Xp Mini-freezes Every 2-3 Seconds, Mouse/keyboard/sound interrupted

cnbingham2 · 01-09-2005, 02:34 PM

XP is unresponsive for about 1/2 second every 2-3 seconds. During this time, Mouse clicks and keyboard modifiers (ie. shift/ctrl) are lost and mouse movements and keyboard letter/numbers are delayed for 1/2 second or more.

I can occasionally catch the system without these mini-freezes on every 3rd or 4th reboot (nothing changes between reboots).

In watching the CPU Usage History, I see a frequent pattern of spikes from 1-2% up to 35-75% usage. Pagefile usage doesn't seem to be moving much.

The Processes list sorted by CPU usage seems to have taskmgr.exe bumping up frequently, as well as explorer & iexplore.exe.

I'm running Dell 8200 laptop, 2.4GHz P4M, 1GB RAM, XP SP1.

I've run AdAware, SpyBot, as well as System Mechanic 5 in attempts to clean up anything errant.

I have an HijackThis log if you think it may help any.

Has anyone else ever run into this?

Thanx,

Curtis

**Sarge** · 01-09-2005, 03:32 PM

What have you got running for Anti-Virus?
Is there a software firewall running (AKA 'Personal Firewall") besides/instead of the Windows Firewall?
I assume you're running XPSP2. If you're not... you should be IMHO.

What's the net usage like? Is there lots of unbidden outgoing traffic?

cnbingham2 · 01-09-2005, 03:49 PM

I'm running Norton AntiVirus, + Anti-Spam on XP SP1. I've hesitated upgrading to SP2 for a while because of all the problems people have been discussing.

I haven't installed any additional firewalls.

I've not closely monitored outgoing traffic, however at the moment there doesn't seem to be any traffic (displayed in the Windows Task Manager: Networking tab) unless I specifically request a page via the browser. I too had thought there might be something trying to call home.

Thanx,

CB

CTSNKY · 01-09-2005, 05:17 PM

A log review couldn't hurt......

Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Double click on the program to run it.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless.

cnbingham2 · 01-09-2005, 05:26 PM

Quote:

Originally Posted by CTSNKY

A log review couldn't hurt......

Thank you very much for taking the time to respond.

Here you go. As you requested, this HijackThis logfile has been processed by HijackThis Analyzer, last updated on 1/7/05:

===========================================================================================================================
Log was analyzed using HijackThis Analyzer - Updated on 1/7/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.0
Scan saved at 8:21:44 PM, on 1/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Photodex\CompuPicPro\ScsiAccess.exe
C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
C:\Program Files\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe
C:\Program Files\Enfish\Enfish Find\EtiTray.exe
C:\Program Files\SoftMaker\Shared Tools\Smash\Smash.exe
C:\Program Files\CardScan\System\CSyncCfg.exe
C:\Program Files\Groove Networks\Groove\Bin\Groove.exe
C:\Program Files\Virtual Ink\mimio\mimiosys.exe
C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
C:\Program Files\PDF-XChange SDK EndUser\PDFSaver.exe
C:\mysql\bin\winmysqladmin.exe
C:\Program Files\Enfish\Enfish Find\PropMSvr.exe
C:\Program Files\Enfish\Enfish Find\EtiSchd2.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Crimson Editor\cedt.exe
C:\PROGRA~1\Enfish\ENFISH~2\DexEng2.exe
C:\Program Files\ReGetDx\regetdx.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ceoexpress.com/personal.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Groove Networks\Groove\Bin\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dll
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Program Files\ReGetDx\iebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O3 - Toolbar: Enfish Find... - {1F680408-B58A-40B0-A330-50A344786F97} - C:\Program Files\Enfish\Enfish Find\EtiFndBr.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [WorkFlowTray] "C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe"
O4 - HKLM\..\Run: [SSPrnAgent] C:\Program Files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\RegistryController.exe"
O4 - HKLM\..\Run: [Opware14] "C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Slingshot Tray App] C:\Program Files\Enfish\Enfish Find\EtiTray.exe /startup
O4 - HKCU\..\Run: [Smash] "C:\Program Files\SoftMaker\Shared Tools\Smash\Smash.exe"
O4 - HKCU\..\Run: [CardScan AutoSync] "C:\Program Files\CardScan\System\CSyncCfg.exe" /background
O4 - Startup: WinMySQLadmin.lnk = C:\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Groove Virtual Office.lnk = C:\Program Files\Groove Networks\Groove\Bin\Groove.exe
O4 - Global Startup: mimio Studio.lnk = C:\Program Files\Virtual Ink\mimio\mimiosys.exe
O4 - Global Startup: mimio.lnk = C:\Program Files\Virtual Ink\mimio\mimiosys.exe
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: PDF-Capture.lnk = C:\Program Files\PDF-XChange SDK EndUser\PDFSaver.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O16 - DPF: {3C039F5B-5728-4EE1-A323-B7F6DB5406CA} - https://na1.salesforce.com/dwnld/offline/install.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {59D04288-805E-4D43-BE09-83B1083E9E1E} (IUpdateAutoLaunch Control) - http://idenphones.motorola.com/iden/...AutoLaunch.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1096907790733
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://confsql1.centra.com/bestsoftw...Downloader.cab
O16 - DPF: {CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_03) -
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {EF58E341-49C3-4156-A3C4-5FFCA7C1EAB7} (EURAS_Portal.Gateway) - http://www.euras.com/euras/activex2/euras.CAB
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - https://www.linkedin.com/cab/wabctrl.cab
O18 - Protocol: eti - {3AAE7392-E7AA-11D2-969E-00105A088846} - C:\Program Files\Enfish\Enfish Find\EtiPBrkr.dll
O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Group\Apache2\bin\Apache.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
O23 - Service: Groove Audit Service - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveAuditService.exe
O23 - Service: Groove Installer Service - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveInstallerService.exe
O23 - Service: MySql - Unknown - C:/mysql/bin/mysqld-nt.exe
O23 - Service: ScsiAccess - Unknown - C:\Program Files\Photodex\CompuPicPro\ScsiAccess.exe
O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe

End of HijackThis Analyzer Log.
===========================================================================================================================

greyknight17 · 01-09-2005, 07:27 PM

Check and fix these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O16 - DPF: {3C039F5B-5728-4EE1-A323-B7F6DB5406CA} - https://na1.salesforce.com/dwnld/offline/install.cab
O16 - DPF: {CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_03) -

Regarding this program:

C:\Program Files\Enfish\Enfish Find\EtiFndBr.dll

It might be spyware related also. If you don't need it, we recommend uninstalling it also.

Restart and post a new log.

cnbingham2 · 01-09-2005, 09:31 PM

Quote:

Originally Posted by greyknight17

Check and fix these:[b]

Thanks again for your help.

I've done as you suggested. See new log below..

Quote:

Originally Posted by greyknight17

Regarding this program:

C:\Program Files\Enfish\Enfish Find\EtiFndBr.dll

It might be spyware related also. If you don't need it, we recommend uninstalling it also.

Restart and post a new log.

Enfish is kosher. It is paid software, reliable, all that. Great utility to find any file, text, data, etc. on your system if you haven't yet seen it.

Curtis

----------

===========================================================================================================================
Log was analyzed using HijackThis Analyzer - Updated on 1/7/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.0
Scan saved at 12:38:58 AM, on 1/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe
C:\Program Files\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\SoftMaker\Shared Tools\Smash\Smash.exe
C:\Program Files\Enfish\Enfish Find\EtiTray.exe
C:\Program Files\CardScan\System\CSyncCfg.exe
C:\HijackThis\HijackThis Analyzer.exe
C:\Program Files\Groove Networks\Groove\Bin\Groove.exe
C:\Program Files\Virtual Ink\mimio\mimiosys.exe
C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
C:\Program Files\PDF-XChange SDK EndUser\PDFSaver.exe
C:\mysql\bin\winmysqladmin.exe
C:\Program Files\Enfish\Enfish Find\PropMSvr.exe
C:\Program Files\Enfish\Enfish Find\EtiSchd2.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ceoexpress.com/personal.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Groove Networks\Groove\Bin\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dll
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Program Files\ReGetDx\iebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O3 - Toolbar: Enfish Find... - {1F680408-B58A-40B0-A330-50A344786F97} - C:\Program Files\Enfish\Enfish Find\EtiFndBr.dll
O4 - HKLM\..\Run: [WorkFlowTray] "C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe"
O4 - HKLM\..\Run: [SSPrnAgent] C:\Program Files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\RegistryController.exe"
O4 - HKLM\..\Run: [Opware14] "C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKCU\..\Run: [Smash] "C:\Program Files\SoftMaker\Shared Tools\Smash\Smash.exe"
O4 - HKCU\..\Run: [Slingshot Tray App] C:\Program Files\Enfish\Enfish Find\EtiTray.exe /startup
O4 - HKCU\..\Run: [CardScan AutoSync] "C:\Program Files\CardScan\System\CSyncCfg.exe" /background
O4 - Startup: WinMySQLadmin.lnk = C:\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Groove Virtual Office.lnk = C:\Program Files\Groove Networks\Groove\Bin\Groove.exe
O4 - Global Startup: mimio Studio.lnk = C:\Program Files\Virtual Ink\mimio\mimiosys.exe
O4 - Global Startup: mimio.lnk = C:\Program Files\Virtual Ink\mimio\mimiosys.exe
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: PDF-Capture.lnk = C:\Program Files\PDF-XChange SDK EndUser\PDFSaver.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {59D04288-805E-4D43-BE09-83B1083E9E1E} (IUpdateAutoLaunch Control) - http://idenphones.motorola.com/iden/...AutoLaunch.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1096907790733
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://confsql1.centra.com/bestsoftw...Downloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {EF58E341-49C3-4156-A3C4-5FFCA7C1EAB7} (EURAS_Portal.Gateway) - http://www.euras.com/euras/activex2/euras.CAB
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - https://www.linkedin.com/cab/wabctrl.cab
O18 - Protocol: eti - {3AAE7392-E7AA-11D2-969E-00105A088846} - C:\Program Files\Enfish\Enfish Find\EtiPBrkr.dll
O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Group\Apache2\bin\Apache.exe
O23 - Service: Groove Audit Service - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveAuditService.exe
O23 - Service: Groove Installer Service - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveInstallerService.exe
O23 - Service: MySql - Unknown - C:/mysql/bin/mysqld-nt.exe

End of HijackThis Analyzer Log.
===========================================================================================================================

CTSNKY · 01-10-2005, 04:56 AM

Your log is clean. If you disabled System Restore, make sure to enable it now.

To help prevent future spyware installations/infections, please read the Anti-Spyware Section (http://www.greyknight17.com/spyware.htm#prevent) and use the tools provided.

Are there any problems now? If not, you should be set to go, malware-speaking, that is.

One other nice little utility is this:

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link don't work) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

cnbingham2 · 01-10-2005, 07:31 AM

CTSNKY and others--

Thanks tons for your help in cleaning out the logs.

Unfortunately, the mini-freezes are still occurring. Can we move this thread back into the original forum?

To diagnose the problem, I used msconfig to configure services/startup.

The problem is gone with a diagnostic startup. As I add in ONLY the MS services (NO startup, win.ini, system.ini) the problem reappears.

I repeatedly added in ~10 services at a time between reboots and the problem reappeared when I added the MS service "Server" with the following configuration:

System.ini loaded, no win.ini or startup programs
Services loaded:
Windows Audio
Computer Browser
DHCP client
DNS client
Error Reporting Service
Event Log
Com+ Event System
Fast User Switching
Remote Procedure call Local~
Remote Procedure call
Windows Installer
Windows Management Instrumentation
Windows Management Instrumentation Driver
WMI Performance adapter
Portable Media Serial # Service
Portable Media Serial #
Windows Time
Volume Shadow Copy
Alerter
Application Layer Gateway Service
Application Management
COM+ System Application
Net Logon

Removing Server and continuing on, the symptoms did not reappear until after a number additions & reboots.

Later, I added server back in and it worked fine.

The system worked with only the following services NOT installed and NOT starting an startup apps:

Clipbook
FTP Publishing
GEAR Security
IIS Admin
Indexing Services
Machine Debug Manager
Messenger
Netmeeting Remote Desktop
QoSRSVP
Remote Registry
SCSI Access
SMTP
Smart Card
Smart Card Helper
Sony SPTI
V2i Protector
Wireless Zero Config
WWW Publishing

However, as I started all startup applications, the mini-freezes reappeared and simply removing all startup apps won't remedy the problem.

I'm stumped, as my efforts to narrow/isolate the problem have been thwarted.

Any other ideas?

CB

01-09-2005, 02:34 PM	#1 (permalink)
cnbingham2 Registered User Join Date: Jan 2005 Posts: 5 OS: XP	Xp Mini-freezes Every 2-3 Seconds, Mouse/keyboard/sound interrupted XP is unresponsive for about 1/2 second every 2-3 seconds. During this time, Mouse clicks and keyboard modifiers (ie. shift/ctrl) are lost and mouse movements and keyboard letter/numbers are delayed for 1/2 second or more. I can occasionally catch the system without these mini-freezes on every 3rd or 4th reboot (nothing changes between reboots). In watching the CPU Usage History, I see a frequent pattern of spikes from 1-2% up to 35-75% usage. Pagefile usage doesn't seem to be moving much. The Processes list sorted by CPU usage seems to have taskmgr.exe bumping up frequently, as well as explorer & iexplore.exe. I'm running Dell 8200 laptop, 2.4GHz P4M, 1GB RAM, XP SP1. I've run AdAware, SpyBot, as well as System Mechanic 5 in attempts to clean up anything errant. I have an HijackThis log if you think it may help any. Has anyone else ever run into this? Thanx, Curtis

01-09-2005, 05:17 PM	#4 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	A log review couldn't hurt...... Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Double click on the program to run it. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless. __________________ GO BIG BLUE!!

01-09-2005, 07:27 PM	#6 (permalink)
greyknight17 Analyst, Security Team Join Date: Jul 2004 Location: New York Posts: 14,327 OS: Windows 98 & Windows XP Home/Pro My System	Check and fix these: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O16 - DPF: {3C039F5B-5728-4EE1-A323-B7F6DB5406CA} - https://na1.salesforce.com/dwnld/offline/install.cab O16 - DPF: {CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_03) - Regarding this program: C:\Program Files\Enfish\Enfish Find\EtiFndBr.dll It might be spyware related also. If you don't need it, we recommend uninstalling it also. Restart and post a new log. __________________ Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D Anti-Spyware Tutorial :: Spyware Prevention Tools

01-10-2005, 04:56 AM	#8 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	Your log is clean. If you disabled System Restore, make sure to enable it now. To help prevent future spyware installations/infections, please read the Anti-Spyware Section (http://www.greyknight17.com/spyware.htm#prevent) and use the tools provided. Are there any problems now? If not, you should be set to go, malware-speaking, that is. One other nice little utility is this: The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link don't work) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes. __________________ GO BIG BLUE!!

01-10-2005, 07:31 AM	#9 (permalink)
cnbingham2 Registered User Join Date: Jan 2005 Posts: 5 OS: XP	CTSNKY and others-- Thanks tons for your help in cleaning out the logs. Unfortunately, the mini-freezes are still occurring. Can we move this thread back into the original forum? To diagnose the problem, I used msconfig to configure services/startup. The problem is gone with a diagnostic startup. As I add in ONLY the MS services (NO startup, win.ini, system.ini) the problem reappears. I repeatedly added in ~10 services at a time between reboots and the problem reappeared when I added the MS service "Server" with the following configuration: System.ini loaded, no win.ini or startup programs Services loaded: Windows Audio Computer Browser DHCP client DNS client Error Reporting Service Event Log Com+ Event System Fast User Switching Remote Procedure call Local~ Remote Procedure call Windows Installer Windows Management Instrumentation Windows Management Instrumentation Driver WMI Performance adapter Portable Media Serial # Service Portable Media Serial # Windows Time Volume Shadow Copy Alerter Application Layer Gateway Service Application Management COM+ System Application Net Logon Removing Server and continuing on, the symptoms did not reappear until after a number additions & reboots. Later, I added server back in and it worked fine. The system worked with only the following services NOT installed and NOT starting an startup apps: Clipbook FTP Publishing GEAR Security IIS Admin Indexing Services Machine Debug Manager Messenger Netmeeting Remote Desktop QoSRSVP Remote Registry SCSI Access SMTP Smart Card Smart Card Helper Sony SPTI V2i Protector Wireless Zero Config WWW Publishing However, as I started all startup applications, the mini-freezes reappeared and simply removing all startup apps won't remedy the problem. I'm stumped, as my efforts to narrow/isolate the problem have been thwarted. Any other ideas? CB Last edited by cnbingham2 : 01-10-2005 at 07:41 AM.

01-09-2005, 03:32 PM	#2 (permalink)
Sarge TSF Enthusiast Join Date: Nov 2004 Location: Earth Posts: 644 OS: Windows XP Pro x64	What have you got running for Anti-Virus? Is there a software firewall running (AKA 'Personal Firewall") besides/instead of the Windows Firewall? I assume you're running XPSP2. If you're not... you should be IMHO. What's the net usage like? Is there lots of unbidden outgoing traffic?

01-09-2005, 03:49 PM	#3 (permalink)
cnbingham2 Registered User Join Date: Jan 2005 Posts: 5 OS: XP	I'm running Norton AntiVirus, + Anti-Spam on XP SP1. I've hesitated upgrading to SP2 for a while because of all the problems people have been discussing. I haven't installed any additional firewalls. I've not closely monitored outgoing traffic, however at the moment there doesn't seem to be any traffic (displayed in the Windows Task Manager: Networking tab) unless I specifically request a page via the browser. I too had thought there might be something trying to call home. Thanx, CB