Computer Freezing-up

[Len]

My HP PIII 128mg ram freezes up, usually online....need to hard boot to recover. PC repair shop told me it was a software problem, so they loaded new internet explorer. After $120....it is still freezing up. Any comments are appreciated. Thanks! Len

[AnnMarie]

Hi Len - welcome to CTH. Are you getting an error message? This problem is not always easy to diagnose however we can look at your Startups and see if there is anything there that might be causing the problem. Go here and download and run Startup List. It will generate a log file. Please copy and paste the log back in this thread.

[Len]

Thanks for the tip! I downloaded the file and got "Error starting Program" when I tried to execute it with message : Required .DLL file, MSVBVM60.DLL, not found

No, I never receive an error message before it freezes up.

Thanks again!
Len

[AnnMarie]

Hi again Len - what OS do you have and what browser (and version) are you using?

[Len]

Thanks Anne Marie! I am using MS98 2nd Ed 4.10.2222A and MS Internet Explorer 6.00.2800.1106. Thanks for your help! Len

[AnnMarie]

Len, it is my pleasure to try and help. Lets try this one, go here scroll down a bit and download and run Startup Log. It will also generate a text file but you will have to halve it and paste it back in two posts.

[Len]

---------- C:\WINDOWS\desktop\StartUp.Log

Start-Ups checked at 11-24-2002 8:20:18.97p
__________________________________________________ ________________________
__________________________________________________ ________________________

StartUp Log for Windows 95/98 - Freeware by rmbox
__________________________________________________ ________________________
__________________________________________________ ________________________

Comments:

This is a log of all the programs on your computer that
are starting automatically every time you start Windows.
Using this log can be a quick way to spot trojans.

StartUp Log (version 1.58) - Release Date 11/9/2002

__________________________________________________ ________________________
__________________________________________________ ________________________

StartUp Log Index

1. HKLM Run
2. HKCU Run
3. HKLM RunOnce
4. HKCU RunOnce
5. HKLM RunServices
6. HKLM RunServicesOnce
7. WIN.INI file
8. SYSTEM.INI file
9. AUTOEXEC.BAT file
10. StartUp folder
11. All Users StartUp
12. Misc. StartUp Configurations

__________________________________________________ ________________________
__________________________________________________ ________________________

The following is a list of your current Start-Ups
__________________________________________________ ________________________
__________________________________________________ ________________________

1. HKLM Run - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"TaskMonitor"="c:\\windows\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"HPScanPatch"="C:\\WINDOWS\\SYSTEM\\HPScanFix. exe"
"hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
"Adaptec DirectCD"="C:\\Program Files\\DirectCD\\DIRECTCD.EXE"
"USBMMKBD"="usbmmkbd.exe"
"Keyboard Manager"="C:\\Program Files\\Netropa\\One-touch Multimedia Keyboard\\MMKeybd.exe"
"SBPCISetup"="C:\\SBPCI\\sbsetup.exe"
"VsecomrEXE"="C:\\Program Files\\Network Associates\\McAfee VirusScan\\VSEcomR.EXE"
"VsStatEXE"="C:\\Program Files\\Network Associates\\McAfee VirusScan\\VSSTAT.EXE /SHOWWARNING"
"McAfee Guardian"="\"c:\\Program Files\\McAfee\\McAfee Shared Components\\Guardian\\CMGrdian.exe\" /SU"
"TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe -osboot"


================================================== ========================
__________________________________________________ ________________________

2. HKCU Run - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run]
"MoneyAgent"="\"C:\\Program Files\\Microsoft Money\\System\\Money Express.exe\""
"Taskbar Display Controls"="RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY"
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"McAfee.InstantUpdate.Monitor"="\"c:\\Program Files\\McAfee\\McAfee Shared Components\\Instant Updater\\RuLaunch.exe\" /STARTMONITOR"


================================================== ========================
__________________________________________________ ________________________

3. HKLM RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce]


================================================== ========================
__________________________________________________ ________________________

4. HKCU RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce]


================================================== ========================
__________________________________________________ ________________________

5. HKLM RunServices - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"Encompass_ENCMONTR"="C:\\Program Files\\Easy Internet\\ENCMONTR.EXE"
"Hidserv"="Hidserv.exe run"
"AolFix"="C:\\windows\\system\\AolFix.exe"
"SchedulingAgent"="mstask.exe"
"McAfeeVirusScanService"="c:\\Program Files\\McAfee\\McAfee VirusScan\\AVSYNMGR.EXE"


================================================== ========================
__________________________________________________ ________________________

6. HKLM RunServicesOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServicesOnce]


================================================== ========================
__________________________________________________ ________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.


These are the run and load lines in your WIN.INI file

run=

load=

================================================== ========================
__________________________________________________ ________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.

[Len]

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.


This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

================================================== ========================
__________________________________________________ ________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)


These are your program startups and set paths in your autoexec.bat file

rem - By Windows 98 Network - c:\windows\net start
@echo off

REM To make a DOS Boot Diskette, see the file C:\DosBoot\DosBoot.txt.
c:\windows\system\setpower.exe

call c:\dosboot\drivers.bat


================================================== ========================
__________________________________________________ ________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Works Calendar Reminders.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Updates from HP.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Photo Loader supervisory.lnk

================================================== ========================
__________________________________________________ ________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your All Users StartUp folder


*(No start-ups found)*

================================================== ========================
__________________________________________________ ________________________

12. Miscellaneous StartUp Configurations

-============================-
Registry StartUp Directories
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.................................................. ...................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.................................................. ...................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\User Shell Folders


.................................................. ...................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\exp lorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.................................................. ...................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\exp lorer\User Shell Folders


.................................................. ...................

-=======================-
Registry Shell Spawning
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================-
HKLM RunOnceEx - Registry
-=========================-


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnceEx]


-=========================-
HKU (.Default) Run - Registry
-=========================-


[HKEY_USERS\.Default\Software\Microsoft\Windows\Cur rentVersion\Run]
"MoneyAgent"="\"C:\\Program Files\\Microsoft Money\\System\\Money Express.exe\""
"Taskbar Display Controls"="RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY"
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"McAfee.InstantUpdate.Monitor"="\"c:\\Program Files\\McAfee\\McAfee Shared Components\\Instant Updater\\RuLaunch.exe\" /STARTMONITOR"


-==============================-
HKU (.Default) RunOnce - Registry
-==============================-


[HKEY_USERS\.Default\Software\Microsoft\Windows\Cur rentVersion\RunOnce]


-================================-
StubPaths - Registry (Partial Listing)
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components


"OldStubPath"="c:\\windows\\SYSTEM\\ie4uinit.e xe"
"RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT. EXE"
"StubPath"="c:\\windows\\msnmgsr1.exe"
"StubPath"=""
"StubPath"="c:\\windows\\COMMAND\\sulfnbk.exe /L"
"OldStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.e xe\" /APP:OE /CALLER:WIN9X /user /install"
"RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50. exe\" /APP:OE /CALLER:IE50 /user /install"
"OldStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.e xe\" /APP:WAB /CALLER:WIN9X /user /install"
"RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50. exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

-=================-
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-=================-

@echo off
REM To make a DOS Boot Diskette, see the file C:\DosBoot\DosBoot.txt.

set path=c:\windows\command

mscdex.exe /d:IDECD000 /L:M

SET PROMPT=$p$g
SET TEMP=C:\windows\TEMP
SET TMP=C:\windows\TEMP

set DosOnly=1
call c:\dosboot\mousie.bat

c:\windows\smartdrv /q
c:
cd \windows

REM to enable ZIP support in DOS:
REM 1) cd C:\IOMEGA
REM 2) run IOMEGA.EXE
REM 3) then uncomment the following line
REM C:\IOMEGA\GUEST.EXE

REM for DOS Networking including most networked games,
REM read the file IPX.BAT and then uncomment the following
REM CALL C:\DOSBOOT\IPX.BAT



-=================-
WININIT.BAK File - (c:\windows\wininit.bak)
(name) (type) (size)(modified)(time)
wininit bak 43 11-12-02 2:21p
-=================-

[rename]
NUL=c:\windows\TEMP\GLB1A2B.EXE
-=====================-
Screen Saver Settings (Possible system.ini start-up)
-=====================-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\UNDERW~1.SCR

================================================== ========================
__________________________________________________ ________________________

- Supplemental Environment Information -

TMP=c:\windows\TEMP
TEMP=C:\windows\TEMP
winbootdir=C:\WINDOWS
PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND
COMSPEC=C:\WINDOWS\COMMAND.COM
windir=C:\WINDOWS

File - c:\windows\Wininit.bak
File - c:\windows\deletefi.ini

================================================== ========================
__________________________________________________ ________________________

- End -

[AnnMarie]

Hi Len - thanks for posting your log. I can see a few unneccesary items in your Startups which could potentially cause a problem but I havent got time just at the moment to have a good look.

I'll post back in a few hours. In the meantime, if anyone else has some comments to add, please do.

[AnnMarie]

Hi again Len - the following entries are surplus to your needs.

TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe -osboot"

This is an Application Scheduler installed along with RealOne Player and you are better off without it.

Go to Start > Run and type msconfig. Click on the Startup tab and uncheck the entry (if there) and then run a search for realsched.exe and rename it to realsched.old.

Now go to Start > Run and type:

regedit

then OK. Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

and look for the above entry in the right hand pane and when you find it delete it.




AolFix"="C:\\windows\\system\\AolFix.exe"

(From Pacmans list) Run on Gateway Astra computers, and maybe a few others. Designed to repair a bad registry key in Gateway computers that would not allow AOL to run correctly. Not seen much any more and should only run once.

Run msconfig and uncheck.




"Encompass_ENCMONTR"="C:\\Program Files\\Easy Internet\\ENCMONTR.EXE"

Do you use this browser? If not, run msconfig and uncheck it.




C:\WINDOWS\Start Menu\Programs\StartUp\Updates from HP.lnk

This allows HP computers to automatically receive notifications from HP over the Internet. This program is associated with BackWeb (which is known to cause problems such as you have been experiencing).

Right click on your taskbar and click on Properties. Click on the Start Menu programs tab and click on Advanced. Click on Programs and scroll down to StartUp and doubleclick to open. Rightclick on the shortcut and delete it. (this only stops the program running at startup, it doesnt remove the program).


Now open IE6 and click on Tools > Internet Options. Click on the General Tab, delete all your Temporary Internet Files and then click on Settings. Click on View Objects. This is going to be a bit time consuming but I would like you to right click on each ActiveX Control and view the Properties. Could you please post back each one here and also the status (damaged or installed).

Lastly, could you please go here and download and install BHO Demon. Run it and disable what it finds.

Now, has this helped at all? Are you still freezing online?

[Len]

Thank you AnnMarie for the posts. I will follow your recommendations and post back in a few days. This is exactly the help that I need to correct this problem. Thanks again! Len

[AnnMarie]

You are very welcome Len. Let us know how you get on

[Len]

Update:
Error message......Cannot rename realsched:Access is denied.

ActiveX Control:
{00000161....status-unknown
{32564D57....status-unknown
{3334504D....status-unknown
Shock Flash Object.....status-installed
Update Class.....status-installed
YlnstStarter Class.....status installed

Otherwise, I completed all the tasks OK.

Thanks again!
Len

[GretaP]

Hi Len,
You could try renaming the file from within DOS. Go to Start>Shutdown>Restart in MS-DOS mode. At the C:\Windows prompt, key in:
cd c:\PROGRA~1\COMMON~1\REAL\UPDATE~1
I am making a guess here that UPDATE~1 will take you to the subdirectory which is called Update_OB
DOS doesn't handle long filenames (names longer than 8 characters) like Windows does, so after 6 characters of the filename, there's usually a ~1 to replace the rest of the name prior to the file extension.
When you're at a prompt that looks like this:
C:\PROGRA~1\COMMON~1\REAL\UPDATE~1>
key in:
ren realsc~1.exe realsc~1.old
Once again, I am assuming that this is how it will appear in DOS.

Let us know whether this works for you or not, and if the filenames I guessed at worked or not (if the filenames are incorrect, you'll receive an error message stating "Bad command or file name").
When you're done with DOS, key in Exit at the prompt and Windows will then restart.

[Len]

Hello GretaP,
Yes, I got the "Bad command or file name" error message.

Thanks for the help!
Len