever the system has been trying to access Windows Explorer. Somewhere along the line - long before I got involved - the registry had gotten corrupted. The fact that there were a ton of trojans, spyware out the ears, and dowloaders to beat the band were probably only incidental, but I think the damage is beyond the scope of AVG, Spybot, Adaware, and CWShredder.

One of the additional pains in the neck is that I haven't been able to get the laptop online here at the office, so everything that I might want to download to try has to be burned to disc on my other computer and installed.

Using all those tools I've found a bunch of registry problems, but the basic problem is that as I understand it, now I need to run SFC with the Win XP disc, which I don't have today. Any further suggestions??

 

Hi bently,

The only suggestion that I have given no XP cd, is to see whether there is a Restore point prior to the problems. By the sound of things, that's a long shot. If SR has been working correctly, and SR is set at 12% of drive space, then maybe you have a restore point that goes back 90 days.

Regards - Charles

 

I think the problem has been going on longer than that. I'm going to check for restore points, but the baddies seem to have been on the system for a long time. The XP CD is at home, so I should have that tomorrow, and we'll see how that works. If all else fails, brain surgery by hatchet may be the next step!