XP OS Freezing

PLEASE HELP!!

This problem has been touched on before but the posts seem to peter-out or the problem was easily resolved – unlike my case.

The problem – a few months ago my Dell Dimension 8250 started to freeze for no reason. The screen would show its last view when it froze not a blue screen, the keyboard and mouse would be dead. Task Manager cannot be called up. To all intents and purposes it is completely dead although the fan continues and – if the screen had a cursor or an animated web page running at the freeze these would continue to flash or change.

It would freeze at any time, when inactive, when in use or even during the boot procedure. The freezing would be at irregular intervals, some times hours between sometimes minutes. I tried re-formatting all the drives a couple of time but it did not solve the problem.

A friend suggested it could be a problem that something was interrupting a disk write procedure and causing the crash. The PC was always quite well virus and firewall protected as far as I am aware (I have 20 years of day-to-day computer experience but no formal training in operating systems etc.). Checks were made and no viruses, worms or Trojans found. So as I had a major project to finish in a hurry I bought a new desktop – a Fujitsu Siemens Scaleo 600.

Surprise, surprise – same problem exactly. This time when I re-formatted I re-installed the programmes one at a time with a few hours or days between and initially all seemed to be OK. But then after a week or so the same thing started again. Again the PC was protected and nothing showed up on virus and other checks.

Then my company gave me an IBM T41 laptop and – yes, same problem again. So it must surely be a software problem – too much coincidence for 3 PCs to all have the same hardware problem.

Nothing shows up in Event Viewer at the time of the freeze as far as I can understand the reports. All PCs have probably had a worm such as Blaster at some time because it seems to get in before one can configure the firewall. All have been successfully removed by Symantec removal tools according to the reports.

I have run all obvious things such as PC Doctor (supplied) and general housekeeping utilities. I have downloaded a program called PC Surgeon which seems quite powerful but too complex for me to use. This may show up the problem if I knew how to use it but the normal logs which it produces do not seem to show any event at the freeze time.

The modem/router has been changed for different reasons but it makes no difference to this problem.

I am sure its nothing to do with hibernation or other power settings.

The programs I am running are, for example, but not a complete list:

OS – XP Home and Pro depending on PC
MS Office 2000
Adobe Acrobat 6
Photoelements
Skype
Persono Headphone software
Canon and HP Scanner and Printer software
Roxio CD and DVD software
Norton Internet Security (although I have run Zone Alarm as well with no difference)
Soundmax
ISP’s Modem/router software

How can I find out what is causing this?

 

To begin with:

Hi cmagee,

Freezes "even during the boot procedure" - does that mean before the XP graphic screen shows or after?

In "programs I am running" you don't mention any firewall or antivirus software. Is that the case?

"How can I find out what is causing this? "

First, make sure you are protected by a firewall amd an antivirus program. Then download spybot from:
http://www.safer-networking.org/index.php?page=mirrors

run it and report back.

 

Dump this

and see if the problem resolves itself. At the very least, be sure you have all the latest updates and patches direct from Roxio. Xp and Roxio don't always play nice.

HTH
Johanna

 

That Skype doesn't sound very stable either:
Skype currently has problems working while the following software is installed and running on the pc: ZoneAlarm in combination with Windows 98. I realize this is XP but where's there's smoke there may be fire. It wouldn't be the first time that a known problem or bug, in a piece of software, was allowed to continue through future versions.

See:
http://www.skype.com/help_knownproblems.html

There, apparently, is other issues and, I suspect, undisclosed/undiscovered ones as well. Particularly if using the beta version. Considering this is P2P software and made by the same guys a Kazzaa I would not find it strange that crashes, conflicts and freezes would occur.

I'd unistall this also, at least as tester for the possible problematic application combination.

 

XP OS Freezing - reply to suggestions

Thanks to Sparrow, Johanna n goddez1 for suggestions to which I respond below.

The boot freeze usually occurs after the logo but I think once before (the boot freeze is rare, maybe 1 in 20 re-boots). If you look at my software list you will see I mention Norton Internet Security which is personal firewall and AV. Also I have been running Zone Alarm at times. I ran spybot and it picked up a few seemingly innocuous entries such as cookies, bookmark and a couple of registry entries which referred to a download manager. Afterwards no change to problem.

I also removed Roxio and Skype and no change either. Incidentally a group of 8 of us use Skype almost daily between Cayman Islands, Spain, Denmark and Switzerland with little problem. No-ne has the same problem as me, the only problem has really been to control volume sometimes and to get Skype to keep the headset in its settings.

Paradoxically since I installed PC Surgeon on one PC, even though I am not running it, the PC seems more stable. However, the freeze can always be provoked by trying a virus scan.

Strangely on the last freeze a few minutes ago, when I relaunched Outlook the screen (& mouse and keybord) froze but new messages kept downloading into the inbox.

Any other ideas?

 

Try hijackthis

cmagee,

Download hijackthis.exe from:

http://209.133.47.200/~merijn/files/HijackThis.exe

and copy/paste the log in messages (takes 2-3 i think). The members will examine the log and report back to you.

 

Hi Sparrow - log below

Logfile of HijackThis v1.97.7
Scan saved at 13:17:14, on 12/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMTray.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\Archivos de programa\ScanSoft\OmniPageSE\opware32.exe
C:\Archivos de programa\TweakMASTER\TwMaster.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\Archivos de programa\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Archivos de programa\Archivos comunes\efax\HotTray.exe
C:\Archivos de programa\Archivos comunes\efax\Dllcmd32.exe
C:\Archivos de programa\PerSono\perstray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Telefonica\KitAIM\AimMon.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccProxy.exe
C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Archivos de programa\Norton AntiVirus\SAVScan.exe
C:\Archivos de programa\Microsoft Office\Office10\OUTLOOK.EXE
C:\Documents and Settings\Colin\Mis documentos\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.manx.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = VÃ*nculos
O1 - Hosts: 216.127.38.100 imgserv.adbutler.com
O1 - Hosts: 193.195.96.230 www.2fort4.com
O1 - Hosts: 66.193.254.36 www.winternals.com
O1 - Hosts: 216.142.16.242 www.sysinternals.com
O1 - Hosts: 207.46.248.244 support.microsoft.com
O1 - Hosts: 208.185.101.168 a.tribalfusion.com
O1 - Hosts: 64.29.201.21 www.pcpitstop.com
O1 - Hosts: 67.15.18.52 rosecitysoftware.com
O1 - Hosts: 66.246.108.161 www.sofotex.com
O1 - Hosts: 216.239.59.104 pagead2.googlesyndication.com
O1 - Hosts: 195.10.116.20 webmail.manx.net
O1 - Hosts: 193.195.96.222 www.robbscelebs.co.uk
O1 - Hosts: 194.159.248.86 www.douglass.co.uk
O1 - Hosts: 216.27.93.20 members.fortunecity.com
O1 - Hosts: 213.137.31.58 www.manx.net
O1 - Hosts: 212.227.253.104 www.safer-networking.org
O1 - Hosts: 194.97.4.66 download.freenet.de
O1 - Hosts: 67.15.19.177 www.windowsbbs.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\ARCHIV~1\TWEAKM~1\TweakBHO.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Archivos de programa\Archivos comunes\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Archivos de programa\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Archivos de programa\Archivos comunes\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Smapp] C:\Archivos de programa\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Archivos de programa\Archivos comunes\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT "
O4 - HKLM\..\Run: [AgenteADSL_15] C:\Archivos de programa\Telefonica\KitAIM\AimExDll.exe AimGestA.dll 8
O4 - HKLM\..\Run: [Omnipage] C:\Archivos de programa\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Archivos de programa\ScanSoft\PDF Converter\RegistryController.exe "
O4 - HKLM\..\Run: [PDFConverterReminder] "C:\ARCHIV~1\ScanSoft\PDFCON~1\EReg\EReg.exe" -r "C:\ARCHIV~1\ScanSoft\PDFCON~1\EReg\ereg.ini "
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Archivos de programa\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [TweakMASTER] "C:\Archivos de programa\TweakMASTER\TwMaster.exe" /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Acrobat Assistant.lnk = C:\Archivos de programa\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: j2 Tray Menu.lnk = C:\Archivos de programa\Archivos comunes\efax\HotTray.exe
O4 - Global Startup: Live Menu.lnk = C:\Archivos de programa\Archivos comunes\efax\Dllcmd32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Perstray.lnk = ?
O8 - Extra context menu item: Open PDF in Word - res://C:\Archivos de programa\ScanSoft\PDF Converter\IEShellExt.dll /100
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downl...-a3de-373c3e5552fc/msSecAdv.cab?1081894784156
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38090.6393634259

 

Someone else will have to help.

cmagee,

You've got me here. There's too many things I can't understand in your log. Maybe goddez1 of Johanna can comment on it.

 

The Hijackthis log looks pretty clean. Couple of interesting sites (now bookmarked ) but not problem items.

There are a few entries that probably should go but they don't look like anything to freeze the PC.

Spybot looks like the latest version 1.3 - good.

You've mentioned most of the protections that a reasonable person would use but having the symptoms on all your PCs is worrysome. Also the fact that virus scans won't run to completion.

So you have all the appropriate security patches loaded? MS04-011 in particular but the other recent ones would be good.

Have you tried using an online scanning site to see about viri? That's about the only thing I can think of at this point.

RAV would be a good starting place since it will clean what it finds. Housecall would be a good follow-up even though I think it only finds but won't clean.

I know you have onboard AV but it may not be working right.

 

Hello cmagee,

A number of things I'm struck by.

Quote by you: "All PCs have probably had a worm such as Blaster at some time because it seems to get in before one can configure the firewall"
XP has a built in firewall which will stop Blaster and on the latest versions of XP will disable itself upon detecting a 3rd party firewall. So no configuration needed and the major 3rd party firewalls that I know of have default protections operating anyway.

When you add software, what is the physical source? Are some being loaded from 3.5's or CD's? And if so, are they the common to all 3 systems? Have you checked those for infection?

Have you thought about the physical environment? Too hot - too dusty - varying electical source.

Regards - Charles

 

charlesvar
XP does have a firewall but the problem is, it's not enabled by default. So you are vulnerable to the blaster worm until you enable it. The way to avoid this problem is to disconnect your modem until after you've installed windows and enabled the firewall. From what I understand, the firewall will be enabled by default with SP2. Good move on MS's part.

 

Between an OS install and going online, I always install a firewall. I NEVER install an OS with the modem connected, and do not connect it UNTIL I am done with the security installs.

The fact that 3 pcs are doing this indicates "software" to me, also, but nothing looks suspicious in your log. If only one comp were freezing, I would suggest clearing CMOS, next.

You can use msconfig or Mike Lin's StartUpCPL to reduce what is loading at boot to the bare minimum. You have a lot of programs that are coming on automatically that could be started manually, as you need them. How much memory does your new comp have?

When you say "freeze ", do you mean a totally unresponsive system, or a delay before action is taken from a command? Do you have to reboot to get past the freeze every time?

Trying to help,
Johanna

 

You might try disabling opware32.exe. I have a friend that had a similar problem and it was what was causing it. If you've used the same scanner or the same brand of scanner on each of the computers it would be one common denominator anyway. Worth a try. Have a look at this page for a little more info about it and how to disable it. Look about have way down the page.
http://www.answersthatwork.com/Tasklist_pages/tasklist_o.htm

 

Zander,

*XP does have a firewall but the problem is, it's not enabled by default.*

Mine was, and this was from 2 years ago. The DELL's that I've seen since have come that way. This is an OEM decision.

From Johanna "Between an OS install and going online, I always install a firewall. I NEVER install an OS with the modem connected, and do not connect it UNTIL I am done with the security installs* real good advice. But I'm still puzzeled by cmagee's not "configuring" the firewall before going on-line. I read it as there is one, so I'm wondering what configuring means.

Regards - Charles

 

charlevar
Now that I think about, you're right about the Dell computer. I ordered a Dell laptop for my daughter last year and when I went to enable the firewall I remember being surprised by the fact that it was already enabled. Must be something Dell does. If you install windows from a regular windows cd, it isn't enabled by default. Score 1 point for Dell.

 

I second Newt's advice on doing some online scans. Also suggest installing Process Explorer. After doing some normal activities, open and click file>save, then copy/paste the contents of the saved text file here. I would also check 'always on top' from within it's options, click the CPU header to arrange the processes by usage, minimize the window so that only the process name and CPU usage is showing (drag the window down small enough to still be able to see your desktop)and continue working till it freezes. See if something in particular has very high usage at that time.

 

Christer and I have been investigating the XP Firewall. It becomes enabled when you set up your internet connection, and IS NOT enabled by default in XP. The upcoming SP2 proposes to automatically enable it.
From MS:
Here are the various ways to install ICF:

• Welcome to Windows wizard. This is what you see if you install Windows XP Home Edition or Windows XP Professional on a stand-alone computer (not joined to a network domain). The wizard makes it easy to connect to the Internet, activate your copy of Windows, register Windows, and create user accounts. If the PC has a single network connection and it's determined that this network connection is for connecting to the Internet, the Welcome to Windows wizard will enable ICF on this connection.

• Network Setup Wizard (NSW). (For Windows XP Home Edition and Windows XP Professional on a stand-alone computer). When you run the NSW you are asked how you are connected to the Internet (there are five options). If you select an option stating that the PC is directly connected to the Internet, ICF will be enabled on the Internet connection.

• New Connection Wizard (NCW). When you run the NCW and select the "Connect to the Internet" path, ICF will be enabled on the designated Internet connection.

• Network Connections folder. You can go to the Advanced tab of the Properties page for a network connection and enable ICF via a simple checkbox. The Network Connections folder is located in the Network and Internet Connections area of the Control Panel.
**********************************************
I thought my ICF was enabled by default, because I always have to turn it off after an install, but, apparently, once my LAN is detected, that's when it enables. Of course, by the time I've gone online, my third party firewall is already installed and enabled, so I didn't notice. Next XP install, I'll verify it.

Charles

I wondered about that, too, and assumed "configure" meant "install ". It would explain a lot!

Johanna

 

XP Freezing

Many thanks for all your efforts, I’ve been away a couple of days so I now will try to respond to all your points although I am not responding separately to posts which simply relate to Firewall issue (see next para).
Firstly I would like to draw an end to the Firewall issue. I mentioned this only for completeness in case anyone knew of any particular residual effects after worms have been cleared out. Through sloppiness on a couple of occasions I let worms in but they were discovered within minutes and removed with Symantec removal tools. The rest was really just an aside that worms seem to be queuing at the door ready to get in if they have momentary opportunity. I don’t think they are an issue here.

Newt

I think the fact that virus scans wont run to completion is not in itself the problem but gives a clue to what the real problem must be. I have been able recently to run sufficient virus checks on-line and off-line to be confident that there are no viruses. (I have problems running off-line checks but even RAV would not run on-line and froze).
When I got the problem initially with the Dell a friend said that any failed read/write action would freeze the system – so I originally thought it was a faulty hard disk. But instead of checking that out, as mentioned, due to time pressures I just bought a new PC.
Now the same problem exists on all PCs it seems to indicate that what is happening is that something is causing a read/write action to fail. Things like virus checks and more recently installing new programs will always provoke a freeze due to the heavy read/write activity at these times. I use virus checking as the quick way to see if I can still provoke a freeze after I have tried some potential solution to the problem.
So I do not think it is a virus but a “bad†program.
I believe all available security patches are installed.

Charlesvar

Software is usually loaded from CDs but I have downloaded software also. The latter is stored on a couple of external hard drives which I use for storage and backups. Obviously there is a possibility of cross-infection but the drives are all clean as far as I can test with usual anti-virus etc software.
The physical environment is not extreme and whenever I use the desktops they are on UPSs.

Johanna

As mentioned above I tend to conclude it is a software issue also. If I try to use “msconfig†I can only play about with this as I have no thorough knowledge of how to use it. If I try to boot to diagnostic I cannot figure out how to re-set enough allow Norton Anti-virus to run to try to provoke a freeze (see above re provoking the problem). It is difficult to know what can be deleted from startup/services and the ini files apart from the obviously named things.
All PCs have 512 meg memory.
When I say freeze I do mean freeze, absolutely nothing works – no mouse, keyboard or task manager. I do have to re-boot to get through. Although as I mentioned before, strangely if I have on screen a web page with animated parts these continue after the freeze.

Zander

I have uninstalled all peripherals to no avail.


Thanks for now and hope you have more suggestions. At the moment I have re-formatted the “old†Dell and I am using it as a “mule†and will do a parallel re-format and re-install with my current PC.

 

So, you
A. Have an enabled, updated firewall in place?
or
B. Do not use a firewall, just delete worms and trojans if they get in?


Johanna

 

XP Freezing

Hi Johanna

Yes I always have Norton Internet Security installed and updated (I have used Zone Alarm at timeson one PC). As I said worms got in a couple of times in the past on sloppy re-installs.