[black_hull_coastie]

Scandisk tells me something is writing to the disk so it stops after 10 tries. I tried stopping everything except explorer and systray. did the same again in safe mode and It wont work. My computer will periodically freeze for sometimes 2 seconds or maybe 30 and everything will be normal. after doing this a few times it will eventually freeze and become completely unresponsive. any ideas? defraged just a few days ago and mcaffe looks like im clean.

mark

[Advertisements]

Does scan disk work in dos? Sounds like ya may have a spyware infection so ya should follow the advice Hereand see if that clears it up.

[StarHawk]

Does scan disk work in dos? Sounds like ya may have a spyware infection so ya should follow the advice Hereand see if that clears it up.

[Samm]

Definately worth checking for spyware & viruses. In the meantime, if you need to run scandisk, try running it in safe mode instead. After the system completes the post test on boot up, press F8 key several times. This should bring up the boot menu. From there select Safe mode. This will load windows without the drivers or startup programs (or malware hopefully) loading, so there should be nothing in thebackground accessing the drive.

[black_hull_coastie]

Ran a slew of adware/spyware removers from the link specified. Still no luck. I have already tried running scan disk in safemode with nothing but explorer open and it is still being interrupted. How do i boot the computer in just dos, without windows so I can try running the scandisk command from there. oooo, also the computer occasionally hangs on shutdown so i still have to powerdown manually.

mark

[Samm]

Select command prompt from the boot menu, it that option is in there. I can't remember if ME has that option or not.
If it doesn't, just boot from a win98 boot disk & run it from there.

[black_hull_coastie]

I dont have a boot disk. If i do, i dont know about it. theres no way to use the dos prompt accessable from the start menu to exit windows and stay in dos?

mark

[Samm]

If I remember correctly, winME doesn't give you the option of shuting down & rebooting to dos does it?
I was originally suggesting that you boot the system & press F8 after the post test & before windows starts to load, to bring up the boot menu. See if command prompt is an option from there.

If not, you should be able to go to control panel->add/remove programs->create emergency boot disk. But again its been a long time since I used ME (It fell out of favour with me very quickly!) so I could be wrong about that.
If I am wrong then you can download a win98 bootdisk from
http://www.bootdisk.com/bootdisk.htm

[black_hull_coastie]

Ok. Ran all the adware/ spyware stuff and did a scandisk from my boot disk. scandisk didnt find any problems but i still occassionally have 2-15 second long lockups. every now and again it locks up for good and i have to kill power to the computer. Sometimes when it freezes like this and i move the mouse i'll hear a "rapid clicking" coming from the tower that i pretty much isolated to the hard drive. the clicking stops when i stop moving the mouse. Is my HD on its way out? Ive had the computer for just under 5 years and it runs most of the day/night. Hopefully replacing it fixes the problem. Id like to get rid of this 4600 rpm dinosaur anyway. Any input or ideas about what i need to do/lookout for? whos got the best hard drives?

mark

Edited by black_hull_coastie, 28 May 2005 - 03:07 PM.

[Samm]

OK, this could be caused by any number of things, so bear with me.

Can you tell me :
have you changed your mouse at all at any time? Sometimes a previous installation of a mouse can interfere with the current one.

Are you using a particular programs etc when this happens?

[black_hull_coastie]

Same old mouse ive had that came with the computer. also, no this doesnt happen at any particular time.

mark

[Samm]

To be honest, you may wan to try a fresh install on the old drive before rushing out & buying a new one.

Out of interest, can you do a CTRL-ALT-DEL for me & tell me what is listed in task manager?

Also, can you do a hijack this scan & post the log on here?
http://www.majorgeek...wnload3155.html

Edited by Samm, 28 May 2005 - 05:44 PM.

[black_hull_coastie]

only things listed in the task monitor my systray, explorer, programs in use that i actually know about and my virusscan nonsense....
heres the hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 7:04:04 PM, on 5/28/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\SYSTEM\USBMMKBD.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFTRAY.EXE
C:\WINDOWS\DRWATSON.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFAGENT.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\WINAMP\WINAMP.EXE
C:\PROGRAM FILES\AIM95\AIM.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSFTSN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-ex
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-ex
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://hp.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=n-ex
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=n-ex
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=n-ex
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [USBMMKBD] usbmmkbd.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - Startup: Shortcut to DRWATSON.lnk = C:\WINDOWS\DRWATSON.EXE
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O8 - Extra context menu item: &eBay Search - res://C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\eBayTb.dll/RCSearch.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Corel Network monitor worker - {4227C2D6-454E-4E8B-B3C9-E016B50C3D88} - C:\WINDOWS\SYSTEM\IEGFXFRW.DLL
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {4227C2D6-454E-4E8B-B3C9-E016B50C3D88} - C:\WINDOWS\SYSTEM\IEGFXFRW.DLL
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - C:\WINDOWS\SYSTEM\REMOVE_ME.DLL (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Corel Network monitor worker - {4227C2D6-454E-4E8B-B3C9-E016B50C3D88} - C:\WINDOWS\SYSTEM\IEGFXFRW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {4227C2D6-454E-4E8B-B3C9-E016B50C3D88} - C:\WINDOWS\SYSTEM\IEGFXFRW.DLL (HKCU)
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - C:\WINDOWS\SYSTEM\REMOVE_ME.DLL (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,21/mcgdmgr.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab

[Samm]

OK then. Apart from the fact your system is being swamped by McAfees anti-godknowswhat utilities and ME's system restore, you have got malware on your system.
I don't care what your anti-virus / anti-adware programs have told, you do have malware I'm afraid.

You need to go to the malware forum in Geekstogo & post your hijack log there. The malware staff there are excellent & will help you out.

If you still have problems after that, then come back to here & let us know.

Good luck