2K Too slow on logoff/restart

Just don't know what happened. My system was fine until today. One of my daughter's friends brought over a flash drive to play music. I noticed this evening my hard drive was reading/writing constantly. Processor was at nearly 100%. I only have 128MB RAM on my 400Mhz system and it appears the system was using it all and then some.

I read through the threads and found one similar but didn't want to perform the tasks in it until I had some more advice.

I have included a Hijack this log and Silent Runners Log in this post. I ran AVG, SpyBot S&D, and XCleaner_Micro all returning no threats. I used EasyCleaner to check my registry and it found no invalid entries.

The system is somewhat slower during normal use, it is just when I try to log back on it takes nearly 20 minutes to bring up my desktop (it usually takes three to four minutes). I even tried to run it in safe mode but it still took an extremely long time to come up. I hope someone will have some ideas.

Hijack This:

Logfile of HijackThis v1.99.1
Scan saved at 2:22:40 AM, on 2/21/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINNT\system32\internat.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe "
O4 - HKCU\..\Run: [internat.exe] internat.exe
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} (OSInfo Control) - http://www.sis.com/ocis/OSInfo.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {16095503-786F-4097-AED6-5D567A26D760} (SiS_OCX Control) - http://www.sis.com/ocis/SiSAutodetectNT.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1164750140072
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

Silent Runners:

"Silent Runners.vbs ", revision 49, http://www.silentrunners.org/
Operating System: Windows 2000
Output limited to non-default values, except where indicated by "{++} "


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ {++}
"SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [ "Safer Networking Limited"]
"PopUpStopperFreeEdition" = " "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" " [ "Panicware, Inc."]
"internat.exe" = "internat.exe" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run \ {++}
"Synchronization Manager" = "mobsync.exe /logon" [MS]
"AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" [ "GRISOFT, s.r.o."]
"SmcService" = "C:\PROGRA~1\Sygate\SPF\smc.exe -startgui" [ "Sygate Technologies, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" [ "Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension "
-> {HKLM...CLSID} = "Display Panning CPL Extension "
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext "
-> {HKLM...CLSID} = "HyperTerminal Icon Ext "
\InProcServer32\(Default) = "C:\WINNT\System32\hticons.dll" [ "Hilgraeve, Inc."]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension "
-> {HKLM...CLSID} = "AVG7 Shell Extension Class "
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" [ "GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension "
-> {HKLM...CLSID} = "AVG7 Find Extension Class "
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" [ "GRISOFT, s.r.o."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandler s\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "
-> {HKLM...CLSID} = "AVG7 Shell Extension Class "
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" [ "GRISOFT, s.r.o."]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000} "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMen uHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000} "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHa ndlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "
-> {HKLM...CLSID} = "AVG7 Shell Extension Class "
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" [ "GRISOFT, s.r.o."]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000} "
-> {HKLM...CLSID} = "WinZip "
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellState

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Mitch\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp "


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINNT\system32\logon.scr" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [ "GRISOFT, s.r.o."]
AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" [ "GRISOFT, s.r.o."]
Sygate Personal Firewall, SmcService, "C:\Program Files\Sygate\SPF\smc.exe" [ "Sygate Technologies, Inc."]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 204 seconds, including 14 seconds for message boxes)


Not sure what else to do.

 

Ok Mitch

Look in Add/Remove and see if they did in fact install something.

Then
Start-Run
type
cmd
then type
taskmgr
click processes

look under CPU for any process except "System Idle process" that has a high number and end it. See if back to normal and let me know what it was. System Idle process should be high and all the others should be low or zero or up and down.

Go here http://windowsbbs.com/showthread.php?t=61089
and do post #5

Reboot

See if that puts you back to normal itself.

Download these

Extract them and put the exe files in windows\system32 (you may have Winnt) then wnint\system32

http://www.dynawell.com/reskit/microsoft/win2000/sc.zip

http://www.dynawell.com/reskit/micro...000/sclist.zip

Start-Run
type
cmd
then type

sc query type= service state= all > c:\allserviceslist.txt

then type
exit

Then open notepad or wordpad and browse to the root c:\

open allserviceslist.txt
Copy and paste back to the BBS

This will allow me to see all the services you are running and what their state is.

Mike

 

Ok, here it is. Earlier I had shut down Automatic Updates (it was taking up 20% of the CPU time). system ok at idle. My problem now is the slow logoff and extremely slow restart. No unwanted programs installed.

Enum: entriesRead = 10
Enum: resumeIndex = 54

SERVICE_NAME: Alerter
DISPLAY_NAME: Alerter
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: AppMgmt
DISPLAY_NAME: Application Management
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: Avg7Alrt
DISPLAY_NAME: AVG7 Alert Manager Server
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: Avg7UpdSvc
DISPLAY_NAME: AVG7 Update Service
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: AVGEMS
DISPLAY_NAME: AVG E-mail Scanner
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: BITS
DISPLAY_NAME: Background Intelligent Transfer Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: Browser
DISPLAY_NAME: Computer Browser
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: cisvc
DISPLAY_NAME: Indexing Service
TYPE : 120 WIN32_SHARE_PROCESS (interactive)
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: ClipSrv
DISPLAY_NAME: ClipBook
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

SERVICE_NAME: Dhcp
DISPLAY_NAME: DHCP Client
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
Enum: more data, need 5160 bytes start resume at index 54

 

Hi Mitch

Clarify:

Running normally now except when shuting dow and booting up?

Get back while I prepare another post for you.

Mike

 

Get and install below get control of startups
http://www.mlin.net/files/StartupCPL.zip

Download XP task list
http://www.computerhope.com/download/winxp/tasklist.exe

move it into into windows\system32 folder

then start
run
type
cmd
at prompt type

tasklist /svc >c:\tasklist.txt
hit enter, close window

In Notepad or Wordpad browse to c:\ open it and paste back.

Mike

 

If it is trying to connect to a bad ip on boot the following should help clear it.

go to cmd prompt and type each of the lines below
depending on your setup you could get errors that is OK

netsh interface ip delete arpcache

ipconfig /flushdns

ipconfig /release *

ipconfig /renew *

ipconfig /registerdns

nbtstat -RR

The pagefile can cause both slow shutdown and bootup

Download XP-Antispy load it and use it to clear your pagefile on shutdown after 1 shutdown you can then clear this setting as you will now have a clean pagefile.
http://xp-antispy.org/index.php?option=com_remository&func=download&itemid=3&mirrorid=7

Mike

 

Mike,

Yes it appears to be running fairly normally (for it's speed) since I dhut down the Automatic Updates. And yes the only real problem I have right now is the slow logOff (last time it locked up with just the background showing so I restarted after several minutes - then it took 14 minutes to reboot to normal use [normally takes about three minutes]). Will download those files and post back.

Mitch

 

Got the startup file. Tasklist.exe only works with XP (according to the error message at the command prompt.

Mitch

 

Hmmm I am sure I have used it (tasklist) before on 2k.

But do all the rest and get back to me.

Do all the cleanups (ATF-Cleaner etc) again, but in safe mode.

Are you on a a router or directly connected to a cable/DSL modem?

command prompt
eventvwr.msc

Clear the logs all of them save if you want not needed.

Then reboot

recheck the event logs and now only fresh things that happened on reboot will be there.

Then on system and Application only save the log file as appl.txt and sys.txt note where they are saved. Open in Word or Notepad and post back.

mike

 

Will the xp-antispy link above work on my 2000?
here are the log files; it appears something errored at startup in the sys log.

2/21/2007 5:28:21 PM EventLog Information None 6005 N/A HOME-MITCH The Event log service was started.
2/21/2007 5:28:21 PM EventLog Information None 6009 N/A HOME-MITCH Microsoft (R) Windows 2000 (R) 5.0 2195 Service Pack 4 Uniprocessor Free.
2/21/2007 5:29:57 PM Service Control Manager Error None 7022 N/A HOME-MITCH The DNS Client service hung on starting.
2/21/2007 5:26:21 PM EventLog Information None 6006 N/A HOME-MITCH The Event log service was stopped.


and here is the appl log

2/21/2007 5:30:58 PM AVGEMS Information None 1 N/A HOME-MITCH Service started


When I restarted it took only about five minutes to get to the log on screen - much better. but it took several minutes to log me on and at about 9 minutes I still didn't have my startup program on the bottom right of the screen. I logged off and on again and it took only about 1 minutes 10 seconds. That is the way it should be.

Mitch

 

OK Mitch

Something came up here.

I will need time to think and compose probably in the morning.

But it is something to do with DNS. Go to services and set DNS Client to Disabled.

Reboot and if you have web access you do not need that service. It may clear the problem.

Get back to me on this tonight especially if it fixes the issue.

Mike

 

Mitch

You don't need to download "System file checker" or "Chkdsk" they are already on 2k.

To run System file checker you may need your 2k install disk

command prompt
sfc /scannow

to run Chkdsk

start run
chkdsk /r
it will want to run on a restart

don't do the sfc until you have disabled DNS Client as in my last post.

Mike

 

OK, I will take care of all this when I get off work tonight. Don't want to reboot now it takes too long and my wife wants to play friday night poker while I am gone

Mitch

P.S. Mike, you are the man!!!!! I disabled DNS and my system rebooted just fine. I also rean chkdsk and sfc. chkdsk - system clean. sfc - had some problems replacing some files - bad spot on my CD (big ole scratch). Not to worry, I have a friend with win2K and will get his CD and run sfc again. System rebooted in under four minutes.

Mitch


BTW: I have something in my installed programs called "webfldrs" when I select it to remove I do not get an option to remove it (the remove button is grayed out) how can I get rid of it?

 

Great Mitch

Looks like I took you to raise!

Use the cleaners ATF EZpcfix and others every 2 weeks or so to stay ahead.

Same for SpyBot and Adaware don't even run them unless you update first.

I would load the below protections and since you have done all this cleanup I would defrag.

Block hundreds of bad sites
MVP Block-list
[http://www.ericphelps.com/security/index.html#HOSTS
See this page for instructions.
-----------------------------------------------------------

KHBlocker download and install.
http://www.softpedia.com/get/Interne...-Blocker.shtml
Once installed and scanned while unconnected, and all seems well then connect cable back then connect to the Internet and update via Windows update and all the above that we installed while disconnected.
-----------------------------------------------------------

Thanks for moving this post from the Spyware forum where I am blocked so I could help you. This the reason I am leaving the BBS again for sure when we finish you other issue and 1 other person.

Good luck to you Mitch

Mike