XP Pro Problems

Slink,

Have you tested the machine not going to internet atall and does it work fine ?  Run this
http://www.snapfiles.com/get/processexplorer.html
and check if any process unknown to you is running .. That can give some clue

Check for unwanted starting services and disable them
http://www.blackviper.com/WinXP/servicecfg.htm


>>  Is there some new XP virus out there that the virus software companies have not been able to combat?  Any other suggestions?

Not sure if you had run this
http://vil.nai.com/vil/stinger/  - this should check for all latest viruses


I can suggest some more on your response

SR

Results:

Stinger - clean
Process Explorer (after running the SVC Config and making it look somewhat like the suggestions) questionables are BDSS.EXE and WFXSWTCH.EXE.  It seems that BDSS may be virus related and I believe WFXSWTCH to be related to the Winfax software I have installed.
SVC Config showed
   NS_Service_3 - Network Security Service which is questionable, I didn't mess with this one.  It is not started but is set to Automatic.
   Peer Networking entries - four different

Any ideas?

Check out abt bdss.exe : http://www.reger24.de/prozesse/bdss.exe.php

WFXSWTCH.EXE looks like Norton winfax software

You may also want to post the log from Hijackthis for experts to view
Hijackthis : http://www.spychecker.com/program/hijackthis.html

So do you see any difference atall when you unplug the machine from internet ? Does it work fine or same state ?

SR

It is sporadic.  I haven't seen it happen since I made those changes.  It may take a few days.  I have run HijackThis before and removed stuff related to DOWNLOADER trojans.  I will look into BDSS and will post a HijackThis log if it happens again.  If it does not happen this week I will close the question.

slink9,

Thanks

SR

No need to wait.  It just happened again in the middle of my online session and it disconnected from the ISP and nothing would start.  I tried to start pinball and it just fired up after five minutes or so.  The dialup connection became active before the pinball game started but for the minute or so before it disconnected again there was no indication of activity on the computers.  It has reconnected but there is still no indicator of activity.

HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 7:51:41 PM, on 7/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\Norton SystemWorks\WinFax\WFXMOD32.EXE
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\NORTON~1\WinFax\WFXSWTCH.exe
C:\WINDOWS\System32\wfxsnt40.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\ibmtools\aptezbtn\aptezbp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\ibmtools\aptezbtn\rakusb.exe
C:\Program Files\SmartDisk\FlashPath\sdstat.exe
C:\Palm\HOTSYNC.EXE
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\download\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wral.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ripline.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ripline Internet
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\NORTON~1\WinFax\WFXSWTCH.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: FlashPath Monitor.lnk = C:\Program Files\SmartDisk\FlashPath\sdstat.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37913.1715972222
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4326400-F839-477D-8362-17A892BBF50B}: NameServer = 65.174.122.5 205.244.200.3

Any idea what the last entry is?  I have removed it before but it keeps coming back.  I don't recognize the IP address.

Not sure about this

C:\WINDOWS\System32\WFXSVC.EXE
C:\WINDOWS\System32\wfxsnt40.exe


The last entry doesnot seem to be a valid IP address so let us see removing it would make any difference

SR

Slink,

When I use  a static IP address at my work place , I give the DNS server info primary and secondary and that is what get listed as the last entry in the hijackthis log. I would guess it is same for you and I donot think it is a bad one

SR

Could this be related to my phone line erroring out and the modem trying to do error correction?  I am guessing here since it keeps disconnecting.  I just logged on, got my email, went to this question, and it dropped the line.

Slink,

As you suggest , it looks more to me as a modem issue than OS .. Have you tried to reinstall modem drivers , check with phone people about the phone line and reinstall any software related to it ?  

SR

New development.  I just had one instance of IE open and my OL2002.  I was online.  I then tried to open another instance of IE and it would not go.  I also tried to open pinball.  No go.  Two minutes later I get an email notification that you posted in this question but still no second IE or pinball.  Approx a minute and a half later both lights blink on the modem indicator but still no more programs started up.  In another two minutes or so my second IE and pinball start.

It appears that the phone line and communications were working fine the whole time since the email checked itself while I couldn't start any other programs.  Is there any known issue of this type with ICS?  That is all that I can think of that may be affected by being online and cause system problems also.

This is weird!!!!!!

To corner on whether modem is creating the issue here, can you connect to any other internet connection like cable or DSL.. I assume when you say modem ,you are using dialup ...I have never got troubles with ICS because most of the time i disable it and use Zonealarm...

I am not sure if you saw my question earlier. not being online , is your system stable with no issues atall ?

SR

I can't really tell about not being online since this is sporadic and most of what I do is online.

Nope.  No other type of internet connection available, dial-up is it.

It happened first thing this morning.  At 8 am I flipped on my system and it dialed up.  I tried to start OL and it would not.  I then started pinball and it didn't.  Between then and 8:06 I was able to turn off ICS and ICF and disconnect the dial-up connection (none of this happened immediately but with pauses between the action and result).  At 8:06 my OL2002 and pinball started.

I am now connected without internet sharing and internet firewall.  I will wait and see how this goes.

Update.

I just spent almost four hours working on my latest book - "Are You Certifibale?" on Office certification.  During this time I was not online and did not have Outlook running since I have completed the Outlook section already.  I did not have a single instance of system freeze-up.  I had Snag-It, Access 2002, and Word 2002 (with a now 70 page document) running and did screen captures and switched between programs without a single problem.

This does not really indicate anything since this problem seems to be quite sporadic but it is still interesting that over three and a half hours of time not online there was not a single problem.  I would attempt to stay online for three hours without actually using it but my internet line is also my business line.  I may try that tonight, though.

Slink,

I think not having problems during the 3 hr period when you were online clearly says that it has to do with going online that is internet connection ..

It would surprise if you get any issue (system hangup) even when you are not online .. Post back howit goes after testing tonite

SR

I also run BitDeffender... The problem you describe is the same as what i ran into when i first started useing BD. My fix was to customize what BitDeffeneder scans automatically to typical file extensions. This should keep the scan from bogging down your system. Whatever you do dont turn its service off.. otherwise you will have to reinstall the program to get it to work correctly.. BitDeffender monitors all of its snap-ins. there are a fer more settings you can alter such as its firewall snapin.. i'll keep an eye in this post. hope its helps

also sometimes an overkill of virus programs will hurt eachother.. cus they all try to take priority over all other processes. so try picking one virus scanner and one spyware scanner. then practice smart surfing; monitoring how you surf the web

This was happening before Bitdefender was installed, although I now can't start the bitdefender services.

I believe this has now been tracked down to something to do with ICS.  I had it disabled and ran OL and stayed connected to the internet.  It was fast and I had no system dropouts or internet slowdowns.  When trying to re-enable ICS I had problems and ree-enabled some services I had disabled according to the SERVICECFG link.  I had uninstalled and reinstalled ICS before doing this.  maybe it is fixed now.  I will play with it for a few days and see if all is well again.

Thanks.  Time to go fishing ...

Post back when you get time

SR

I am back from fishing with a couple of decent bass as my catches.  I now have ICS and ICF turned back on and have had no problems as of yet.  My son just checked the email on one of the other systems so it is working.  I am going to get a rather large download going and see how well it goes.  Tomorrow evening I will hopefully be satisfied with this thing and close it.

OK slink.. Will keep watching

SR

I have been downloading XP SP2 now since 8 pm with no disconnects.  I thought the download speed had almost doubled but it is back to 4k per sec.  I will let my kids and my wife get on today (on their systems) and see how things go.  So far so good.

Are you downloading the release version of SP2 or pre-release ?

SR

Pre-release.  Is the release available?  I just wanted a large download and thought it would be interesting to have.  After reading about a few things that it could break I may not apply it until the release version is available.

No release not yet available only pre-release.

The only problem with respect to pre-release is that you might have to wait for the actual release to get this pre-release uninstalled or reinstall the OS. Few people here in EE wanted to remove SP2 (i donot remember the reason) ..

I guess you can wait for the release cos the release is mainly going to have updates, fixes which you can anyway get going to windowsupdate page

SR

Here is an interesting new development.

It did not disconnect until I started testing for COM ports with my ActiveSync software when it didn't see my USB connected IPAQ.  That was expected.  I was using the Sun Download Manager to download XP SP2 so I reconnected and restarted the download.  Still no problem.  While the download was going and the dial-up computers were solid I could not start pinball or task manager but I could still check my email.  Apparently this is still not fixed.  It still sounds like it could be related to ICS.  Any suggestions other than ditching ICS and finding other internet sharing software?

Believe me, if I could get DSL and use it instead I would.  That and cable are not available to me.  I believe DSL may soon be since it is available about a mile away from me (but on another road if that makes a diff).

Neither of those would seem to address this problem.

It is not just task manager and pinball.  I use them because they are easy to start.  I have started another connection to the internet, Internet Spades, Word, and others.  It may just be something I will have to live with.

Another interesting development.

I am currently in the middle of one of those five minute system "freezes."  Except the system is not frozen.  I was viewing a MS security document (206 pages which I need to digest for an interview tomorrow) and my cursor went to an hourglass and I cannot move within that PDF document.  I then tried to start task manager to see what was going on and it just (finally) popped up.  To prove that the programs I am trying to start are not an issue I tried to start Notepad and Calculator and they have also started now.

I currently have 47 processes running, cpu usage of 6-7%, and a commit charge of 271M/1606M

I have:
Winword taking up 20,724k
Outlook at 18,240k
SVCHOST at 12,568k
IExplore at 11,278k
AcroRD32 at 10,404
I also have another IExplore at 8,520k

Any more ideas and suggestions?

May be i should go through all the comments and suggestions here to suggest you something new. I shall also bring your issue to the attention of other xp experts ..

Well could you tell me if this issue happens (i mean freezing) only when you are connected to internet or even without it ..

SR

It seems to be only when connected.  I worked on the book for over three hours while unconnected without a problem.  It is extremely weird now that the only thing prevented is the starting of new programs (and the program that was active when it disconnected).

It also seems to happen only with the establishment of a new dial-up connection.  I had quite a few programs running and it disconnected and reconnected.  Then I could not use the PDF file (at the foreground when disconnected and reconnected) and could not start new programs but I checked email and posted in this question while these others were affected.

I have called the phone company to get the line checked out.  They said it would be by 9:15 today but I don't believe that happened.  I am guessing by Monday morning.  Maybe they will find a problem with that and I will close the question.

I now have the phone line fixed and have had no problems with disconnects even though the phone guy said he couldn't find any problems.  I am still having problems with the sporadic five minute pauses.  Any more ideas?  If not, I will close this one and live with the other problem.

sorry Slink that we were not able to solve the entire problem.
Thanks for the pts tho

SR

I have been experiencing the same problem.  I have two PCs (main and home theater PC), dial-up on main, ICS active (on main).  

I had found that if I disabled McAfee Personal Firewall prior to using dial-up, I did not have the problem as often.  Disabling Virus Scan helped even more.   The version I had was incompatable with ICS.  I just installed newest version of McAfee suite and am having the problem again.  I suspect that it has to do with having two competing firewall programs on the same box.  

Hello, I found your old thread regarding system "droping out".  I refer to it as going on vacation.  I have been dealing with this same issue for two years.  I have a similar system.  XP Pro SP2, Celeron processor. 256Kb RAM, 80Gb harddrive and CD RW.   I have taken to starting the task manager as soon as I boot and find that when programs do not appear on the monitor they are actually listed in the processes list.   I have uninstalled WinFAx but continue to have this problem.   Do you also find that after the 2 - 5 minutes everything you tried to open suddenly opens and you have as many windows of it as you made requests.   Perhaps by now you have either repaired your problem or junked your computer.  These minutes really add up.