Help!!!

[Ulyshia]

I have a Compaq Presario Model 5050, it has 7gb h.d., 96mb ram, Intel Celeron Processor, with a Windows ME upgrade. It freezes up too much. Whether on or off of the internet, closing a program, or trying to run one, it freezes! Please tell me what is wrong, and what to do to fix it.

[tb525]

Let's have a look, Go here and download, unzip and run StartupList. It will create a log file, copy the log and paste it in a reply.

http://www.lurkhere.com/~nicefiles/index.html

[Ulyshia]

StartupList report, 5/5/03, 3:59:01 AM
StartupList version: 1.52
Started from : C:\MY DOCUMENTS\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Unable to get Internet Explorer version!
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMMON FILES\SHUTTLE TECHNOLOGY\ICONFIG.EXE
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\CONNECTIONMANAGER.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\CYBERMEDIA FIRST AID\FAWGRD32.EXE
C:\PROGRAM FILES\CYBERMEDIA FIRST AID\FA_GD32.EXE
C:\PROGRAM FILES\CYBERMEDIA FIRST AID\RTFIXM32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\PROGRAM FILES\KENZIPPR\ZIPPR100.EXE
C:\MY DOCUMENTS\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Windows Guardian.lnk = C:\Program Files\CyberMedia First Aid\FAWGRD32.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ICONFIG.EXE = C:\PROGRA~1\COMMON~1\SHUTTL~1\ICONFIG.EXE "Software\Shuttle Technology\shtleusb\LS120"
Logitech Utility = Logi_MwX.Exe
SystemTray = SysTray.Exe
EnsoniqMixer = starter.exe
Microsoft IntelliType Pro = C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SpeedKey.exe
POINTER = point32.exe
SBC Yahoo! Connection Manager = C:\PROGRA~1\SBCYAH~1\CONNEC~1\ConnectionManager.ex e
CreateCD50 = "c:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
AdaptecDirectCD = "c:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 2/4/2003, 4:0:24)

[rename]
NUL=c:\WINDOWS\TEMP\BCREBO~1.TMP
C:\~BCWipe.stu\WINDOWS_Cookies_index.dat=C:\WINDOW S\COOKIES\INDEX.DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET PATH=C:\PROGRA~1\PANDAS~1\PANDAA~1;%PATH%;C:\LOTUS \MAIL32\VIEWERS

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - (no file) - {206E52E0-D52E-11D4-AD54-0000E86C26F6}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP4,0,2,6.DLL - {EF99BD32-C1FB-11D2-892F-0090271D4F88}
(no name) - C:\PROGRAM FILES\YAHOO!\COMMON\YCHECKH.DLL - {576EB0AD-6980-11D5-A9CD-0001032FEE17}
CSBHO - C:\PROGRAM FILES\COMET\BIN\CSBHO.DLL - {D14D6793-9B65-11D3-80B6-00500487BDBA}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Disk Defragmenter.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Java Plug-in 1.4.0_01]
InProcServer32 = C:\Program Files\Java\j2re1.4.0\bin\npjpi140_01.dll

[CWDL_DownLoadControl Class]
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[FVLiteLoad Class]
CODEBASE = http://digitalflip.biz/fvlite22/fvlite.cab

[CDToolCtrl Class]
CODEBASE = http://free.aol.com/tryaolfree/cdt175/aolcdt175.cab

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://download.yahoo.com/dl/installs/ymail/ymmapi.dll

[{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37693.6915856482

[Cult3D ActiveX Player]
InProcServer32 = C:\WINDOWS\SYSTEM\CULT3D\IECULT.DLL
CODEBASE = http://www.cult3d.com/download/cult.cab

[{15589FA1-C456-11CE-BF01-00AA0055595A}]
CODEBASE = http://www.spywarenuker.com/product/camp/SpywareNuker_com/SpywareNukerInstaller.exe

[CSBHO Class]
InProcServer32 = C:\PROGRAM FILES\COMET\BIN\CSBHO.DLL
CODEBASE = http://files.cc.cometsystems.com/cc2/release/bin/plat-4-3-333-ccct.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 5,838 bytes
Report generated in 0.683 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[tb525]

What could be causing the problem is CyberMedia First Aid. But uninstalling it may cause problems also. The choice is yours.


RTFIXM32

Part of First Aid 98. Read FA_GD32 for more details.

Recommendation :
RTFIXM32 is often the cause of shutdown problems and freezes. If after reading FA_GD32 you decide to keep First Aid 98, you should at least disable RTFIXM32 with Startup Manager.

FA_GD32

First Aid 98 Windows Guardian. Once upon a time, in the days of Windows 95/98, a number of companies thought they could write software which would prevent or warn of Windows crashes, which would fix problems in tens of thousands of programs (Gee!!) thanks to constantly updated databases, which would provide safe installation and un-installation of software, and with some of them, which would provide the "System Restore" function which is now part of Windows since Windows Millennium Edition. Would you know, the majority of these products turned out to cause crashes themselves !!! Right from day one we never believed in such programs, if only because it is an impossible feat to keep track of all the software produced around the world, of their bugs, of their newest bugs or corrections in their latest versions, etc... Like most other such programs, First Aid 98 and the company that made it, Cybermedia, eventually disappeared (bought by McAfee/Network Associates in the case of Cybermedia).

Recommendation :
Given that First Aid 98 has been a defunct product for some time, running it in 2002 and beyond without the benefit of program updates that take into account nowadays software, is courting trouble. You certainly should not run it on anything other than Windows 95/98. Our view is that if you are still running First Aid you should de-install it. Note, however, that because of the way in which First Aid interacts with Windows, the de-installation of First Aid may actually cause you instability problems later (catch 22!!). So, if your PC is currently relatively stable, do not try to fix what doesn’t need fixing, keep First Aid.

[Ulyshia]

My mistake! You see, I have two computers, and when you asked me for the sdtats on the ME computer, I am working on the Win 98 Computer, so I sent you the wrong stats on the right computer! I will have to resend on the ME.
Sorry!

[tb525]

No problem! :D StartupList is small enough to put on a floppy and run on the ME machine. Then copy the log file to the floppy and copy and paste it here from the 98 machine.

[Ulyshia]

StartupList report, 5/11/2003, 11:14:32 AM
StartupList version: 1.52
Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SA3DSRV.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\COMPAQ\INTERNET\WATCHDOG.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEAUI.EXE
C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\CONNECTIONMANAGER.EXE
C:\WINDOWS\SYSTEM\IJ75P2PS.EXE
C:\PROGRAM FILES\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\APVXDWIN.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\ON-SCREEN DISPLAY\OSD.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\PAVPROXY.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\ZIPPR\ZIPPR100.EXE
C:\WINDOWS\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
TaskMonitor = c:\windows\taskmon.exe
SystemTray = SysTray.Exe
Essdc = essdc.exe
AtiCwd32 = Aticwd32.exe
AtiKey = Atitask.exe
Aureal A3D Interactive Audio Init = A3dInit.exe
Compaq Internet Setup = C:\Compaq\Internet\InetWizard.exe /RUN
Watch Dog Program = C:\COMPAQ\INTERNET\WATCHDOG.EXE
EACLEAN = C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe /NORESTART
CPQEASYACC = C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\Cpqeaui.exe
PCHealth = c:\windows\PCHealth\Support\PCHSchd.exe -s
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SBC Yahoo! Connection Manager = C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe -Show
Hidserv = Hidserv.exe run
CompaqPrinTray = PrinTray.exe
IJ75P2PSERVER = IJ75P2PS.EXE
APVXDWIN = "C:\Program Files\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
POINTER = point32.exe
BCWipeTM Startup = "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe = SBC Yahoo! Connection Manager

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services

Aureal A3D Interactive Audio = sa3dsrv.exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Reminder = C:\Program Files\Microsoft Money\System\reminder.exe
Mozilla Quick Launch = "C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE" -turbo

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 11/5/2003, 10:30:24)

[Rename]
NUL=C:\PROGRA~1\PCBOOST\PCBOOST.EXE
C:\WINDOWS\powerpnt.ini=C:\_RESTORE\EXTRACT\powerp nt.ini
C:\WINDOWS\wavemix.ini=C:\_RESTORE\EXTRACT\wavemix .ini
C:\WINDOWS\tasks\desktop.ini=C:\_RESTORE\EXTRACT\d esktop.ini
C:\WINDOWS\win.ini=C:\_RESTORE\EXTRACT\win.ini
C:\WINDOWS\system.ini=C:\_RESTORE\EXTRACT\system.i ni
C:\WINDOWS\USER.DAT=C:\_RESTORE\EXTRACT\USER.DAT
C:\WINDOWS\SYSTEM.DAT=C:\_RESTORE\EXTRACT\SYSTEM.D AT
C:\WINDOWS\CLASSES.DAT=C:\_RESTORE\EXTRACT\CLASSES .DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\PROGRA~1\PANDAS~1\PANDAA~1;C:\WINDOWS;c:\w indows;c:\windows\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\windows\TEMP
SET TMP=c:\windows\TEMP
SET BLASTER=A220 I5 D1

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_0_8_6.DLL - {02478D28-C3F9-4efb-9B51-7695ECA05670}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job

--------------------------------------------------

Enumerating Download Program Files:

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://download.yahoo.com/dl/installs/ymail/ymmapi.dll

[YInstStarter Class]
InProcServer32 = C:\PROGRAM FILES\YAHOO!\COMMON\YINSTHELPER.DLL
CODEBASE = C:\Program Files\Yahoo!\Common\yinsthelper.dll

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37748.7561226852

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 6,650 bytes
Report generated in 1.011 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[Ulyshia]

I uninstalled Windows Guardian, and did a system restore, and now it seems to be working great! I guess that was the problem. Thanks!

[tb525]

It appears that you have a trojan:

IJ75P2PSERVER = IJ75P2PS.EXE

Click Start > Run > type msconfig and click OK.
Click the startup tab and uncheck this entry:
IJ75P2PSERVER = IJ75P2PS.EXE
Click apply/ok and reboot. Do a find files for IJ75P2PS.EXE and delete it.

Then go here and run an online virus scan:

http://www.ravantivirus.com/scan/

[Ulyshia]

Statistics

Scanned files: 15581
Scanned directories: 1134
Scanned archives: 1049
Size of the scanned files: 1920260292
Packed files: 516
Known viruses found: 1
Virus bodies: 1
Suspicious files: 0

Disinfected files: 0
Deleted files: 0
Renamed files: 0
Copied files: 0
I/O errors: 0
Warnings: 0
Corrupted files: 0
New files: 114912
Mail files: 97




Found viruses
File: c:\_RESTORE\ARCHIVE\FS14.CAB->A0003189.CPY
Virus: BAT/DeltreeY.A* Status: Infected


This seems like a new one! (virus). What now?

[tb525]

That file is in the restore archive. You will need to disable system restore, reboot, enable system restore and reboot to purge it from the system.

Click Start > Settings > Control Panel > System > Performance tab.
Click File System > Troubleshooting tab.
Place a check in 'Disable System Restore' and click OK. Reboot.

To re-enable it, follow the above and uncheck 'Disable System Restore' and click OK. Reboot.

[Ulyshia]

Okay, we've gotten rid of thr viruses, but it is still freezing when I turn it on. What can I do to speed things up? More ram?
It has 96mb.

[30111987]

you shouldn't need more ram, my compaq came with 'me' and it had 64mb ram originally. More ram will improve thing but it shouldn't crash often with you memory.





*Signature edited by AnnMarie*

[tb525]

Hi Ulyshia, When exactly is it freezing? As it is booting?

[Ulyshia]

Yes. When it boots up mostly, and sometimes when I am just working on it.

[tb525]

I noticed from your startuplist that you have apps from two different sound cards running.

Open the device manager and click the + next to Sound, Video and Game Controllers. What is listed?

[Ulyshia]

There are as follows...

Creative Gameport Joystick.
Creative Sound Blaster PCI 128.
Creative Sound Blaster PCI 128 Legacy Device.
HID compliant game controller.
Wave Device for Voice Modem.

[tb525]

Are you positive you checked the ME machine and not the 98 one?

This is rather odd, Your device manager shows a Creative card:

Creative Sound Blaster PCI 128

StartupList shows:

Aureal A3D sound card

Aureal A3D Interactive Audio = sa3dsrv.exe
Aureal A3D Interactive Audio Init = A3dInit.exe

ESS Solo sound card

Essdc = essdc.exe

Have you ever changed sound cards on this machine? Open the device manager again and double click on :
Creative Sound Blaster PCI 128
What is listed for device status? Then click the Driver tab. What is listed?
Is there anything listed under Multi-function adapters?

[Ulyshia]

yes I did tell you about the win 98 puter. I get so confused. Let me check the Me puter... the Me puter has under sound...
ES1869 Control Interface
ES1869 Plug N Play AudioDrive
Joystick.

[tb525]

Ok, Let's try this,

Click Start > Run > type regedit and click OK.
Click the + next to the following keys:

HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
Current Version

Scroll down and click on the RunServices folder.
Back this key up by clicking 'Registry' and 'Export Registry File'.
Give it a name and make sure 'Selected branch' is ticked and save as a .reg file.
Then in the right hand window right click on:
Aureal A3D Interactive Audio = sa3dsrv.exe and click delete.
Close regedit.

Click Start > Run > type msconfig and click OK.
Click the startup tab and uncheck:
Aureal A3D Interactive Audio Init = A3dInit.exe
Click apply/ok and reboot.

Do you have sound?? Does it still freeze??

[Ulyshia]

Still have sound, and so far not freezing! Thanks so much! Please refer to my new thread under Win 98. Thanks!