[Jolie30]

My problems began after one of my kids accepted a download of Windows Defender. After the download, certain functions were not available in IE (at the time I was running v7). It appeared to have anything to do with Java. But my system restore also would not open. Only a blank page would appear. After reviewing the site here, I decided to attempt to repair Windows XP and followed all the steps and everything was good, until the automatic updates started trying to update. Every critical update it has attempted to load (including the new updater) keeps failing. At this point my system is running Windows XP Pro, Version 2002, Service Pack 2. I can no longer access IE at all (when I open it, it just keeps trying to open, but nothing ever comes up and it slows everything else down.) If you click on an icon on the desktop, instead of going to the program, it creates a desktop shortcut. I can run FF, but everything is extremely slow. My systray update yellow shield constantly says there are updates to run, but everything fails. I'm in the process of running Malwarebytes Anti-Malware to see if there is anything there, but wanted to get this post up in case it was something else. Any assistance would be appreciated. Thanks.

[Advertisements]

Go here and download Dial-A-Fix. After, I want you to run it and then click on the Flush Software Distribution. When a Windows pops up, click no. This will erase all Update History but it will also erase the old updates that were waiting to be to be installed. Next, go to C:\Windows\ and find a folder called Software Distribution.old. If you find one, delete it. If you dont, then just exit that out. Next, please open up Dial-A-Fix and click on the little hammer on the bottom of the window and then click on Reinstall Automatic Updates, or something like that. Finally, click OK. Reboot and then try Microsoft Update and tell me what updates you see.

[PILL5B3RRY]

Go here and download Dial-A-Fix. After, I want you to run it and then click on the Flush Software Distribution. When a Windows pops up, click no. This will erase all Update History but it will also erase the old updates that were waiting to be to be installed. Next, go to C:\Windows\ and find a folder called Software Distribution.old. If you find one, delete it. If you dont, then just exit that out. Next, please open up Dial-A-Fix and click on the little hammer on the bottom of the window and then click on Reinstall Automatic Updates, or something like that. Finally, click OK. Reboot and then try Microsoft Update and tell me what updates you see.

[Jolie30]

Ok, ran everything. Rebooting now and will advise shortly. Thanks.

[Jolie30]

Ok, rebooted and automatic updates no longer in systray. Tried to open IE to get to Windows Update. Can not open IE. It appears that it will open then it keeps trying to open additional IE windows. Then get not responding and have to close everything through task manager.

[Jolie30]

Should I move this to the IE threads?

[The Skeptic]

I understand that at the present IE 6.0 is the one that is installed. Try to repair it by doing this: Click Start > Search > All file and folders. Click More Advanced Options and check all the boxes. Now run a search for ie.inf. You should find one in c:\windows\ie.inf. Insert your XP CD to the drive and right click ie.inf in Search. Choose the Install option and let the process run. This should repair IE 6.0.

[Jolie30]

Ok, I did as you suggested. Let me see what happens now...

Same thing is happening. Obviously my copy is corrupted...is there a way to download a clean copy? And I just noticed that no matter what program I am working in, my cursor is flashing the hour glass like something is running in the background.

Any ideas?

[The Skeptic]

I don't think your copy of XP is corrupted. It's just that one procedure we tried didn't succeed because the problem is somewhere else.

Open Task Manager > Processes. Look at the table for a minute or so and write down the process(s) that take a lot of CPU power (say, over 10%). Please note that we are interested in CPU and not memory usage. Also, ignore Idle Processes. We are not interested in this one.

[Jolie30]

Ok, checked the task manager. There were several files - all show 0% but if you hold on them for a while then they change at the bottom to varying percentages. Is this normal?

So there was a file, skmgr.exe that was showing 24% but it disappeared shortly after I started looking at task manager. There is crss.exe at 15% that shows then disappears and comes back. Then there is alg.exe showing a range of 16% to 24%. Another file is jusched.exe which is showing at 11% and SMax4PNP.exe which is showing at 15%. Incidentally, I am not running explorer and explorer.exe is an active in the task manager. Also, is it normal for svchost.exe SYSTEM to show up 4 times, as well as svchost.exe NETWORK SERVICE two times and then svchost.exe LOCAL SERVICE also to show up?

Thanks for your help!

Edited by Jolie30, 01 June 2008 - 04:21 PM.

[Jolie30]

Ok, my problems may be a lot worse than I thought. I finally got my virus scan to run and it is telling me it could not read the following files:

warning: Could not read from file: c:\documents and settings\jodi\ntuser.dat
-- File was not scanned
warning: Could not read from file: c:\documents and settings\jodi\ntuser.dat.log
-- File was not scanned
warning: Could not read from file: c:\documents and settings\localservice\ntuser.dat
-- File was not scanned
warning: Could not read from file: c:\documents and settings\localservice\ntuser.dat.log
-- File was not scanned
warning: Could not read from file: c:\documents and settings\networkservice\ntuser.dat
-- File was not scanned
warning: Could not read from file: c:\documents and settings\networkservice\ntuser.dat.log
-- File was not scanned
warning: Could not read from file: c:\system volume information\_restore{46de8921-1d39-44d2-a9e9-64119261f211}\rp11\a0005819.exe
-- File was not scanned
warning: Could not read from file: c:\windows\softwaredistribution\eventcache\{a7599a4d-cccd-4434-a9b5-99f36493c0bb}.bin
-- File was not scanned
warning: Could not read from file: c:\windows\system32\catroot2\edb.log
-- File was not scanned
warning: Could not read from file: c:\windows\system32\catroot2\edbtmp.log
-- File was not scanned
warning: Could not read from file: c:\windows\system32\catroot2\tmp.edb
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\default
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\default.log
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\sam
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\sam.log
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\security
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\security.log
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\software
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\software.log
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\system
-- File was not scanned
warning: Could not read from file: c:\windows\system32\config\system.log
-- File was not scanned
warning: Could not read from file: c:\documents and settings\jodi\local settings\temp\perflib_perfdata_820.dat
-- File was not scanned
warning: Could not read archive: c:\documents and settings\jodi\application data\superantispyware.com\superantispyware\quarantine\quarantine - 05-18-2008 - 13-10-52.sbu
-- Reason: Password protected
warning: Could not read archive: c:\documents and settings\jodi\application data\superantispyware.com\superantispyware\quarantine\quarantine - 05-30-2008 - 15-30-50.sbu
-- Reason: Password protected
warning: Could not read from file: c:\documents and settings\jodi\local settings\application data\microsoft\windows\usrclass.dat
-- File was not scanned
warning: Could not read from file: c:\documents and settings\jodi\local settings\application data\microsoft\windows\usrclass.dat.log
-- File was not scanned
warning: Could not read from file: c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log
-- File was not scanned
warning: Could not read from file: c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log
-- File was not scanned
warning: Could not read from file: c:\documents and settings\jodi\application data\mozilla\firefox\profiles\ku1z0dg1.default\parent.lock
-- File was not scanned

Maybe that is because I have stuff open, I don't know. My knowledge is limited so I may be looking for trouble, but I did a search for that perflib_perfdata_820.dat file and what I found doesn't sound good. And the last entry...that profile is unfamiliar. Let me know if I need to move this to the malware thread. Thanks.

Edited by Jolie30, 01 June 2008 - 06:04 PM.

[The Skeptic]

Please post your topic in the malware forum (a link in my list of links below). Take all the preliminary steps. After the helpers from the malware forum confirm that the computer is clean, and if the problem persists, post back in this forum. It may take some time because they are quite busy there.