PC Freezes / locks up intermittantly

[stephenc]

My sons PC which incidentally is networked to mine, has a habit of freezing intermittantly for apparantly no reason. He is running WinXP with plenty of Ram and an updated CPU fitted about a year ago.

Possible clues to the answer might be -

Occassionally, when the PC is left running ok and he returns to it, the monitor wont even turn on. Also, occassionally for no reason, the NIC is not available and so there is no network coverage.

Any help appreciated and thanks in advance

Stephen

[oracleguy]

Do you have all the latest drivers and patches?

[Spookster]

Also what kind of network setup do you have? NICs? Router? Wireless? Cable Modem? PCs? Laptops? Using a domain or a workgroup?

The first thing I would probably do is disconnect it from the network and let it sit for a day and see if it locks up. If it doesn't then it may be a network problem.

[stephenc]

OK, the latest drivers and patches are installed although there has been no new hardware fitted recently. The network is running via NIC's on each of our 3 PC's but none of the other ones are giving any trouble. I thought it might might have been a faulty NIC but I swopped them weeks ago and the problem remains.

I've taken Spooksters advice and totally removed the NIC - lets see if that makes any difference

Stephen

[stephenc]

:confused: The NIC was removed but the PC is still locking up intermittantly - anyone any ideas please???

Stephen :confused:

[Ben@WEBProp]

Could possibly be a software issue...I would suggest completely nuking your computer and starting over from scratch...or at least reformatting it.

I guess use these as last resorts...

Power supply is an important issue...you may be undersupplied: http://www.jscustompcs.com/power_supply/

Also, does the thing only lock up when connected to the network? Try unplugging him from the network and seeing if the comp freezes. If it still freezes, then its not your network. If it doesnt freeze, and the problem is your network...then i have no clue, that is a weird problem.

Good Luck!

-Ben

[Spookster]

:confused: The NIC was removed but the PC is still locking up intermittantly - anyone any ideas please???

Stephen :confused:

Ok that eliminates a network problem. Now try disabling any power down/power saving features or screensavers. Let it run for awhile and see if it locks up. Also write down what processes are running all the time.

[stephenc]

I'd already disabled the screen saver and power settings, etc as I thought originally that might be the cause. So far as processes running, there are about 30 of them but no applications (other than this one)

Stephen :(

[Ultragames]

the vid card and NIC probs, sounds like a mobo problem to me. Make sure youhave the latest motherboard drivers. Any info on exactly what cards and mobo you have would be nice.

[stephenc]

But surely as no hardware has been changed recently, it will not matter what drivers have been installed. And remember, the NIC has now been removed and the video card is an onboard chip.
Stephen

[Spookster]

Have you already checked your error logs for anything unusual? Also what would be helpful is to know more about your setup. Go to Start/Programs/Accessories/System Tools and open the System Information Tool. Highlight the System Overview in the left side and then go to File and Export. Export it to a text file and attach the file to the thread. It will contain all the information about how your system is setup as well as any running tasks, conflicts, etc.

[Celtboy]

what kind of motherboard does it have?

Have you done a virus scan?

A capacitor may have leaked...

[stephenc]

Virus scan ran through fine

System information file could not be attached as it is 307KB and the file upload will only allow 50KB

Stephen

[Basscyst]

What type of processor do you have, if an AMD is it overclocked?

Basscyst

[Basscyst]

LOL - guess I hit the wrong button.

Really best bet is to reformat and start fresh. Especially if you have the ability to back up your data etc.

Basscyst

[Spookster]

LOL - guess I hit the wrong button.

Really best bet is to reformat and start fresh. Especially if you have the ability to back up your data etc.

Basscyst

If it is a hardware problem then reformatting is not going to fix anything. It's probably better to figure out what is causing the problem first before resorting to that.

[Basscyst]

OK, the latest drivers and patches are installed although there has been no new hardware fitted recently. The network is running via NIC's on each of our 3 PC's but none of the other ones are giving any trouble. I thought it might might have been a faulty NIC but I swopped them weeks ago and the problem remains.

I've taken Spooksters advice and totally removed the NIC - lets see if that makes any difference

Stephen

and reading the rest of the thread,

Kinda points to a software issue to me. Somthing thats slipping through.

Basscyst

[Spookster]

and reading the rest of the thread,

Kinda points to a software issue to me. Somthing thats slipping through.

Basscyst


What points it to a software problem?

[Basscyst]

Well, call it an educated guess, no hardware as been recently added so it doesn't make sense that there would be a hardware conflict, Somthing could have gone bad I suppose, but most likly the kid just "dirtied" up his pc wiith a bunch of garbage and has downloaded and \ or installed somthing that is causing conflicts.

If I'm wrong, you have my vote for president. :p

Basscyst

[Roy Sinclair]

The next time the PC locks up, try pressing the "Numlock" key. If you can turn the numlock light off and on the PC itself is actually still running and it's likely the graphics subsystem is the part that's locked up. If the numlock light can't be changed then the problem runs deeper. It could still be a hardware problem such as a bad memory location, weak power supply, overclocked parts or the like. Just because you haven't added or removed any hardware doesn't mean the hardware is all still ok.

[Spookster]

It could still be a hardware problem such as a bad memory location, weak power supply, overclocked parts or the like. Just because you haven't added or removed any hardware doesn't mean the hardware is all still ok.

Exactly. A power supply for example may not die immediately. I had one that died a slow death over a long period of time and caused various problems to occur.

Unfortunately this type of problem is difficult to track down as there are many different potential causes.

[stephenc]

Hi Guys

Thanks for all the advice so far - I know its really difficult to pinpoint the cause of the problem and very frustrating for us. The system has been stable for the past couple of days, but I know it will misbehave very soon and lock up without warning.

I will try the number lock test and report back........

Stephen

[Basscyst]

The next time the PC locks up, try pressing the "Numlock" key. If you can turn the numlock light off and on the PC itself is actually still running and it's likely the graphics subsystem is the part that's locked up. If the numlock light can't be changed then the problem runs deeper. It could still be a hardware problem such as a bad memory location, weak power supply, overclocked parts or the like. Just because you haven't added or removed any hardware doesn't mean the hardware is all still ok.


I won't argue with you, it very well could be that a piece of hardware has gone bad, I did leave that open as a possibility. I just prefer to eliminate the software possibility first, maybe after minor hardware troubleshoting. Since there are usually hundreds of pieces of software installed and only a few pieces of hardware, it's seems logical to me to start there first, and continue hardware trouble shooting on a fresh system ripping out a part at a time if the problem is still occuring. Just a personal preference I guess.

Basscyst

[Spookster]

Stephen,

After reviewing the output from your system information this caught my eye.

{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} Not Available http://dload.ipbill.com/del/loader.exe


This might be a dialer program. You might want to download HiJackThis http://www.spychecker.com/program/hijackthis.html and run it. If you have any other spyware/dialers/trojans it might be a good idea to Update your AdAware (I noticed that you had it installed). In order for it to be effective you have to update it with the most current data file. Update it and rerun it and try out SpyBot as well.

[stephenc]

Stephen,

After reviewing the output from your system information this caught my eye.

{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} Not Available http://dload.ipbill.com/del/loader.exe


This might be a dialer program. You might want to download HiJackThis http://www.spychecker.com/program/hijackthis.html and run it. If you have any other spyware/dialers/trojans it might be a good idea to Update your AdAware (I noticed that you had it installed). In order for it to be effective you have to update it with the most current data file. Update it and rerun it and try out SpyBot as well.

Hi Spookster

I ran the ad-aware program and quarantined about a dozen files; I then downloaded hijackthis and ran it. Attached is a list of the files found. I'm a bit scared of removing something that should stay on the system. Maybe something will be obvious to you (eg, {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} Not Available http://dload.ipbill.com/del/loader.exe

Really appreciate your help so far with this

Stephen

[Spookster]

Hi Spookster

I ran the ad-aware program and quarantined about a dozen files; I then downloaded hijackthis and ran it. Attached is a list of the files found. I'm a bit scared of removing something that should stay on the system. Maybe something will be obvious to you (eg, {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} Not Available http://dload.ipbill.com/del/loader.exe

Really appreciate your help so far with this

Stephen


It does appear you have some potential spyware on your system. But before we get into that let's talk about some other things first. I've been reviewing your system information more in depth. Did you upgrade this system to WindowsXP from a older version of Windows? The reason I ask is because you are running Windows XP and are using a FAT32 file system. That's not very good. With Windows XP you want to use NTFS as it is more efficient and more secure and less susceptible to disk errors.

[Darknight]

Have you checked for heat issues?
Fans not working
Heat sink on cpu loose
Heat sink on video card loose

[Darknight]

I just did a search for 'dload.ipbill.com' from your hijack this txt file....
Yahoo returned 3 pages of porn links.
Yet none appeared to be anything other than porn.
Even if its not the cause of your lockup issues, I advise removing whatever it is thats putting that line in your report. Porn sites are often the source of maulware and other nasty (as in break your computer, and trick you into clicking stuff you shouldn't) junk.

[stephenc]

It does appear you have some potential spyware on your system. But before we get into that let's talk about some other things first. I've been reviewing your system information more in depth. Did you upgrade this system to WindowsXP from a older version of Windows? The reason I ask is because you are running Windows XP and are using a FAT32 file system. That's not very good. With Windows XP you want to use NTFS as it is more efficient and more secure and less susceptible to disk errors.
I'm pretty sure I did a clean install when I built Matthews system. From memory, he had so much junk on it then (and now!) that I reformatted the hard drive and started from scratch. Maybe I need to think about doing that again, though its a bit of a pain if its not software related.

The CPU fan is working and the heat sink is firmly fixed. Its an on-board video chip so no associated fan.

I'm not surprised about the porn links - whilst we dont condone it, what can you expect with a 17 year old boy? And of course, you never know how they came about.

But I wonder about the other potential spyware on his system is??

Stephen

[Willy Duitt]

I see at least one trojan in the log file you posted:

O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe

The winlogon.exe located at C:\Windows\System32\Winlogon.exe is the real one. The one running at C:\Windows\winlogon.exe is most likely a virus. There are several virus's it might be, including the new NetSky virus variant.

Don't know what this is, but it seems suspect:
O2 - BHO: (no name) - {62160EEF-9D84-4C19-B7B8-6AC2526CD726} - C:\WINDOWS\System32\iruzedi.dll (file missing)

These are search assistant hijackers and can go:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://opti.riviera.cc (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://opti.riviera.cc (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/options/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://opti.riviera.cc (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://riviera.cc (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://opti.riviera.cc (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://opti.riviera.cc (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://opti.riviera.cc (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
O1 - Hosts: auto.search.msn.com
O1 - Hosts: search.netscape.com
O1 - Hosts: ieautosearch
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

These should go also:
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.exe
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -

And this is a huge resource hog:
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE


Filename: Osa.exe Osa9.exe
Program Title: Office Startup
Rating: 1 ( Not Recommended - Resource Hog, Spyware )
Comments: Resource hog that launches common MS Office components to help speed up the launch of Office programs. Osa9.exe is the Office 2000 equivalent. Some users claim there's no difference with or without it but it isn't required anyway


And this is the Windows Update Manager and the fact that it is running in your processes means it is waiting for permission to download recently released updates. Which means you are not up to date on your updates....
C:\WINDOWS\System32\wuauclt.exe

Try cleaning some of that mess up and see if it runs any better. Just getting rid of the trojan should help performance considerably.

.....Willy

[stephenc]

Hi Willie

Thanks for advice - I've deleted the offending files and restarted the system.

I then ran Norton Antivirus again to 'Scan' the system. I've noticed that running this scan often locks up the system and that is what has just happened again.

Originally I'd hoped / thought that it might have locked up at the same place each time but now that I've checked, I'm pretty sure that this is not the case.

BTW , I've attached a copy of the log file after alterations.

Stephen

[Willy Duitt]

Your log looked clean and it seems as if you downloaded the Microsoft Critical Updates, but did you try rebooting to check if that trojan resurfaced on boot?


And FWIW, I never have liked anything Norton....
I have found their Utilities to be resource hogs and although I took another look thru this thread, I did not see your system stats and therefore do not know what CPU or RAM you have available. But besides that trojan robbing system resources, Norton is doing a good job of it itself and my feeling is, you are low on resources which is causing the system to hang...

Two additional resource hogs which jump out at me are:
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

Are you running any speech recognition, handwriting recognition software? Because these are known to drain system resources also...

Process File: ctfmon or ctfmon.exe
Process Name: Alternative User Input Services
Description: A service that handles the Alternative User Input Text Processor (TIP) and the Microsoft Office Language Bar. It provides text input support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.


And is there a true need to be running the Flash Communication Server because this server is known to use upwards to 1.5 Giga bytes of RAM due to a problem with memory leakage. Running properly, it will still use at least 140 Mega bytes of RAM and all this could be your underlying problem. You do not have the resources....
C:\Program Files\Macromedia\Flash Communication Server MX\FlashCom.exe

.....Willy

BTW: Try rebooting into Safe Mode so that you have the minimal of processes running and try running another anti virus scan and see if it hangs. If it doesn't, I would think that you are low on resources for all of the programs you are trying to run on normal boot...

[Willy Duitt]

BTW: Your NIC problem could be related to any problem you may have with the Flash Comminicator Server since that server is suppose to detect your modem and any incompatability between the two could adversly affect your connection...

[stephenc]

Hi Willy

I went into control panel | add & remove programs and as I started to scroll down the list, the system hung on my again. I rebooted it again (reset as ctrl, alt & del dont have any effect). I scrolled slowly down through the list of programs and got flash comm server removed. As I scrolled down the list again, it hung again!

This occured another 3 times - even in Safe Mode, so a pattern is beginning to unfold. Both the add & remove and the antivirus scan search through the hard drive. I wonder if there could be a fault here?

BTW, I've cleared O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe.
I dont have any speech recognition s'ware, etc

Stephen

[Willy Duitt]

This is merely my opinion but I still think this is a resource problem. When was the last time the system was defragged? And it wouldn't hurt to run both Spybot Search and Destory as well as Adaware (if you need the links let me know but I do not have either handy ATM)

I would defrag and also test your memory with this:
http://www.memtest86.com/

[Spookster]

Ok obviously since this is a public forum you are going to get bombarded with suggestions so I will just throw a few and let the others go at it.

Ok first thing disable and get rid of Norton Speed Works as it is not needed with Windows XP. Norton Speed Works is a defrag program that constantly runs and rearranges data on your drive to make things run faster. In your case it is not helping things but slowing things down. Your drive is very full. You only have around 4Gb's of free space on yur 28Gb drive. Now that can be due the fact that you are using a FAT32 file system with WinXP as well as your son may have downloaded alot of files. You will want to use an NTFS file system. I think your problem is likely being caused due to having the FAT32 file system with the drive being so full and then having Norton Speedworks run trying to reorganize it all the time.

ctfmon is not a resource hog. It's a component of Microsoft Office. It uses a little bit of memory but not much. If you want to remove it then do it properly. Here are some instructions:

http://support.microsoft.com/default.aspx?kbid=282599

The winlogin.exe virus/trojan is a good catch. I hadn't noticed that one the first time as because windows xp actually does use a file with that name however it runs from c:\windows\system32\winlogon.exe not c:\windows\winlogon.exe

At this point I see this as being both a hardware and softare related problem. The hardware problem being with how your drive is set up and the software problem being most likely the Norton speedworks. I am sure many of those Spyware/Virus/Trojans are not helping matters.

You can try and remove all of it and convert the drive to NTFS without reloading the system but for you it might be easier to just wipe it clean and start over.

A few things that you might want to consider though is what software you load back on the system. Norton Antivirus is actually a very good product but watch out for Nortons other utilities. Don't install Norton Speedworks as you do not need it with WinXP. WinXP is handles management of your drives just fine with regular maintenance. You also want to keep Windows updated as well as Nortons antivirus definitions and Lavasofts AdAware definitions and any other Spyware Detection program. It's good to have those but if you don't keep them up to date they can't do their jobs effectively.

[stephenc]

A lot of good advice here Spookster and other - many thanks!

At this point, reformating the hard drive may be the only option but setting up the network connection and loading all the drivers again is a bit of a hastle. On top of that, boys will be boys and I know we'll end up with the same c**p loaded again. It was all I could do to get him to take off Kazaa as it was really slowing his system some months again.

Anyway many thanks to you all for the help and advice. When I get it sorted or reformatted, I'll let you know the outcome.

Stephen :)

[Spookster]

A lot of good advice here Spookster and other - many thanks!

At this point, reformating the hard drive may be the only option but setting up the network connection and loading all the drivers again is a bit of a hastle. On top of that, boys will be boys and I know we'll end up with the same c**p loaded again. It was all I could do to get him to take off Kazaa as it was really slowing his system some months again.

Anyway many thanks to you all for the help and advice. When I get it sorted or reformatted, I'll let you know the outcome.

Stephen :)

No problem. Just remember use NTFS and don't install Norton Speedworks. Yes Kazaa is very poorly designed software. If he's going to use p2p software use something else. You may also want to consider installing Zone Alarm for firewall protection as well. I don't recall seeing any firewall software installed.