non-torrent related computer help

[Five]

I asked grace to look at this, she is thinking about it and will post here (or tell me what to post).

the svchost seems normal to me, here is a screencap on my comp from a minute ago...

[netyuppie]

puts my mind to rest about the svchost at least. thanks five - look forward to whatever grace comes up with.

[grace]

Hi,

Process Explorer will give you a better idea of what your processes are than the taskmanager (i.e. it will tell you which services each instance of svchost is running.) You are most likely running some unneccesary windows services, windows does this by default. Disabling some of them (using the tweak Guide TheMamba posted) will make your computer run faster; but this doesn't seem to be the source of your problem -- these services would have already been running when your compter was acting normally.

I do have a suspicion that your problem is hardware related, in which case i won't be of much help. But just to make sure on the software end maybey you could post a Hijack This log and a start up list. Thes sometimes show things that are hiding from windows. Here is a link with the programs and an explanation of how to use them.

[netyuppie]

somehow i completely missed this post mamba. sorry.

Originally Posted by TheMamba

Have you changed anything in the last couple of days? Any new hardware, software, etc?

Paging file = swap file. Looks like your size is OK.

If you've got a spare hard drive and some spare time I'd try a fresh install on one of those and see what that gets you.

There's a Windows XP Tweak Guide that I've always tried to use when I reinstall XP: http://www.tweakguides.com/TGTC.html Some of the tweaks in it are not really tweaks but it's a good read none the less. Lotta good information in there to implement...once we get your problem solved.

Another thing that occurred to me is that you could have a failing power supply. Had that happen to me once. Was getting all sorts of weird behavior like you're getting so I ordered a new one and replaced it. That was purely a shot in the dark...

"large memory sizes should be made of registered/buffered memory)". I did a quick search on google and it looks like this is no big deal.
http://www.computing.net/gaming/wwwb...orum/4136.html

Unfortunately, you're probably on a witch hunt. Since we've ruled out heat and probably RAM, try the hard drive swap and see what that gets you. When you're on the witch hunt, always do the cheapest/easiest fixes first so you don't waste money...too bad you're in Chicago because I have a ton of spare parts in my office that we could swap in and out of your machine to help narrow it down.

no new hardware, no new software. tried a restore point over a week before problems started and no luck too. guessing its hardware.
i will try a fresh XP install on a spare drive later tonight or tommorow.
i've always had bad luck with power supplys, have had at least 2 go bad within the last year or so. and they were antec too, no cheapy brand. i suppose after the hard drive swap i could try that. i dont have another working one laying around but they arent too expensive.
haha, let me overnight my machine to you and you can go at it i've got spare hard drives but thats about it.

grace-
thanks. i was using something similar to process explorer but this is much more informative. i'll take a look at that tweak guide and see what i can cancel. working on the HJT log now.

[netyuppie]

Logfile of HijackThis v1.99.1
Scan saved at 4:43:03 PM, on 6/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\WinTools\RAM Saver Pro\ramsaverpro.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopMail.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\me\Desktop\New Folder (4)\procexp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\me\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gmail.com/
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [RAMSaverPro] C:\Program Files\WinTools\RAM Saver Pro\ramsaverpro.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A4739AE-7A41-4529-A6A5-C3F4156803ED}: NameServer = 192.168.0.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: HDD Information Service (HDDSvc) - AltrixSoft (http://www.altrixsoft.com/) - C:\WINDOWS\system32\HDDSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[netyuppie]

first time using startuplist. no idea what is the important data or if it all is. cant attach the text file cause its too big and cant copy it cause its too damn long.
email perhaps?

[grace]

netyuppie, as far as i can tell the hijackThis log is ok.

I don't think think that the startup list is going to show anything either. My bet is on a hardware problem. I'd try the fresh install on your spare drive.

[netyuppie]

thanks grace. heading out to dinner now - will try a fresh install once i get back in. fingers crossed.

[netyuppie]

well, installed XP on a new hard drive. machine ran normal. whatever it is, failing drive or unkown virus or something. just gonna reformat the drive and start over i guess. kinda worst care scenario but whatcha gonna do.
accidentally deleted a partition on my external while testing - lost 250gb of music. ohh well.
thanks for the help folks.

I would recommend against running two antivirus apps at the same time after you finish your reinstall.

[netyuppie]

i didnt run both real time before this started. i used NOD32 real time and ran AVG weekly.
quick question - looking at replacing the drive. 8MB vs 16MB cache - how much will i miss the extra 8MB? bestbuy has 8MB 250 WD Caviers on sale for 90 bucks. newegg has the same with 16MB cache for the same price. its been over a week and i'm anxious to get my machine up and running again, and it would be so much easier to just run to bestbuy and get the 8MB cache, as fast as newegg is. my current drive is 8MB so i wouldnt be missing anything, but in the long run how much of an advantage will the 16MB cache offer?

[netyuppie]

nevermind. just gonna wait a few more days and go with the 16MB cache.

[netyuppie]

interesting. this poped up today while i wasnt even using the computer.

2 points of interest here. first time i've seen this warning. take a look at the address of the file. this is the general area (system volume information/_restore) that was shown as bad sectors fixed in chkdsk a few days ago. also, comment shows it is taking place in svchost. this is of particular interest as that file is always showing so much memory usage. was around 22,000K before, and i just checked it after NOD32 alert, its now showing about 10,000K at most.
good news or bad news?

[starman714]

I'm no wiz but I think it's good news...it looks like it means you didn't turn "system restore" off on all drives when you ran a scan and so a virus lived on in system restore because ant-virus progs cannot access that, Windows doesn't let them....
That might be it, anyway....right click on "My Computer" icon open "properties" > system restore tab and uncheck system restore on all drives > apply, then run a scan again...

[netyuppie]

Originally Posted by starman714

I'm no wiz but I think it's good news...it looks like it means you didn't turn "system restore" off on all drives when you ran a scan and so a virus lived on in system restore because ant-virus progs cannot access that, Windows doesn't let them....
That might be it, anyway....right click on "My Computer" icon open "properties" > system restore tab and uncheck system restore on all drives > apply, then run a scan again...

sounds like a plan, will reply once its complete. thanks sm