My Computer Hangs Frequently.

[drali 6]

its P-III.800.128RAM,40GB high rpm H.Disk(3 months old),I am using win 98SE with norton antivirus fully updated and BHODemon 2(antispyware).the problem is it hangs very frequently.& sometimes even not respond to Alt+Ctrl+Delete.& i have to do direct shut down to restart it.it sauses damage to my H.disk.i surf rimweb,yahoo,rediff mainly.using R-connect with samsungSch191

Experts help me.

[cracker 0]

this is not enough pls post HijackThis Log

get HijackThis http://www.filehippo.com/download_hijackthis.html

from here

and also do onnline scan of ur pc

http://housecall.trendmicro.com/housecall/start_corp.asp

(Works for Firefox, Netscape, IE and more)

To use these you need to run your Internet Explorer web browser.

Edited October 12, 2005 by cracker

[Chirag 5]

Try disabling Norton, and use the machine... most probs of such hook-ups are coz of these Norton / McAfee products!

[amitstg 0]

it could be a hardware problem

check ur RAM

than check ur motherboard (probably BIOS)

ultimately replace ur CPU (very rare)

the very first option would be to format ur hard drive and fresh install the operating system (original)

[cracker 0]

thats why i asked for HijackThis log. so that we can get better idea wats wrong . and its true Norton / McAfee products! s**ks. thats is the reason i am using pc-cillin

[drali 6]

Try disabling Norton, and use the machine... most probs of such hook-ups are coz of these Norton / McAfee products!

43742[/snapback]

--------------------------------------------------------------------------------------------

if i find norton is the culprit then what next(anti virus) to protect my system.and tell can bad sectors in H.disk cause this hang problem.

[drali 6]

this is not enough pls post HijackThis Log

get HijackThis http://www.filehippo.com/download_hijackthis.html

from here

and also do onnline scan of ur pc

http://housecall.trendmicro.com/housecall/start_corp.asp

(Works for Firefox, Netscape, IE and more)

To use these you need to run your Internet Explorer web browser.

43728[/snapback]

this is the results of hijack.what mext friend

Logfile of HijackThis v1.99.1

Scan saved at 10:12:49 PM, on 10/12/05

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SYSTEM\IGFXTRAY.EXE

C:\WINDOWS\SYSTEM\HKCMD.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\WINDOWS\SYSTEM\QTTASK.EXE

C:\PROGRAM FILES\WINAMP\WINAMPA.EXE

C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE

C:\PROGRAM FILES\TFGI\YPQE.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\SYSTEM\RNAAPP.EXE

C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE

C:\WINDOWS\SYSTEM\TAPISRV.EXE

C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE

C:\PROGRAM FILES\INTERNET OPTIMIZER\ACTALERT.EXE

C:\PROGRAM FILES\VG\VIRTUAGIRL2.EXE

C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\RCONNECT\RCONNECTDIALER.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

C:\WINDOWS\NOTEPAD.EXE

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX

O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM220.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O4 - HKLM\..\Run: [scanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"

O4 - HKLM\..\Run: [Media Gateway] C:\PROGRAM FILES\MEDIA GATEWAY\MEDIAGATEWAY.EXE

O4 - HKLM\..\Run: [internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"

O4 - HKLM\..\Run: [Zvjmkj] C:\PROGRAM FILES\TFGI\YPQE.EXE

O4 - HKLM\..\Run: [vmfuotgnjh] c:\windows\system\vmfuotgnjh.exe

O4 - HKLM\..\Run: [stillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

O4 - HKLM\..\RunServices: [scriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet

O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: VirtuaGirl2.lnk = C:\Program Files\Vg\VirtuaGirl2.exe

O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe

O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html

O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html

O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html

O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMESUS.DLL

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMESUS.DLL

O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc.../bridge-c18.cab

O16 - DPF: {FA83E942-B796-46DE-9155-1632ECC5473B} - http://akamai.downloadv3.com/binaries/EGDA...ACCESS_1061.cab

[Vishal Gupta 4]

What I found suspicious in the HijackThis file is:

C:\EXPLORER.EXE

Explorer.exe file should be present in C:\Windows not in C:\.

And what I found while googling:

C:\Explorer.exe Autostart Method

VULNERABILITY: C:\Explorer.exe - New autostart method

SEVERITY: Low

DESCRIPTION: Windows loads explorer.exe (typically located in the Windows directory) when it has loaded. However, if c:\explorer.exe exists it will be executed instead of the Windows explorer.exe.

THE PROBLEM: If c:\explorer.exe is corrupt, the user will effectively be locked out of their system after they reboot. If c:\explorer.exe is a trojan, it will be executed. Unlike all other autostart methods, there is no need for any file or registry changes - the file just simply has to be named c:\explorer.exe. Microsoft have been notified.

So try to move that file at some other place and reboot the comp.

If u get ERROR while moving it, try to move it by starting ur comp in DOS mode using 98 setup CD.

[cracker 0]

download, update and scan with this:

http://www.ewido.net/en/download/

and reboot

[drali 6]

download, update and scan with this:

http://www.ewido.net/en/download/

and  reboot

43777[/snapback]

yhanks frend but the above download is for win2000 & above & i m running win 98SE.

What I found suspicious in the HijackThis file is:

C:\EXPLORER.EXE

thanks for the valuable information.now guide me if i format & reinstall win98SE.will it help & where from i can d/l internet explorer 6.

[Vishal Gupta 4]

If u reinstall ur windows, it should definitely help (if the problem is not related to h/w?)

And u can d/l IE 6 from here:

D/l IE 6 SP1

[RajanPERT 0]

Hi DRALI2!

Try one thing before doing reinstalling, it may solved your problem.

It may be virus problem. For it please Uninstall the Norton Antivirus, and install the AVG 7.0. and also install the Spyboat, For a firewall Download the Sygate Personal Firewall. For downloading Location pleas read following topic http://www.rimweb.in/forums/index.php?showtopic=4555

After installing the above program restart your system and run it in Safe Mode. Now run the Complete System Check and follow the instruction, which u get.

For a firewall Download the Sygate Personal Firewall

For checking the condition of the Hard disk as u say about Bad Sector, to check the Bad Sectors, Start the computer in DOS mode and run the following command

c:\scandisk\all\nosave\autofix\surface

and press enter.

Please also check the Device Manager for the Hardware Conflict. Right click on My Computer and Check whether u have any Unknown Device option or a device is marked by a Question Mark sign. If yes, then try to install this device again.

Share your experience with us for more help!

Thanks and Take Care!

[drali 6]

Hi DRALI2!

Try one thing before doing reinstalling, it may solved your problem.

thanks buddy,but one thing more to inform u that now it shows error msg- Y pager has performed an illegal operation and will be........................

and also tell me how to scan H.disk in DOS mode(step by step plz)

Edited October 14, 2005 by drali2

[cracker 0]

chk ur inbox download any antivirus

it will solve ur problem

[RajanPERT 0]

@Drali2!

To run the Scandisk, take following steps.

Restart ur system in MS DOS mode (For this click on Shutdown, and u will get that option) and type the following command on DOS prompt.

SCANDISK/SURFACE/AUTOFIX/NOSAVE

and press enter and follow the Coming Steps.

For other help. I want HijackThis Log file again. Please attach it as attachment so i can download it for further diagnoses. But before running the HijackThis u need to extract the content of the Zip file to Program Files folder. You have to run HijackThis from program files folder.

(First uninstall the following before running HijackThis, 1. Norton Antivirus. 2. VirtuaGirl2, 3. Delete the Internet Explorer file (C:\EXPLORER.EXE) present at DRIVE C, 4. If possible delete the Google toolbar also.)

Here is a simple advice as u told in ur post that u purchased this system just about three months ago. That means, this system is under warranty. Simply, Call your assembler for Help as u don't have much knowledge of Computer.

Regarding Yahoo problem, It may be a RAM problem also, as ur program starts illegal problem. First try to reinstall the Yahoo Pager and tell me whether problem solved or not.

Waiting for your response!

Thanks and Take Care!

PS: CRACKER, Please share your valuable Antivirus's download link and name with us also. (Please post it here not to there inbox.)

EDIT: Error correction!!!

Edited October 15, 2005 by Rajanpert

[cracker 0]

sorry Rajanpert i can't post those links here coz warez is banned in rim web

if u want i'll inbox u those links.

mcafee 2005,2006

norton 2005,2006

pc-cillin 2005

nod-32

[Utsav 0]

Rajan! Explorer.exe is the default browser for Windows! Never try to delete it even in the DOS mode! Internet Explorer id C:\Program Files\Internet Explorer\iExplore.exe. If the IE6 is loaded it has got an auto-repair facility which can be triggered from Add/Remove Programs of Control Panel.

To reinstall the main browser for Windows (i.e. Explorer.exe) you need to run SFC and extract explorer.exe from the installation disk. You'll be prompted to reboot after the process.

[RajanPERT 0]

Rajan! Explorer.exe is the default browser for Windows! Never try to delete it even in the DOS mode! Internet Explorer id C:\Program Files\Internet Explorer\iExplore.exe. If the IE6 is loaded it has got an auto-repair facility which can be triggered from Add/Remove Programs of Control Panel.

To reinstall the main browser for Windows (i.e. Explorer.exe) you need to run SFC and extract explorer.exe from the installation disk. You'll be prompted to reboot after the process.

44007[/snapback]

It was my mistake. File, which i want to remove, is present on the C:\ and its name is

EXPLORER.EXE. (i.e. c:\EXPLORER.EXE). BTW thanks for correction.

Thanks and Take Care!

[Vishal Gupta 4]

Actually there is no need to repair the Explorer.exe using sfc.

The explorer file is alright.

The problem is with nother explorer.exe file (may be spyware) residing in C:\drive directly.

My suggestion is:

D/l AVG anti virus, its free :

D/l Zone Alarm firewall personal edition, also free.

D/l LavaSoft Ad-Aware SE Personal

And fully scan ur system.

It should solve ur problem...

[Utsav 0]

If there is explorer.exe under C:\Windows then C:\explorer.exe can be deleted directly. Virus checking and Spyware/Adware checking after periodic intervals is a must for every machine. Don't forget to update your anti-virus as frequently as possible to keep the database updated.

[RajanPERT 0]

@Utsav!

Yes! u r right and Drali2 has two files of same name at diffrent location under c:\ and program files. So i advice him to delete the file EXPLORER.EXE from C:\.

@Vishal!

Thanks for LavaSoft Ad-Aware SE Personal link.

Thanks and Take Care!

[drali 6]

thanx-thanks-thanks

now i want to thanks all the experts for their valuable support .now one thing more to inform u all ,that there was some DUST in my RAM slot.which was d main culprit(possibly).still i have install winXP SP-2 with pcillin antivirus.its working fine now but speed slightly compromised as its P-III 800,128 RAM.

can experts suggest some thing more for better performance.

thanx in advance.

[Utsav 0]

Best thing is to Upgrade...

I mean CPU+Motherboard+RAM but I think that would cost as much as Rs.10,000/- for a good configuration. You may increase the RAM at this ponit but I believe you have slots for only SDRAM and not DDR and SDRAMs are really expensive nowadays. If you can manage a good 128MB SDRAM from a pal, that would give you the best performance for your PC.