PC Pals Forum
Technical Help & Discussion => Windows PCs & Software: Help, News & Discussion => Topic started by: johnson120 on February 04, 2004, 21:28
-
Hi Everyone,
I'm new here and desperate for some help.
When I use IE and am typing text in a search engine or a forum just as I am doing now, the text appears really slow. I type the characters and then sit and wait for them to appear on the screen. It can take up to 5 minutes sometimes for the screen to catch up. It only happens when I am online and no one seems to be able to help. I have checked all connections and tried using a new keyboard. I have run first aid and nuts and bolts. :'(
I am using windows me and connect via broadband. I thought changing to broadband might solve the problem as it has a faster browsing spped but it did not help.
I would be really grateful for any help as it is doing my head in. ???
Many thanks.
-
The first thing I would do is to download and run Ad-Aware to see if you have any trojans on your machine. Once you have cleared those out update your anti-virus software and run a full scan. If that doesn't sort it out then check to see if anything else untoward is running in the background by pressing Crl/Alt/Del once.
-
I know it might be an elementary question, Johnson, but are you emptying your internet files and history regularly. I also have WinME and I find that,it sometimes happens when I am on the net. It's usually a memory thing as I am maybe surfing and downloading at the same time. It is particularly bad when I am on MSN.
-
Hello.
Thank you for your speedy replies. :o
I do run ad aware regularly and AVG virus scan.
I also clear my internet files usually after every browse as this has been suggested to me in the past.
As far as ctrl alt delete goes I have loads of stuff running in the background. I am unsure what I can get rid of an remain safe while browsing. I know I need systray and explorer but in the past I have had two nasty viruses and do not know what to close down in order to browse safely.
I am a bit of a thicko when it starts getting technical.
That could be the problem as I know that some of my programmes will not run unless I shutdown everything except systray & explorer.
Thanks for your advice so far. If anyone knows what I need to keep open for safe browsing I would be very grateful. ;D
By the way. What a great site with great peeps. :)
-
You can find a complete list of start up programs here:
http://pc-pals.com/index.php?board=33;action=display;threadid=442
But if you wait a while, one of our techies will be along to give you some proper help.
-
It would seem Johnson that it's definitely memory related. Some antivirus programmes can use up your memory especially if you have it set to kick in with Task Schedular at certain intervals. Check Task Schedular and disable some of the tasks, that might also help. :)
-
wow. ;D
THank very much.
I will try your ideas right now and let you know how I get on later.
Thanks again. I really appreciate your time.
-
Is it all sites, or just some? I find that typing anything on the "Friends Reunited" website can be very slow. Interestingly, it is the only website I have to use Internet Explorer to view. I use Opera for all other sites, and the slow typing problem never appears.
-
HI,
-
Hi johnson120,
If you do Ctrl+Alt+Del and click the Processes tab, you'll possibly find something is using up to 100% of your CPU resources, in which case, that would be your problem. If you find something doing this, and tell us what it is, we can advise further. I can almost guarantee that if something is using up that much of your CPU, it shouldn't be there, or is not working correctly. Can you also tell us which browser you are using?
-
Hi,
Sorry do not know what when wrong with last message.
It happens on nearly all websites but is worse on some than others. I do not know what opera is ???? :-[
I am using Internet Explorer.
I tried cntrl/alt/delete but could not see processes tab ????
It had a list of programmes and option to end task shutdown or cancel ?? :-[
I must admit that I have just checked my ad aware and it was very out of date. I have updated it and removed 30 files.
I have also tried shutting down some of my background programmes using ctrl/alt/delete and it seems to have made a bit of difference already.
Thanks for the help so far everyone. ;D
A big ((((( Hug ))))) to you all.
-
This (below) is the Processes tab in XP. I had assumed it is the same in ME? ??? Anyway, if you have now updated Ad Aware, and removed some, or all, or your spyware, that should help. Have you also updated your Anti Virus software? If it's out of date, it's almost not worth having it. We generally advise that you should update your anti virus software at least once weekly, if not every day, especially when there are things going round like the 'My Doom' virus. :)
-
I dont think 98 and ME have as much detail in task Manager as XP does Simon, but it should still show the apps that are running and total cpu usage :)
-
Could be a few things but two that spring to mind:
1. Hijacker that hasn't been caught yet.
Download and run Hijackthis from tomcoyote.org/hjt/ (http://tomcoyote.org/hjt/), do a scan and post the log here. We can then have a look at it and see if there is anything untoward.
Probably worth running Coolwebsearch shredder from http://www.spywareinfo.com/~merijn/downloads.html (http://www.spywareinfo.com/~merijn/downloads.html) first as one of the main symptoms of that spyware was Massive IE slowdown, especially when typing text into forms
2.The explorer autocomplete problem
http://support.microsoft.com/?kbid=251787 (http://support.microsoft.com/?kbid=251787)
What happens is whatever you type in a form is checked against the autocomplete values that explorer keeps. If the explorer file gets corrupted then it slows down text entry. You also get problems running Outlook.
-
Hi all,
Things are definately getting better. I updated my adaware again today and it found another 37 objects some of which reported as possible hijack attempt on browser. :o
I run the coolweb shredder and it removed some items from my drives.
I ran hijack this scan and here are the results
Logfile of HijackThis v1.97.7
Scan saved at 14:14:45, on 06/02/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\NOKIA\NOKIA PC SUITE 5\DATALAYER.EXE
C:\PROGRAM FILES\COMMON FILES\NOKIA\NCLTOOLS\NCLTRAY.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\CREATIVE\AUDIO\PROGRAM\CTMIX32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\PROGRAM FILES\CREATIVE\NEWS\NEWSUPD.EXE
C:\PROGRAM FILES\COMMON FILES\NOKIA\SERVICES\SERVIC~1.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\SCANSOFT\PAPERPORT\PPWEBCAP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERVIDEO\COMMON\BIN\WINCINEMAMGR.EXE
C:\PROGRAM FILES\CCONNECT\CCONNECT.EXE
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 MY CUSTOM EDITION\CALCHECK.EXE
C:\PROGRAM FILES\2400CU PLUS\DRIVER\WATCH.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\PROGRAM FILES\NOKIA\PC SUITE FOR NOKIA N-GAGE\CONNMNGMNTBOX.EXE
C:\PROGRAM FILES\NOKIA\PC SUITE FOR NOKIA N-GAGE\ECTASKSCHEDULER.EXE
C:\PROGRAM FILES\NOKIA\PC SUITE FOR NOKIA N-GAGE\ELOGERR.EXE
C:\PROGRAM FILES\INTUWAVE\SHARED\MROUTERRUNTIME\MROUTERRUNTIME.EXE
C:\PROGRAM FILES\NOKIA\PC SUITE FOR NOKIA N-GAGE\BROADCASTPROXY.EXE
C:\WINDOWS\SYSTEM\E_S10IC2.EXE
C:\PROGRAM FILES\NOKIA\PC SUITE FOR NOKIA N-GAGE\SCRFS.EXE
C:\PROGRAM FILES\ULTIMATEZIP 2.7\UZIP.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/Default.asp?Ath=f
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\msinfo.exe
O1 - Hosts: 645238813 auto.search.msn.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Infra Manager] C:\Program Files\Creative\Infra\CtInfra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Internat Conf] C:\WINDOWS\SYSTEM\bootconf.exe
O4 - HKLM\..\Run: [Register MediaRing Talk] C:\Program Files\MediaRing Talk\register.exe
O4 - HKLM\..\Run: [ServiceLayer] C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE /t
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRAM FILES\SCANSOFT\PAPERPORT\PPWebCap.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O4 - Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
O4 - Startup: Watch.lnk = C:\Program Files\2400CU Plus\Driver\WATCH.exe
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: PCSuiteForNokiaN-Gage Detect.lnk = C:\Program Files\Nokia\PC Suite for Nokia N-Gage\connmngmntbox.exe
O4 - Startup: PCSuiteForNokiaN-Gage TS.lnk = C:\Program Files\Nokia\PC Suite for Nokia N-Gage\ectaskscheduler.exe
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: AIM (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37921.5051736111
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: Yahoo! Chat 1.3 - http://cs5.chat.sc5.yahoo.com/c174/chat.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} (AV Class) - http://www.pcpitstop.com/antivirus/PCPAV.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O19 - User stylesheet: C:\WINDOWS\default.css (HKLM)
I noticed that there are some paths relating to a lexmark printer. This printer was removed ages ago and the software uninstalled. ???
Hope I have done this right. :-[
Thanks once again for all your help and attention. ;D
-
Hi!
You've still got some bits of coolwebsearch infecting your system :(
Did you ensure you had all explorer windows closed before running it?
Probably worth you running it again (some infections are quite persistant)
After running again if you run HJT and have a look for any of these that are left as these are the ones requiring fixing.
F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\msinfo.exe GLOBAL FINDER/Coolweb Hijacker
O1 - Hosts: 645238813 auto.search.msn.com Ditto
O4 - HKLM\..\Run: [Internat Conf] C:\WINDOWS\SYSTEM\bootconf.exe CoolWebsearch
O4 - HKLM\..\Run: [LexStart] Lexstart.exe Left over printer bit
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe Left over printer bit
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN Left over printer bit
O4 - Startup: PowerReg Scheduler V3.exe another bit of Spyware
O19 - User stylesheet: C:\WINDOWS\default.css (HKLM)Coolweb again
BTW the software that is installed with your soundcard is classed as spyware (the NewsUPD program). It downloads adds to your machine.
To uninstall that application run it's uninstall software, cut and paste this command into your start->run window
C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\News\CTNews.isu"
-
Hi, ;D
I have run Coolwebsearch again twice. It now says that my system is clean. ;D
I have fixed the left over printer bits and got rid of the spyware. ;D
I tried to run the above command C:\windows\isuninst.exe etc
and got an error message that this file could not be found and uninstaller would therefore close. I tried three times and got the same each time.
I Also ran msconfig and unchecked lots of bits that do not seem to be needed most of the time. Things like scanner and nokia functions kodak software etc. I can open them when needed.
I am typing this and it is appearing instantly on the screen. ;D ;D ;D ;D ;D ;D ;D
Yipeeeeeeeeeeeeeeeeeeeeeeee :D
Big thank you's to everyone who has helped me with this issue. I have been trying to reolve this problem for ages.
-
Glad you got it sorted, Jackson. It's surprising the junk that your pc collects over time. I thought it would be a memory thing. :D
-
That's great news Johnson. You may be interested to know that most spyware arrives on your computer in the form of cookies. I've downloaded a small piece of software called CookieWall which enables you to reject (or accept) cookies. Since I did that (over 3 years ago) I have not had any spyware at all on my machine. If you decide not to go down that route, you should run Ad-Aware or another spyware removal tool fairly frequently to keep clearing them out.
-
Of course, you don't need Cookie Wall now you have Mozilla, Clive. ;)
-
Is there no end to Mozilla's capabilities. ::)
-
Funny you should say that but I hadn't realised I'm no longer receiving any cookies! I also love the pop-up stopper. It's a brilliant piece of software isn't it?
-
You are still receiving cookies, Clive, otherwise PC Pals wouldn't work, but the Cookie Manager in Mozilla allows you greater control over the cookies accepted. ;)
-
Thanks again to one and all for your help.
What a great site you have here. Invaluable especially for peeps like me.
-
That's great news Johnson. You may be interested to know that most spyware arrives on your computer in the form of cookies.
Um...no.
Most spyware tends to be from drive by installs due to Explorer errors (it's how I got my first hijack a few months ago - It was the byteverifier java bug that installed some software which then proceeded to download some spyware, set home page and added lots of dubious sites to my favourites. I then rev-enged the file and sent the results off to the spywareinfo people). After installing spybot (including the helper app), and keeping regular updates to explorer, I haven't been caught since.
Alternatively you can get it through installation of software that has a spyware component e.g. DIVX (with Gator), Kazza etc.
@Johnson120
Glad to have been of help.