Topic: Need help with memory / hard drive problem

[thegallery]

This last week my HD light on my M1200 Motion Tablet PC started flickering about every second and it doesn't stop. I can also hear the HD spin slightly every second with the light flicker. Within in a few minutes I have a huge lag in performance. Not to mention that the pulsating HD light and spin are driving me crazy!

I have 768mb of ram, I've tried removing some of it, thinking the ram could have a problem. I have scanned for viruses, scanned for spy ware, cleaned the disk, removed everything from startup, defragmented, and even run XP's version of Scan Disk. I got rid of all the files I could, cleaned up the desktop, even tried Ram Booster, and the problem is still here. I also played with memory settings to no avail.

If I look at the running processes I see a couple of svchost.exe programs running and the "system idle" taking up the bulk of anything happening at any time. Every second, in sink with the HD light and spin, these processes are jumping around using various amounts of "CPU".

Any ideas what the problem could be? I'm sure to be calling Motion support on Monday, and will spend tomorrow backing up my system while I still can. But if any of you have some thoughts I'd greatly appreciate it.  

[Dack]

Try running that hijack this program from:
tomcoyote.org/hjt/ and then cutting and pasting the log here.

It will give a list of running processes that may give a clue as to what could possibly be causing a problem. Sounds like a software and not hardware issue.

Just a quick question/guess - you haven't got indexing switched on the drives have you?

[thegallery]

Thanks Dack. Do you need all of it or just the processes? Sometimes I have up to 5 svchost.exe processes running. 4 system and one local. I have noticed if I stop the local one I do have less 'flickering' of the HD light. Not sure if it is a cure, but it's definately better.

oh, and indexing is off.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Windows\System32\scrdll.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\Common Files\microsoft shared\ink\TPA.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Default\Desktop\HijackThis.exe

[TR]

Thegallery

Look in Start/contol panel/admin tools/event viewer/systemand you should see what is causing the problem and what processes are running err.


Hookstar

[Dack]

Thanks Dack. Do you need all of it or just the processes? Sometimes I have up to 5 svchost.exe processes running. 4 system and one local. I have noticed if I stop the local one I do have less 'flickering' of the HD light. Not sure if it is a cure, but it's definately better.

oh, and indexing is off.

Best bet is to show the full list as that gives a load more information that may be useful and can also show if programs are not really in their correct place

From the list so far I guess you've got DvdXCopy, a Tablet PC, run win 2000,  have multiple monitors support and have Visual studio 7 installed (apparently MDM can cause a lot of problems).

[thegallery]

I'm not sure about DvdXCopy, or win 2000 (it's XP pro Tablet PC edition),  I do have an external monitor. I also don't know about Visual studio 7 or MDM? Here is the whole log. As a work computer I do my best to avoid x-rated sites, so unless things came through spam email I don't know where some of this info is coming from. I have already run adaware, spyware, and tried three different companies up-to-date virus scans. I'm definately seeing vastly better performance killling off the svchost.exe local. My guess is that process is where the probblem lies.

Logfile of HijackThis v1.97.7
Scan saved at 12:22:42 AM, on 11/23/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Windows\System32\scrdll.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\Common Files\microsoft shared\ink\TPA.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Default\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://thesten.com/main/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://thesten.com/main/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://thesten.com/main/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://creativearts.com/mom
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://thesten.com/main/sp.php
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\57d1amen.slt\prefs.js)
O1 - Hosts: 66.40.16.131 livesexlist.com
O1 - Hosts: 66.40.16.131 lanasbigboobs.com
O1 - Hosts: 66.40.16.131 thumbnailpost.com
O1 - Hosts: 66.40.16.131 adult-series.com
O1 - Hosts: 66.40.16.131 www.livesexlist.com
O1 - Hosts: 66.40.16.131 www.lanasbigboobs.com
O1 - Hosts: 66.40.16.131 www.thumbnailpost.com
O1 - Hosts: 66.40.16.131 www.adult-series.com
O2 - BHO: (no name) - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\mathies.com\PopThis!\PopThis.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\Program Files\Popup Manager\PopupMgr_1.0.1.5.dll
O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\PROGRA~1\POPUPP~1\PopLib.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)
O9 - Extra button: PopupPopper Control Panel (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: PopThis! Options... (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O10 - Unknown file in Winsock LSP: c:\program files\spamfighter\proxy\proxy.dll
O10 - Unknown file in Winsock LSP: c:\program files\spamfighter\proxy\proxy.dll
O10 - Unknown file in Winsock LSP: c:\program files\spamfighter\proxy\proxy.dll
O10 - Unknown file in Winsock LSP: c:\program files\spamfighter\proxy\proxy.dll
O10 - Unknown file in Winsock LSP: c:\program files\spamfighter\proxy\proxy.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://officebeta.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/0fb5e03023def1/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {763C10EE-E4C6-49AA-9325-F15ABF1C52B0} (X1 DownloadControl Class) - http://www.x1.com/download/X1WebInstall.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://zinio.earthc.net/images.zinio.com/reader/isetup.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4018/ftp.coupons.com/v3122/cpbrkpie.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

[Dack]

Well you've had a variant of coolwebsearch installed at some time (the Hosts entries).

Worth running this http://www.spywareinfo.com/~merijn/files/cwshredder.zip

The GEarsec.exe is related to burning CDs etc. and tends to come installed with lots of software - dvdxcopy being one.

The MDM.exe file is the machine debugger that was probably installed with office and is used for script debugging.

The main concern would probably come from the

010 - Unknown file in Winsock LSP: c:\program files\spamfighter\proxy\proxy.dll

Messages as that would seem to fit in with your symptoms/slowdowns. Have you installed Spamfighter at some point? And if so try unisntalling and re-installing as it looks as though either it didn't clean itself properly or didn't install itself correctly.

The other thing I noticed was you seem to have X1 installed which would be trying to index documents on your hard drive.

[TR]

I'm glad thats not my HJ list, my missus would kill me  

[Michelle]

hehe    

yeah but its amazing what you can get into on a search for stuff.  

[thegallery]

Dack, you hit the nail on the head. It was the SpamFighter software. It's a real disappointment because it worked very well on spam in Outlook Express. I'm too frightened to reinstall it again. I'm not sure how one program would have caused me so much hassle, but I'm glad you found the answer, and I much appreciate everyones help.

Any recommendations for another spam program? I have had the same domain for years and in the early days I didn't worry about signing up for things, etc. I now get about 400 emails a day of which maybe 10 I'm actually interested in. It's a whole separate topic, but I'm getting buried. I'm worried I'll have to move to a new host who might offer easy server based spam filtering. Making a move will be a nightmare though, and finding the right host will be equally as tough.

[Sandra]

Glad to hear that you got it sorted.
I think that most people on here use "Mailwasher" the link to it is here :

http://www.mailwasher.net/

I hope that this helps  

[Adept]

Another really good one is SpamPal. It is slightly more difficult to set up than MailWasher, but once it is set up, you don't notice you are using it, apart from the lack of Spam in your mailbox.

I recommend that you also download the Bayesian Filter Plugin, which makes SpamPal's detection even more accurate

[Simon]

The trouble with Mailwasher, good as it is, is that the new version only allows you to use it for one e-mail account.  To use MW for multiple accounts, you have to pay to upgrade to the Pro version.

I have found another one, which is free, which I am about to try out myself, so it would be interesting if anyone else wanted to also try it.  http://poptray.org/

Please note, I have yet to try this software myself, so I do not know if it contains spyware![/color]

[Adept]

If you are going to be trying alternatives to MW, give SpamPal a try Simon and let us know what you think.

As I said above, don't forget to download the Bayesian Filter Plugin at the same time

[Simon]

I think I tried SpamPal before, Sean.  I have downloaded and tried PopTray, but unfortunately I have yet to find a way to get it to work with Mozilla Mail.  That is, launch the mail program once mail has been pre-checked.  I seem to recall that the reason I didn't use SpamPal was because I really don't get all that much in the way of spam, and I don't have a problem with Mail Washer, as I have the Pro version, but as I can't remember it, I'll have another look.