[dp2]

Hi,

First, sorry for my english (I'm a french canadian)...I will try to write as clearly as possible..

Recently I have installed service pack 2 for windows XP because a new external disk drive needed this for it's drivers...

The problem is that now my computer is always freezing for a few seconds when I'm moving the mouse...and I can't play videos with windows media player no more because teh image is always freezing..

I have tried many tools to remove spywares or to find viruses (Norton antivirus, spywareBlaster, spybot, Ad-aware, microsoft antispyware etc)...and it helped to find a few spywares (no viruses) but my computer performance didn't improved..

I really don't know what else I could be doing....and I'm not even sure if the problem is with the windows service pack 2...??

[Advertisements]

Click start then run, type sfc /scannow then press enter to replace the system files, you need the XP CD.

System File Check will show an on screen blue progress bar, reboot when the bar goes

Then run this

Get the trial of Tune Up 2006 here

Tune Up 2006 Trial

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete.

Run Tune Up disc clean up then registry clean up then click optimize to run reg defrag, which needs a reboot

Those will have cleared the drive of obsolete software errors

These are suggestions for making the most of the free trial

After the reboot, click optimize then system optimizer to optimize the computer, select computer with an internet connection from the drop down menu, this also requires a reboot

After the reboot, click optimize then system optimizer to accelerate downloads, select the speed just above your actual connection speed, this requires a reboot.

After the reboot, click optimize then system optimizer to run system advisor

[Retired Tech]

Click start then run, type sfc /scannow then press enter to replace the system files, you need the XP CD.

System File Check will show an on screen blue progress bar, reboot when the bar goes

Then run this

Get the trial of Tune Up 2006 here

Tune Up 2006 Trial

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete.

Run Tune Up disc clean up then registry clean up then click optimize to run reg defrag, which needs a reboot

Those will have cleared the drive of obsolete software errors

These are suggestions for making the most of the free trial

After the reboot, click optimize then system optimizer to optimize the computer, select computer with an internet connection from the drop down menu, this also requires a reboot

After the reboot, click optimize then system optimizer to accelerate downloads, select the speed just above your actual connection speed, this requires a reboot.

After the reboot, click optimize then system optimizer to run system advisor

[dp2]

Hi,

Thanks for your help....

I did everything you told me to do (tuneUp is a great software who found a lot of problems with my registry and configuration) but the exact same problem seems to persist..

One thing tuneUp told me is that Symantec user session (Ccapp.exe) is using an abnormally high amount of memory...but even when I do a selective startup an disable all processes, my problem is still there..

I don't know if this have anything to do with this Ccapp.exe thing???

I really don't know where to look for help now..

[Retired Tech]

This is going to take longer to do, but will check there is nothing stopping the drive making and savings any changes

Click start then run, type chkdsk /f /r then press enter, type Y to confirm for next boot, press enter then reboot.

This will take an hour, it will appear to load normally then either the monitor will show progress or the screen will go blank, do not disturb this.

[dp2]

Hi,

I did what you told me with the chkdsk /f /r thing....and it took something like 3-4 hours to do the scan...!

I posted a hiJackThis log file in another part of this forum...don't know if it was a good thing?

..

Sometimes my computer looks ok....even the mouse is working properly. But, for example, now I have two programs open: Mozilla firefox and Outlook express. If i minimize the two windows, my mouse will start freezing for half a second for say 1-2 minutes...and then everything is back to normal.

[Retired Tech]

You can check the system files

Click start then run, type sfc /scannow then press enter to replace the system files, you need the XP CD.

System File Check will show an on screen blue progress bar, reboot when the bar goes

Then run through the tune up clean up etc

It will be interesting to see what the HJT Log turns up

[dp2]

I already did this process (except for the hjt at the end)...should I do this again?

Do you think this as somthing to do with my service pack 2 installation?

[dp2]

I have just read on your site that maybe installing SP2 when already infected with malwares can cause many problems:

SP2 NOTE: Windows XP Service Pack 2 (SP2) has terrific security features, and we highly recommend everyone install it, however it should not be installed until your system is free from malware. Installing SP2 with malware present can cause many compatibility problems, or even prevent your computer from restarting. If your system has a malware infection, or if you're unsure, use the SP1a download link above.

Do you think I should remove SP2, run every program to remove spywares listed and then reinstall SP2?? Would this make resolving my problem more faster?

[Retired Tech]

If you want to remove SP2, use the XP repair feature which will do that and leave the system operable, you can then run virus scans etc before updating Windows

You can use these to repair XP

Possibly, you will need to boot the PC and keep tapping the delete key until the PC enters set up. Change the boot order to CD ROM Drive then hard drive, press F10 then press enter, type Y then press enter and as it reboots, look for press any key to load from CD, press enter

XP Repair Install

Or here if you are unable to run XP Repair Install

Alternative XP Repair Install Method

Use Windows Installation CD to repair the current installation, from the list, which uses a slightly different method

Windows XP repair feature won't delete your data, installed programs, personal information, or settings. It just repairs the operating system

After running XP Repair you will need to install all Windows Updates

Microsoft Update

[dp2]

do you think I should try this? cause I don't want to make my problem worst...or waste my time by removing and re-installing something that had no problem in the beginning..

what are we looking for with hijackthis log files? spywares or viruses??
can you see anything in the one i did yesterday: (sounds like someone readind in a cup of tea!)

Logfile of HijackThis v1.99.1
Scan saved at 8:07:22 PM, on 1/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adcash24.de/?driver24
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.passpor...ilogin.srf?id=2
O1 - Hosts: 205.205.126.17 mail.icaxon.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\LOGICI~1\OFFICE~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro...usecall_pre.php (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative....007/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro...eCallButton.CAB
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart...ploadClient.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartph...x/PCAXSetup.cab?
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15008/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8831CB02-85E6-47A0-B8E1-3C2C64A37E9B}: NameServer = 206.47.244.138 206.47.244.42
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

[Retired Tech]

There are a few unnecessary items and one which the malware team will pick up on. You should run through the malware guide, although you may be better deciding to remove or keep SP2 first as it will make a difference to the log

Please go here:

Malware Removal Guide

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, ask for advice in the Malware Forum

[dp2]

Hi again,

I did everything mentionned on the Malware Removal Guide you have sent me....but the problem seems to persist...
Si I have post a new topic in the hijackthis part of the forum here

I have posted a hijackthis log file and an Evido scan report...

Crossing my fingers!