memory loss

[Randy]

My pc memory is drained to a point where my desk top
doesn't even work. This is any time my pc is left on in
normal mode. Not necessaryly online. Have to reboot to
gain back memory. Help!

Randy

[Steve Baron - KB3MM]

How are you judging that ?

"Randy" > wrote in message
...
> My pc memory is drained to a point where my desk top
> doesn't even work. This is any time my pc is left on in
> normal mode. Not necessaryly online. Have to reboot to
> gain back memory. Help!
>
> Randy

[John]

I have the same problem - plenty of RAM but over time it
runs down. Am using Dachshund "Hare" software with mem
doubler to defrag the RAM which helps. Can't find any
trace of a virus - but something is running in the
background! Running scandisk results in multiple re-
starts, and a message that "another programme is writing
to disk - close other programms" even though nothing is
running! Defrag also takes anything up to an hour to
complete, with a 40GB hard drive 40% full!

ANY ideas welcome! (My ultimate solution may be to spend
out on a new hard drive and XP!

John.
>-----Original Message-----
>How are you judging that ?
>
>"Randy" > wrote in
message
...
>> My pc memory is drained to a point where my desk top
>> doesn't even work. This is any time my pc is left on in
>> normal mode. Not necessaryly online. Have to reboot to
>> gain back memory. Help!
>>
>> Randy
>
>.
>

[Rick T]

John wrote:
> I have the same problem - plenty of RAM but over time it
> runs down. Am using Dachshund "Hare" software with mem
> doubler to defrag the RAM which helps. Can't find any
> trace of a virus - but something is running in the
> background! Running scandisk results in multiple re-
> starts, and a message that "another programme is writing
> to disk - close other programms" even though nothing is
> running! Defrag also takes anything up to an hour to
> complete, with a 40GB hard drive 40% full!
>
> ANY ideas welcome! (My ultimate solution may be to spend
> out on a new hard drive and XP!

Well that's a solution of course, though problems related to computer
usage patterns will resurface, of course.

Try without your memory-defragger running and/or in SafeMode.

Rick



>
> John.
>
>>-----Original Message-----
>>How are you judging that ?
>>
>>"Randy" > wrote in
>
> message
>
...
>>
>>>My pc memory is drained to a point where my desk top
>>>doesn't even work. This is any time my pc is left on in
>>>normal mode. Not necessaryly online. Have to reboot to
>>>gain back memory. Help!
>>>
>>> Randy
>>
>>.
>>

[Steve Baron - KB3MM]

"John" > wrote in message
...
> I have the same problem - plenty of RAM but over time it
> runs down.

How are you judging that?

Am using Dachshund "Hare" software with mem
> doubler to defrag the RAM which helps.

Pure snake oil.

> Can't find any
> trace of a virus - but something is running in the
> background! Running scandisk results in multiple re-
> starts, and a message that "another programme is writing
> to disk - close other programms"

Well, it isn'y lying.

What happens in safe mode ?

even though nothing is
> running! Defrag also takes anything up to an hour to
> complete, with a 40GB hard drive 40% full!

OK

>
> ANY ideas welcome! (My ultimate solution may be to spend
> out on a new hard drive and XP!

Don't think that would help one bit.

>
> John.
> >-----Original Message-----
> >How are you judging that ?
> >
> >"Randy" > wrote in
> message
> ...
> >> My pc memory is drained to a point where my desk top
> >> doesn't even work. This is any time my pc is left on in
> >> normal mode. Not necessaryly online. Have to reboot to
> >> gain back memory. Help!
> >>
> >> Randy
> >
> >.
> >

[Randy]

>-----Original Message-----
>How are you judging that ?
>
>"Randy" > wrote in
message
...
>> My pc memory is drained to a point where my desk top
>> doesn't even work. This is any time my pc is left on in
>> normal mode. Not necessaryly online. Have to reboot to
>> gain back memory. Help!
>>
>> Randy
>
>.Steve, I get a message on my screen that keeps telling
me that I have low memory, not enought to operate the
system. It offers to let me delete all my startup programs
one at a time, but when I do it doesn't help the
situation, I have to manually shut down & restart to use
my pc. If I leave my pc on, the same thing will happen
after a period of time!
Randy
>

[Steve Baron - KB3MM]

"Randy" > wrote in message
...
>
> >-----Original Message-----
> >How are you judging that ?
> >
> >"Randy" > wrote in
> message
> ...
> >> My pc memory is drained to a point where my desk top
> >> doesn't even work. This is any time my pc is left on in
> >> normal mode. Not necessaryly online. Have to reboot to
> >> gain back memory. Help!
> >>
> >> Randy
> >
> >.Steve, I get a message on my screen that keeps telling
> me that I have low memory, not enought to operate the

What program is posting that message ?

Are you sure it says memory and not resources ?

> system. It offers to let me delete all my startup programs
> one at a time, but when I do it doesn't help the
> situation, I have to manually shut down & restart to use
> my pc. If I leave my pc on, the same thing will happen
> after a period of time!
> Randy
> >

[Rick T]

Hi, Randy

How much memory (RAM) do you have installed?

When your PC slows down, type in <Ctrl-Alt-Delete> to pull up the user
taskmanager (CloseProgram Window) and look for something called Winmgmt.


Your Startups can be controlled from the host programs in most cases
(options/preferences) then from Start/Run/msconfig.exe/Startup

http://www.pacs-portal.co.uk/startup_content.php

can give you a hand identifying which of the remaining programs you need.

Have you run any pest-control programs?

free for personal use antivirus tool:
http://www.grisoft.com/us/us_dwnl_free.php

free for personal use spybot/adware detection & removal tools:
http://www.safer-networking.org/
http://www.lavasoftusa.com/


Rick



Randy wrote:

>>-----Original Message-----
>>How are you judging that ?
>>
>>"Randy" > wrote in
>
> message
>
...
>>
>>>My pc memory is drained to a point where my desk top
>>>doesn't even work. This is any time my pc is left on in
>>>normal mode. Not necessaryly online. Have to reboot to
>>>gain back memory. Help!
>>>
>>> Randy
>>
>>.Steve, I get a message on my screen that keeps telling
>
> me that I have low memory, not enought to operate the
> system. It offers to let me delete all my startup programs
> one at a time, but when I do it doesn't help the
> situation, I have to manually shut down & restart to use
> my pc. If I leave my pc on, the same thing will happen
> after a period of time!
> Randy
>

[John]

Running is Safe Mode - same problem but slower. Ran
Scandisk in safemode - took an hour before it reported
that it had re-started 10 times. In that same timeframe
RAM went from 192268IKb to 24184Kb (total available is
261648Kb)
Any suggestions?
JOhn.
>-----Original Message-----
>
>"John" > wrote in
message
...
>> I have the same problem - plenty of RAM but over time it
>> runs down.
>
>How are you judging that?
>
> Am using Dachshund "Hare" software with mem
>> doubler to defrag the RAM which helps.
>
>Pure snake oil.
>
>> Can't find any
>> trace of a virus - but something is running in the
>> background! Running scandisk results in multiple re-
>> starts, and a message that "another programme is writing
>> to disk - close other programms"
>
>Well, it isn'y lying.
>
>What happens in safe mode ?
>
> even though nothing is
>> running! Defrag also takes anything up to an hour to
>> complete, with a 40GB hard drive 40% full!
>
>OK
>
>>
>> ANY ideas welcome! (My ultimate solution may be to
spend
>> out on a new hard drive and XP!
>
>Don't think that would help one bit.
>
>>
>> John.
>> >-----Original Message-----
>> >How are you judging that ?
>> >
>> >"Randy" > wrote in
>> message
>> ...
>> >> My pc memory is drained to a point where my desk top
>> >> doesn't even work. This is any time my pc is left on
in
>> >> normal mode. Not necessaryly online. Have to reboot
to
>> >> gain back memory. Help!
>> >>
>> >> Randy
>> >
>> >.
>> >
>
>.
>

[John]

Rick,

As I said to Steve - running in Safe Mode has the same
problem, but slower. Took an hour to run scandisk and to
report that it had restarted 10 times. RAM went down
dramatically in that time (see earlier response).
Any suggestions welcome!
John.
>-----Original Message-----
>John wrote:
>> I have the same problem - plenty of RAM but over time
it
>> runs down. Am using Dachshund "Hare" software with mem
>> doubler to defrag the RAM which helps. Can't find any
>> trace of a virus - but something is running in the
>> background! Running scandisk results in multiple re-
>> starts, and a message that "another programme is
writing
>> to disk - close other programms" even though nothing is
>> running! Defrag also takes anything up to an hour to
>> complete, with a 40GB hard drive 40% full!
>>
>> ANY ideas welcome! (My ultimate solution may be to
spend
>> out on a new hard drive and XP!
>
>Well that's a solution of course, though problems related
to computer
>usage patterns will resurface, of course.
>
>Try without your memory-defragger running and/or in
SafeMode.
>
>Rick
>
>
>
>>
>> John.
>>
>>>-----Original Message-----
>>>How are you judging that ?
>>>
>>>"Randy" > wrote in
>>
>> message
>>
...
>>>
>>>>My pc memory is drained to a point where my desk top
>>>>doesn't even work. This is any time my pc is left on in
>>>>normal mode. Not necessaryly online. Have to reboot to
>>>>gain back memory. Help!
>>>>
>>>> Randy
>>>
>>>.
>>>
>.
>

[Rick T]

Temporarily, Scandisk can be run in DOS mode from a floppy disk boot, to
(hopefully) fix whatever problem it's having. I'd suggest using the
/SURFACE option this time as well (even though it will take a couple hours).

Windows will automatically use as much memory as it can with various
odds and ends, so "free memory" is a bit of a misnomer. The realistic
method of determining "out-of-memory" behaviour is "by the seat of your
pants", ie: keep an eye on the hard-disk light for cache-thrashing, and
be aware of system slowdowns.

One of the standard causes of system slowdowns and one that does eat
memory is a system process called "winmgmt" which occasionally doesn't
unload after use; when you experience a slowdown, punch in
<Ctrl-Alt-Delete> and check for that task.


Until this is resolved, please disable your memory-defragger from
running; for normal purposes 256MB of RAM is more than enough to run
Windows-ME properly, and it throws another variable into the mix.[1]


Rick
[1] I went to Hare's site... they seem to be more than the usual
memory-defragger... is it possible to easily uninstall it until you can
clean up whatever's causing the slowdown?



John wrote:
> Rick,
>
> As I said to Steve - running in Safe Mode has the same
> problem, but slower. Took an hour to run scandisk and to
> report that it had restarted 10 times. RAM went down
> dramatically in that time (see earlier response).
> Any suggestions welcome!
> John.
>
>>-----Original Message-----
>>John wrote:
>>
>>>I have the same problem - plenty of RAM but over time
>
> it
>
>>>runs down. Am using Dachshund "Hare" software with mem
>>>doubler to defrag the RAM which helps. Can't find any
>>>trace of a virus - but something is running in the
>>>background! Running scandisk results in multiple re-
>>>starts, and a message that "another programme is
>
> writing
>
>>>to disk - close other programms" even though nothing is
>>>running! Defrag also takes anything up to an hour to
>>>complete, with a 40GB hard drive 40% full!
>>>
>>>ANY ideas welcome! (My ultimate solution may be to
>
> spend
>
>>>out on a new hard drive and XP!
>>
>>Well that's a solution of course, though problems related
>
> to computer
>
>>usage patterns will resurface, of course.
>>
>>Try without your memory-defragger running and/or in
>
> SafeMode.
>
>>Rick
>>
>>
>>
>>
>>>John.
>>>
>>>
>>>>-----Original Message-----
>>>>How are you judging that ?
>>>>
>>>>"Randy" > wrote in
>>>
>>>message
>>>
>>>
...
>>>>
>>>>
>>>>>My pc memory is drained to a point where my desk top
>>>>>doesn't even work. This is any time my pc is left on in
>>>>>normal mode. Not necessaryly online. Have to reboot to
>>>>>gain back memory. Help!
>>>>>
>>>>> Randy
>>>>
>>>>.
>>>>
>>
>>.
>>

[Noel Paton]

Just a word of warning here - there is no such thing as a 'good' memory
optimiser for Win ME!
ME has its own optimisation, and the superimposition of another is
guaranteed to cause problems.
Free RAM (as you've already implied) is unused RAM - and as such is best
hung on the wall with the Mooseheads, as it's no use in the computer!

Looking at their 'demo' of the optimiser, all they have done is to move all
applications to the swapfile (and this in XP, rather than a Win9x OS
anyhow) - which will actually slow things down rather than speed them up. It
*may* hel;p you load more programs in XP - but not in ME, where the more
likely limit is imposed by the small resources heap that's available, rather
than the available memory.

In short - it's snake-oil!

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Rick T" > wrote in message
...
> Temporarily, Scandisk can be run in DOS mode from a floppy disk boot, to
> (hopefully) fix whatever problem it's having. I'd suggest using the
> /SURFACE option this time as well (even though it will take a couple
hours).
>
> Windows will automatically use as much memory as it can with various
> odds and ends, so "free memory" is a bit of a misnomer. The realistic
> method of determining "out-of-memory" behaviour is "by the seat of your
> pants", ie: keep an eye on the hard-disk light for cache-thrashing, and
> be aware of system slowdowns.
>
> One of the standard causes of system slowdowns and one that does eat
> memory is a system process called "winmgmt" which occasionally doesn't
> unload after use; when you experience a slowdown, punch in
> <Ctrl-Alt-Delete> and check for that task.
>
>
> Until this is resolved, please disable your memory-defragger from
> running; for normal purposes 256MB of RAM is more than enough to run
> Windows-ME properly, and it throws another variable into the mix.[1]
>
>
> Rick
> [1] I went to Hare's site... they seem to be more than the usual
> memory-defragger... is it possible to easily uninstall it until you can
> clean up whatever's causing the slowdown?
>
>
>
> John wrote:
> > Rick,
> >
> > As I said to Steve - running in Safe Mode has the same
> > problem, but slower. Took an hour to run scandisk and to
> > report that it had restarted 10 times. RAM went down
> > dramatically in that time (see earlier response).
> > Any suggestions welcome!
> > John.
> >
> >>-----Original Message-----
> >>John wrote:
> >>
> >>>I have the same problem - plenty of RAM but over time
> >
> > it
> >
> >>>runs down. Am using Dachshund "Hare" software with mem
> >>>doubler to defrag the RAM which helps. Can't find any
> >>>trace of a virus - but something is running in the
> >>>background! Running scandisk results in multiple re-
> >>>starts, and a message that "another programme is
> >
> > writing
> >
> >>>to disk - close other programms" even though nothing is
> >>>running! Defrag also takes anything up to an hour to
> >>>complete, with a 40GB hard drive 40% full!
> >>>
> >>>ANY ideas welcome! (My ultimate solution may be to
> >
> > spend
> >
> >>>out on a new hard drive and XP!
> >>
> >>Well that's a solution of course, though problems related
> >
> > to computer
> >
> >>usage patterns will resurface, of course.
> >>
> >>Try without your memory-defragger running and/or in
> >
> > SafeMode.
> >
> >>Rick
> >>
> >>
> >>
> >>
> >>>John.
> >>>
> >>>
> >>>>-----Original Message-----
> >>>>How are you judging that ?
> >>>>
> >>>>"Randy" > wrote in
> >>>
> >>>message
> >>>
> >>>
> ...
> >>>>
> >>>>
> >>>>>My pc memory is drained to a point where my desk top
> >>>>>doesn't even work. This is any time my pc is left on in
> >>>>>normal mode. Not necessaryly online. Have to reboot to
> >>>>>gain back memory. Help!
> >>>>>
> >>>>> Randy
> >>>>
> >>>>.
> >>>>
> >>
> >>.
> >>

[Rick T]

Noel Paton wrote:

> Just a word of warning here - there is no such thing as a 'good' memory
> optimiser for Win ME!
> ME has its own optimisation, and the superimposition of another is
> guaranteed to cause problems.
> Free RAM (as you've already implied) is unused RAM - and as such is best
> hung on the wall with the Mooseheads, as it's no use in the computer!
>
> Looking at their 'demo' of the optimiser, all they have done is to move all
> applications to the swapfile (and this in XP, rather than a Win9x OS
> anyhow) - which will actually slow things down rather than speed them up. It
> *may* hel;p you load more programs in XP - but not in ME, where the more
> likely limit is imposed by the small resources heap that's available, rather
> than the available memory.
>
> In short - it's snake-oil!
>

Well I see on their site some 88-bit kernel thing which I'm not even
going to pretend to understand, but as far as moving apps to the
swapfile.... that would be useful for subsequent loads if the WinME
defrag "arrange files so programs start faster" was busted or not used,
and there are more efficient algorithms than the stock M$ one (for
instance arranging multiple dlls sequentially).

Not naysaying you, Noel, but a memory defragger was a must on Win95, and
I'd go out on a limb and say that it'd be useful in WinME with 64-128MB
RAM (higher if the system is left on for any length of time).

Though the Hare product claims not to be a mem-defragger in any event.

Either way, IMHO, the OP's gotta uninstall it until whatever it is
that's broken can be fixed.

Rick

[John]

Have uninstalled HARE - also ran scandisk from boot disk
with surface scan. It took a while(!) but reported no
errors or bad sectors. Restarting and the problem still
exists. <ctrl-alt-del> shows 25 programms running but no
trace of "winmgmt". Would it be useful to list the
programs running? OR is there some other way I can work
out what they are for?
John.
>-----Original Message-----
>Noel Paton wrote:
>
>> Just a word of warning here - there is no such thing as
a 'good' memory
>> optimiser for Win ME!
>> ME has its own optimisation, and the superimposition of
another is
>> guaranteed to cause problems.
>> Free RAM (as you've already implied) is unused RAM -
and as such is best
>> hung on the wall with the Mooseheads, as it's no use in
the computer!
>>
>> Looking at their 'demo' of the optimiser, all they have
done is to move all
>> applications to the swapfile (and this in XP, rather
than a Win9x OS
>> anyhow) - which will actually slow things down rather
than speed them up. It
>> *may* hel;p you load more programs in XP - but not in
ME, where the more
>> likely limit is imposed by the small resources heap
that's available, rather
>> than the available memory.
>>
>> In short - it's snake-oil!
>>
>
>Well I see on their site some 88-bit kernel thing which
I'm not even
>going to pretend to understand, but as far as moving apps
to the
>swapfile.... that would be useful for subsequent loads if
the WinME
>defrag "arrange files so programs start faster" was
busted or not used,
>and there are more efficient algorithms than the stock M$
one (for
>instance arranging multiple dlls sequentially).
>
>Not naysaying you, Noel, but a memory defragger was a
must on Win95, and
>I'd go out on a limb and say that it'd be useful in WinME
with 64-128MB
>RAM (higher if the system is left on for any length of
time).
>
>Though the Hare product claims not to be a mem-defragger
in any event.
>
>Either way, IMHO, the OP's gotta uninstall it until
whatever it is
>that's broken can be fixed.
>
>Rick
>
>
>
>
>.
>

[Rick T]

John wrote:

> Have uninstalled HARE - also ran scandisk from boot disk
> with surface scan. It took a while(!) but reported no
> errors or bad sectors. Restarting and the problem still
> exists. <ctrl-alt-del> shows 25 programms running but no
> trace of "winmgmt". Would it be useful to list the
> programs running? OR is there some other way I can work
> out what they are for?

http://www.pacs-portal.co.uk/startup_content.php
will give you a good idea of all the stuff you've got running at Startup.

Start/Run/msconfig.exe/Startup(tab)


If any of them look sortof shady (for that matter even if they don't)
you should download and run some pest-control software...

free for personal use antivirus tool:
http://www.grisoft.com/us/us_dwnl_free.php

free for personal use spybot/adware detection & removal tools:
http://www.safer-networking.org/
http://www.lavasoftusa.com/



Rick



> John.
>
>>-----Original Message-----
>>Noel Paton wrote:
>>
>>
>>>Just a word of warning here - there is no such thing as
>
> a 'good' memory
>
>>>optimiser for Win ME!
>>>ME has its own optimisation, and the superimposition of
>
> another is
>
>>>guaranteed to cause problems.
>>>Free RAM (as you've already implied) is unused RAM -
>
> and as such is best
>
>>>hung on the wall with the Mooseheads, as it's no use in
>
> the computer!
>
>>>Looking at their 'demo' of the optimiser, all they have
>
> done is to move all
>
>>>applications to the swapfile (and this in XP, rather
>
> than a Win9x OS
>
>>>anyhow) - which will actually slow things down rather
>
> than speed them up. It
>
>>>*may* hel;p you load more programs in XP - but not in
>
> ME, where the more
>
>>>likely limit is imposed by the small resources heap
>
> that's available, rather
>
>>>than the available memory.
>>>
>>>In short - it's snake-oil!
>>>
>>
>>Well I see on their site some 88-bit kernel thing which
>
> I'm not even
>
>>going to pretend to understand, but as far as moving apps
>
> to the
>
>>swapfile.... that would be useful for subsequent loads if
>
> the WinME
>
>>defrag "arrange files so programs start faster" was
>
> busted or not used,
>
>>and there are more efficient algorithms than the stock M$
>
> one (for
>
>>instance arranging multiple dlls sequentially).
>>
>>Not naysaying you, Noel, but a memory defragger was a
>
> must on Win95, and
>
>>I'd go out on a limb and say that it'd be useful in WinME
>
> with 64-128MB
>
>>RAM (higher if the system is left on for any length of
>
> time).
>
>>Though the Hare product claims not to be a mem-defragger
>
> in any event.
>
>>Either way, IMHO, the OP's gotta uninstall it until
>
> whatever it is
>
>>that's broken can be fixed.
>>
>>Rick
>>
>>
>>
>>
>>.
>>

[John]

Have now got Spybot SD - it has cleared some of the bits
off the startup - however defrag now doesn't get past 0%
although the machine is clearly running! Overall the
processes seem faster so probably part of the problem is
fixed.
I'm thinking of looking for defrag issues on the NG to see
if there are other solutions ... unless it is better to
carry on with this (long) message? Thanks for the help so
far - I'll check for responses over the next few days then
if there's no reply I'll post a new message.

John.
>-----Original Message-----
>John wrote:
>
>> Have uninstalled HARE - also ran scandisk from boot
disk
>> with surface scan. It took a while(!) but reported no
>> errors or bad sectors. Restarting and the problem
still
>> exists. <ctrl-alt-del> shows 25 programms running but
no
>> trace of "winmgmt". Would it be useful to list the
>> programs running? OR is there some other way I can
work
>> out what they are for?
>
>http://www.pacs-portal.co.uk/startup_content.php
>will give you a good idea of all the stuff you've got
running at Startup.
>
>Start/Run/msconfig.exe/Startup(tab)
>
>
>If any of them look sortof shady (for that matter even if
they don't)
>you should download and run some pest-control software...
>
>free for personal use antivirus tool:
>http://www.grisoft.com/us/us_dwnl_free.php
>
>free for personal use spybot/adware detection & removal
tools:
>http://www.safer-networking.org/
>http://www.lavasoftusa.com/
>
>
>
>Rick
>
>
>
>> John.
>>
>>>-----Original Message-----
>>>Noel Paton wrote:
>>>
>>>
>>>>Just a word of warning here - there is no such thing
as
>>
>> a 'good' memory
>>
>>>>optimiser for Win ME!
>>>>ME has its own optimisation, and the superimposition
of
>>
>> another is
>>
>>>>guaranteed to cause problems.
>>>>Free RAM (as you've already implied) is unused RAM -
>>
>> and as such is best
>>
>>>>hung on the wall with the Mooseheads, as it's no use
in
>>
>> the computer!
>>
>>>>Looking at their 'demo' of the optimiser, all they
have
>>
>> done is to move all
>>
>>>>applications to the swapfile (and this in XP, rather
>>
>> than a Win9x OS
>>
>>>>anyhow) - which will actually slow things down rather
>>
>> than speed them up. It
>>
>>>>*may* hel;p you load more programs in XP - but not in
>>
>> ME, where the more
>>
>>>>likely limit is imposed by the small resources heap
>>
>> that's available, rather
>>
>>>>than the available memory.
>>>>
>>>>In short - it's snake-oil!
>>>>
>>>
>>>Well I see on their site some 88-bit kernel thing which
>>
>> I'm not even
>>
>>>going to pretend to understand, but as far as moving
apps
>>
>> to the
>>
>>>swapfile.... that would be useful for subsequent loads
if
>>
>> the WinME
>>
>>>defrag "arrange files so programs start faster" was
>>
>> busted or not used,
>>
>>>and there are more efficient algorithms than the stock
M$
>>
>> one (for
>>
>>>instance arranging multiple dlls sequentially).
>>>
>>>Not naysaying you, Noel, but a memory defragger was a
>>
>> must on Win95, and
>>
>>>I'd go out on a limb and say that it'd be useful in
WinME
>>
>> with 64-128MB
>>
>>>RAM (higher if the system is left on for any length of
>>
>> time).
>>
>>>Though the Hare product claims not to be a mem-
defragger
>>
>> in any event.
>>
>>>Either way, IMHO, the OP's gotta uninstall it until
>>
>> whatever it is
>>
>>>that's broken can be fixed.
>>>
>>>Rick
>>>
>>>
>>>
>>>
>>>.
>>>
>.
>

[John]

Thought things were better - no such luck! System crashed
about 40 mins after I entered the last message! That'll
teach me to be optimistic!
>-----Original Message-----
>Have now got Spybot SD - it has cleared some of the bits
>off the startup - however defrag now doesn't get past 0%
>although the machine is clearly running! Overall the
>processes seem faster so probably part of the problem is
>fixed.
>I'm thinking of looking for defrag issues on the NG to
see
>if there are other solutions ... unless it is better to
>carry on with this (long) message? Thanks for the help
so
>far - I'll check for responses over the next few days
then
>if there's no reply I'll post a new message.
>
>John.
>>-----Original Message-----
>>John wrote:
>>
>>> Have uninstalled HARE - also ran scandisk from boot
>disk
>>> with surface scan. It took a while(!) but reported no
>>> errors or bad sectors. Restarting and the problem
>still
>>> exists. <ctrl-alt-del> shows 25 programms running but
>no
>>> trace of "winmgmt". Would it be useful to list the
>>> programs running? OR is there some other way I can
>work
>>> out what they are for?
>>
>>http://www.pacs-portal.co.uk/startup_content.php
>>will give you a good idea of all the stuff you've got
>running at Startup.
>>
>>Start/Run/msconfig.exe/Startup(tab)
>>
>>
>>If any of them look sortof shady (for that matter even
if
>they don't)
>>you should download and run some pest-control software...
>>
>>free for personal use antivirus tool:
>>http://www.grisoft.com/us/us_dwnl_free.php
>>
>>free for personal use spybot/adware detection & removal
>tools:
>>http://www.safer-networking.org/
>>http://www.lavasoftusa.com/
>>
>>
>>
>>Rick
>>
>>
>>
>>> John.
>>>
>>>>-----Original Message-----
>>>>Noel Paton wrote:
>>>>
>>>>
>>>>>Just a word of warning here - there is no such thing
>as
>>>
>>> a 'good' memory
>>>
>>>>>optimiser for Win ME!
>>>>>ME has its own optimisation, and the superimposition
>of
>>>
>>> another is
>>>
>>>>>guaranteed to cause problems.
>>>>>Free RAM (as you've already implied) is unused RAM -
>>>
>>> and as such is best
>>>
>>>>>hung on the wall with the Mooseheads, as it's no use
>in
>>>
>>> the computer!
>>>
>>>>>Looking at their 'demo' of the optimiser, all they
>have
>>>
>>> done is to move all
>>>
>>>>>applications to the swapfile (and this in XP, rather
>>>
>>> than a Win9x OS
>>>
>>>>>anyhow) - which will actually slow things down rather
>>>
>>> than speed them up. It
>>>
>>>>>*may* hel;p you load more programs in XP - but not in
>>>
>>> ME, where the more
>>>
>>>>>likely limit is imposed by the small resources heap
>>>
>>> that's available, rather
>>>
>>>>>than the available memory.
>>>>>
>>>>>In short - it's snake-oil!
>>>>>
>>>>
>>>>Well I see on their site some 88-bit kernel thing
which
>>>
>>> I'm not even
>>>
>>>>going to pretend to understand, but as far as moving
>apps
>>>
>>> to the
>>>
>>>>swapfile.... that would be useful for subsequent loads
>if
>>>
>>> the WinME
>>>
>>>>defrag "arrange files so programs start faster" was
>>>
>>> busted or not used,
>>>
>>>>and there are more efficient algorithms than the stock
>M$
>>>
>>> one (for
>>>
>>>>instance arranging multiple dlls sequentially).
>>>>
>>>>Not naysaying you, Noel, but a memory defragger was a
>>>
>>> must on Win95, and
>>>
>>>>I'd go out on a limb and say that it'd be useful in
>WinME
>>>
>>> with 64-128MB
>>>
>>>>RAM (higher if the system is left on for any length of
>>>
>>> time).
>>>
>>>>Though the Hare product claims not to be a mem-
>defragger
>>>
>>> in any event.
>>>
>>>>Either way, IMHO, the OP's gotta uninstall it until
>>>
>>> whatever it is
>>>
>>>>that's broken can be fixed.
>>>>
>>>>Rick
>>>>
>>>>
>>>>
>>>>
>>>>.
>>>>
>>.
>>
>.
>

[Noel Paton]

You may have a virus/spyware hijack

download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://download.nai.com/products/mcafee-avert/stinger.exe

- update your virus scanner and run a full system scan of all files.

Reboot to Safe Mode and run CWShredder - to remove variants of the
CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Use CWShredder, the removal tool:
http://www.merijn.org/files/cwshredder.zip
http://www.merijn.org/files/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe
http://www.zerosrealm.com/downloads/CWShredder.zip

Try BHODemon - from http://www.spywareinfo.com/downloads/bhod/

Download AdAware from www.lavasoftusa.com, install, update, and run it to
remove spyware, adware,
and other such nasties from your system.

(thanks to Graham Womack for the following)
Do all this in Safe Mode.......
Make a Restore Point - just in case it gets worse.
Using Regedit, search for 'Safeguard'. Make a note of the dll name (if
there's an entry at all).
Run BHODemon. Look for the same dll name The 'Details' key should give you
more information about when the entries were loaded. Disable the registry
entry.
Search your hard drive for the dll file (should be in Windows\System).
Rename it and a similar named lib file - change the extensions.
Reboot, cross your fingers and try 'My Computer'

HTH

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"John" > wrote in message
...
> Thought things were better - no such luck! System crashed
> about 40 mins after I entered the last message! That'll
> teach me to be optimistic!
> >-----Original Message-----
> >Have now got Spybot SD - it has cleared some of the bits
> >off the startup - however defrag now doesn't get past 0%
> >although the machine is clearly running! Overall the
> >processes seem faster so probably part of the problem is
> >fixed.
> >I'm thinking of looking for defrag issues on the NG to
> see
> >if there are other solutions ... unless it is better to
> >carry on with this (long) message? Thanks for the help
> so
> >far - I'll check for responses over the next few days
> then
> >if there's no reply I'll post a new message.
> >
> >John.
> >>-----Original Message-----
> >>John wrote:
> >>
> >>> Have uninstalled HARE - also ran scandisk from boot
> >disk
> >>> with surface scan. It took a while(!) but reported no
> >>> errors or bad sectors. Restarting and the problem
> >still
> >>> exists. <ctrl-alt-del> shows 25 programms running but
> >no
> >>> trace of "winmgmt". Would it be useful to list the
> >>> programs running? OR is there some other way I can
> >work
> >>> out what they are for?
> >>
> >>http://www.pacs-portal.co.uk/startup_content.php
> >>will give you a good idea of all the stuff you've got
> >running at Startup.
> >>
> >>Start/Run/msconfig.exe/Startup(tab)
> >>
> >>
> >>If any of them look sortof shady (for that matter even
> if
> >they don't)
> >>you should download and run some pest-control software...
> >>
> >>free for personal use antivirus tool:
> >>http://www.grisoft.com/us/us_dwnl_free.php
> >>
> >>free for personal use spybot/adware detection & removal
> >tools:
> >>http://www.safer-networking.org/
> >>http://www.lavasoftusa.com/
> >>
> >>
> >>
> >>Rick
> >>
> >>
> >>
> >>> John.
> >>>
> >>>>-----Original Message-----
> >>>>Noel Paton wrote:
> >>>>
> >>>>
> >>>>>Just a word of warning here - there is no such thing
> >as
> >>>
> >>> a 'good' memory
> >>>
> >>>>>optimiser for Win ME!
> >>>>>ME has its own optimisation, and the superimposition
> >of
> >>>
> >>> another is
> >>>
> >>>>>guaranteed to cause problems.
> >>>>>Free RAM (as you've already implied) is unused RAM -
> >>>
> >>> and as such is best
> >>>
> >>>>>hung on the wall with the Mooseheads, as it's no use
> >in
> >>>
> >>> the computer!
> >>>
> >>>>>Looking at their 'demo' of the optimiser, all they
> >have
> >>>
> >>> done is to move all
> >>>
> >>>>>applications to the swapfile (and this in XP, rather
> >>>
> >>> than a Win9x OS
> >>>
> >>>>>anyhow) - which will actually slow things down rather
> >>>
> >>> than speed them up. It
> >>>
> >>>>>*may* hel;p you load more programs in XP - but not in
> >>>
> >>> ME, where the more
> >>>
> >>>>>likely limit is imposed by the small resources heap
> >>>
> >>> that's available, rather
> >>>
> >>>>>than the available memory.
> >>>>>
> >>>>>In short - it's snake-oil!
> >>>>>
> >>>>
> >>>>Well I see on their site some 88-bit kernel thing
> which
> >>>
> >>> I'm not even
> >>>
> >>>>going to pretend to understand, but as far as moving
> >apps
> >>>
> >>> to the
> >>>
> >>>>swapfile.... that would be useful for subsequent loads
> >if
> >>>
> >>> the WinME
> >>>
> >>>>defrag "arrange files so programs start faster" was
> >>>
> >>> busted or not used,
> >>>
> >>>>and there are more efficient algorithms than the stock
> >M$
> >>>
> >>> one (for
> >>>
> >>>>instance arranging multiple dlls sequentially).
> >>>>
> >>>>Not naysaying you, Noel, but a memory defragger was a
> >>>
> >>> must on Win95, and
> >>>
> >>>>I'd go out on a limb and say that it'd be useful in
> >WinME
> >>>
> >>> with 64-128MB
> >>>
> >>>>RAM (higher if the system is left on for any length of
> >>>
> >>> time).
> >>>
> >>>>Though the Hare product claims not to be a mem-
> >defragger
> >>>
> >>> in any event.
> >>>
> >>>>Either way, IMHO, the OP's gotta uninstall it until
> >>>
> >>> whatever it is
> >>>
> >>>>that's broken can be fixed.
> >>>>
> >>>>Rick
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>.
> >>>>
> >>.
> >>
> >.
> >

[John]

Anti-virus (McAfee) is bang up-to-date and detects no
viruses.
Have tried in vain to locate 'stinger.exe' on the web
sites given, but will try again.
Download and running of 'cwshredder.exe' showed the system
is clean.
'BHODemon' only identified SDHelper.dll (ie the Search and
Destroy programme).
'Ad-aware' cleared some stuff off the system but the
problem still exists.
Tried running (in Safemode) 'regedit' but no sign
of 'Safeguard' and as stated above, there is no sign of
any dll files other than SDHelper.dll

Managed to run defrag in safemode - it restarted a couple
of times but then went through (slowly) without problems.

Any other thoughts / suggestions welcome.

John.
>-----Original Message-----
>You may have a virus/spyware hijack
>
>download the Stinger from here and run it to make sure
that A-V-disabling
>viruses are not present on your PC
>http://download.nai.com/products/mcafee-avert/stinger.exe
>
>- update your virus scanner and run a full system scan of
all files.
>
>Reboot to Safe Mode and run CWShredder - to remove
variants of the
>CoolWebSearch hijacker.
>http://www.merijn.org/cwschronicles.html
>
>Use CWShredder, the removal tool:
>http://www.merijn.org/files/cwshredder.zip
>http://www.merijn.org/files/CWShredder.exe
>http://www.spywareinfo.com/downloads/tools/CWShredder.exe
>http://www.zerosrealm.com/downloads/CWShredder.zip
>
>Try BHODemon - from
http://www.spywareinfo.com/downloads/bhod/
>
>Download AdAware from www.lavasoftusa.com, install,
update, and run it to
>remove spyware, adware,
>and other such nasties from your system.
>
>(thanks to Graham Womack for the following)
>Do all this in Safe Mode.......
>Make a Restore Point - just in case it gets worse.
>Using Regedit, search for 'Safeguard'. Make a note of the
dll name (if
>there's an entry at all).
>Run BHODemon. Look for the same dll name The 'Details'
key should give you
>more information about when the entries were loaded.
Disable the registry
>entry.
>Search your hard drive for the dll file (should be in
Windows\System).
>Rename it and a similar named lib file - change the
extensions.
>Reboot, cross your fingers and try 'My Computer'
>
>HTH
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>"John" > wrote in
message
...
>> Thought things were better - no such luck! System
crashed
>> about 40 mins after I entered the last message! That'll
>> teach me to be optimistic!
>> >-----Original Message-----
>> >Have now got Spybot SD - it has cleared some of the
bits
>> >off the startup - however defrag now doesn't get past
0%
>> >although the machine is clearly running! Overall the
>> >processes seem faster so probably part of the problem
is
>> >fixed.
>> >I'm thinking of looking for defrag issues on the NG to
>> see
>> >if there are other solutions ... unless it is better to
>> >carry on with this (long) message? Thanks for the help
>> so
>> >far - I'll check for responses over the next few days
>> then
>> >if there's no reply I'll post a new message.
>> >
>> >John.
>> >>-----Original Message-----
>> >>John wrote:
>> >>
>> >>> Have uninstalled HARE - also ran scandisk from boot
>> >disk
>> >>> with surface scan. It took a while(!) but reported
no
>> >>> errors or bad sectors. Restarting and the problem
>> >still
>> >>> exists. <ctrl-alt-del> shows 25 programms running
but
>> >no
>> >>> trace of "winmgmt". Would it be useful to list the
>> >>> programs running? OR is there some other way I can
>> >work
>> >>> out what they are for?
>> >>
>> >>http://www.pacs-portal.co.uk/startup_content.php
>> >>will give you a good idea of all the stuff you've got
>> >running at Startup.
>> >>
>> >>Start/Run/msconfig.exe/Startup(tab)
>> >>
>> >>
>> >>If any of them look sortof shady (for that matter even
>> if
>> >they don't)
>> >>you should download and run some pest-control
software...
>> >>
>> >>free for personal use antivirus tool:
>> >>http://www.grisoft.com/us/us_dwnl_free.php
>> >>
>> >>free for personal use spybot/adware detection &
removal
>> >tools:
>> >>http://www.safer-networking.org/
>> >>http://www.lavasoftusa.com/
>> >>
>> >>
>> >>
>> >>Rick
>> >>
>> >>
>> >>
>> >>> John.
>> >>>
>> >>>>-----Original Message-----
>> >>>>Noel Paton wrote:
>> >>>>
>> >>>>
>> >>>>>Just a word of warning here - there is no such
thing
>> >as
>> >>>
>> >>> a 'good' memory
>> >>>
>> >>>>>optimiser for Win ME!
>> >>>>>ME has its own optimisation, and the
superimposition
>> >of
>> >>>
>> >>> another is
>> >>>
>> >>>>>guaranteed to cause problems.
>> >>>>>Free RAM (as you've already implied) is unused
RAM -
>> >>>
>> >>> and as such is best
>> >>>
>> >>>>>hung on the wall with the Mooseheads, as it's no
use
>> >in
>> >>>
>> >>> the computer!
>> >>>
>> >>>>>Looking at their 'demo' of the optimiser, all they
>> >have
>> >>>
>> >>> done is to move all
>> >>>
>> >>>>>applications to the swapfile (and this in XP,
rather
>> >>>
>> >>> than a Win9x OS
>> >>>
>> >>>>>anyhow) - which will actually slow things down
rather
>> >>>
>> >>> than speed them up. It
>> >>>
>> >>>>>*may* hel;p you load more programs in XP - but not
in
>> >>>
>> >>> ME, where the more
>> >>>
>> >>>>>likely limit is imposed by the small resources heap
>> >>>
>> >>> that's available, rather
>> >>>
>> >>>>>than the available memory.
>> >>>>>
>> >>>>>In short - it's snake-oil!
>> >>>>>
>> >>>>
>> >>>>Well I see on their site some 88-bit kernel thing
>> which
>> >>>
>> >>> I'm not even
>> >>>
>> >>>>going to pretend to understand, but as far as moving
>> >apps
>> >>>
>> >>> to the
>> >>>
>> >>>>swapfile.... that would be useful for subsequent
loads
>> >if
>> >>>
>> >>> the WinME
>> >>>
>> >>>>defrag "arrange files so programs start faster" was
>> >>>
>> >>> busted or not used,
>> >>>
>> >>>>and there are more efficient algorithms than the
stock
>> >M$
>> >>>
>> >>> one (for
>> >>>
>> >>>>instance arranging multiple dlls sequentially).
>> >>>>
>> >>>>Not naysaying you, Noel, but a memory defragger was
a
>> >>>
>> >>> must on Win95, and
>> >>>
>> >>>>I'd go out on a limb and say that it'd be useful in
>> >WinME
>> >>>
>> >>> with 64-128MB
>> >>>
>> >>>>RAM (higher if the system is left on for any length
of
>> >>>
>> >>> time).
>> >>>
>> >>>>Though the Hare product claims not to be a mem-
>> >defragger
>> >>>
>> >>> in any event.
>> >>>
>> >>>>Either way, IMHO, the OP's gotta uninstall it until
>> >>>
>> >>> whatever it is
>> >>>
>> >>>>that's broken can be fixed.
>> >>>>
>> >>>>Rick
>> >>>>
>> >>>>
>> >>>>
>> >>>>
>> >>>>.
>> >>>>
>> >>.
>> >>
>> >.
>> >
>
>
>.
>

[Noel Paton]

John
Just copy the link below to your IE address bar - it should automatically
begin download when you click Go.

http://download.nai.com/products/mcafee-avert/stinger.exe


I'd also try using an on-line scanner, such as McAfee's, Norton's, or
Trend's - they're free, and are usually slightly more up-to-the-job than
the public version, since the heuristics can come into play more (AIUI,
anyhow).

You should also look at your startup axis, and prune it...
look here for instructions on how to clean up your startup axis, preventing
unnecessary programs loading
http://www.pacs-portal.co.uk/startup_content.php


--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp

"John" > wrote in message
...
> Anti-virus (McAfee) is bang up-to-date and detects no
> viruses.
> Have tried in vain to locate 'stinger.exe' on the web
> sites given, but will try again.
> Download and running of 'cwshredder.exe' showed the system
> is clean.
> 'BHODemon' only identified SDHelper.dll (ie the Search and
> Destroy programme).
> 'Ad-aware' cleared some stuff off the system but the
> problem still exists.
> Tried running (in Safemode) 'regedit' but no sign
> of 'Safeguard' and as stated above, there is no sign of
> any dll files other than SDHelper.dll
>
> Managed to run defrag in safemode - it restarted a couple
> of times but then went through (slowly) without problems.
>
> Any other thoughts / suggestions welcome.
>
> John.
> >-----Original Message-----
> >You may have a virus/spyware hijack
> >
> >download the Stinger from here and run it to make sure
> that A-V-disabling
> >viruses are not present on your PC
> >http://download.nai.com/products/mcafee-avert/stinger.exe
> >
> >- update your virus scanner and run a full system scan of
> all files.
> >
> >Reboot to Safe Mode and run CWShredder - to remove
> variants of the
> >CoolWebSearch hijacker.
> >http://www.merijn.org/cwschronicles.html
> >
> >Use CWShredder, the removal tool:
> >http://www.merijn.org/files/cwshredder.zip
> >http://www.merijn.org/files/CWShredder.exe
> >http://www.spywareinfo.com/downloads/tools/CWShredder.exe
> >http://www.zerosrealm.com/downloads/CWShredder.zip
> >
> >Try BHODemon - from
> http://www.spywareinfo.com/downloads/bhod/
> >
> >Download AdAware from www.lavasoftusa.com, install,
> update, and run it to
> >remove spyware, adware,
> >and other such nasties from your system.
> >
> >(thanks to Graham Womack for the following)
> >Do all this in Safe Mode.......
> >Make a Restore Point - just in case it gets worse.
> >Using Regedit, search for 'Safeguard'. Make a note of the
> dll name (if
> >there's an entry at all).
> >Run BHODemon. Look for the same dll name The 'Details'
> key should give you
> >more information about when the entries were loaded.
> Disable the registry
> >entry.
> >Search your hard drive for the dll file (should be in
> Windows\System).
> >Rename it and a similar named lib file - change the
> extensions.
> >Reboot, cross your fingers and try 'My Computer'
> >
> >HTH
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >"John" > wrote in
> message
> ...
> >> Thought things were better - no such luck! System
> crashed
> >> about 40 mins after I entered the last message! That'll
> >> teach me to be optimistic!
> >> >-----Original Message-----
> >> >Have now got Spybot SD - it has cleared some of the
> bits
> >> >off the startup - however defrag now doesn't get past
> 0%
> >> >although the machine is clearly running! Overall the
> >> >processes seem faster so probably part of the problem
> is
> >> >fixed.
> >> >I'm thinking of looking for defrag issues on the NG to
> >> see
> >> >if there are other solutions ... unless it is better to
> >> >carry on with this (long) message? Thanks for the help
> >> so
> >> >far - I'll check for responses over the next few days
> >> then
> >> >if there's no reply I'll post a new message.
> >> >
> >> >John.
> >> >>-----Original Message-----
> >> >>John wrote:
> >> >>
> >> >>> Have uninstalled HARE - also ran scandisk from boot
> >> >disk
> >> >>> with surface scan. It took a while(!) but reported
> no
> >> >>> errors or bad sectors. Restarting and the problem
> >> >still
> >> >>> exists. <ctrl-alt-del> shows 25 programms running
> but
> >> >no
> >> >>> trace of "winmgmt". Would it be useful to list the
> >> >>> programs running? OR is there some other way I can
> >> >work
> >> >>> out what they are for?
> >> >>
> >> >>http://www.pacs-portal.co.uk/startup_content.php
> >> >>will give you a good idea of all the stuff you've got
> >> >running at Startup.
> >> >>
> >> >>Start/Run/msconfig.exe/Startup(tab)
> >> >>
> >> >>
> >> >>If any of them look sortof shady (for that matter even
> >> if
> >> >they don't)
> >> >>you should download and run some pest-control
> software...
> >> >>
> >> >>free for personal use antivirus tool:
> >> >>http://www.grisoft.com/us/us_dwnl_free.php
> >> >>
> >> >>free for personal use spybot/adware detection &
> removal
> >> >tools:
> >> >>http://www.safer-networking.org/
> >> >>http://www.lavasoftusa.com/
> >> >>
> >> >>
> >> >>
> >> >>Rick
> >> >>
> >> >>
> >> >>
> >> >>> John.
> >> >>>
> >> >>>>-----Original Message-----
> >> >>>>Noel Paton wrote:
> >> >>>>
> >> >>>>
> >> >>>>>Just a word of warning here - there is no such
> thing
> >> >as
> >> >>>
> >> >>> a 'good' memory
> >> >>>
> >> >>>>>optimiser for Win ME!
> >> >>>>>ME has its own optimisation, and the
> superimposition
> >> >of
> >> >>>
> >> >>> another is
> >> >>>
> >> >>>>>guaranteed to cause problems.
> >> >>>>>Free RAM (as you've already implied) is unused
> RAM -
> >> >>>
> >> >>> and as such is best
> >> >>>
> >> >>>>>hung on the wall with the Mooseheads, as it's no
> use
> >> >in
> >> >>>
> >> >>> the computer!
> >> >>>
> >> >>>>>Looking at their 'demo' of the optimiser, all they
> >> >have
> >> >>>
> >> >>> done is to move all
> >> >>>
> >> >>>>>applications to the swapfile (and this in XP,
> rather
> >> >>>
> >> >>> than a Win9x OS
> >> >>>
> >> >>>>>anyhow) - which will actually slow things down
> rather
> >> >>>
> >> >>> than speed them up. It
> >> >>>
> >> >>>>>*may* hel;p you load more programs in XP - but not
> in
> >> >>>
> >> >>> ME, where the more
> >> >>>
> >> >>>>>likely limit is imposed by the small resources heap
> >> >>>
> >> >>> that's available, rather
> >> >>>
> >> >>>>>than the available memory.
> >> >>>>>
> >> >>>>>In short - it's snake-oil!
> >> >>>>>
> >> >>>>
> >> >>>>Well I see on their site some 88-bit kernel thing
> >> which
> >> >>>
> >> >>> I'm not even
> >> >>>
> >> >>>>going to pretend to understand, but as far as moving
> >> >apps
> >> >>>
> >> >>> to the
> >> >>>
> >> >>>>swapfile.... that would be useful for subsequent
> loads
> >> >if
> >> >>>
> >> >>> the WinME
> >> >>>
> >> >>>>defrag "arrange files so programs start faster" was
> >> >>>
> >> >>> busted or not used,
> >> >>>
> >> >>>>and there are more efficient algorithms than the
> stock
> >> >M$
> >> >>>
> >> >>> one (for
> >> >>>
> >> >>>>instance arranging multiple dlls sequentially).
> >> >>>>
> >> >>>>Not naysaying you, Noel, but a memory defragger was
> a
> >> >>>
> >> >>> must on Win95, and
> >> >>>
> >> >>>>I'd go out on a limb and say that it'd be useful in
> >> >WinME
> >> >>>
> >> >>> with 64-128MB
> >> >>>
> >> >>>>RAM (higher if the system is left on for any length
> of
> >> >>>
> >> >>> time).
> >> >>>
> >> >>>>Though the Hare product claims not to be a mem-
> >> >defragger
> >> >>>
> >> >>> in any event.
> >> >>>
> >> >>>>Either way, IMHO, the OP's gotta uninstall it until
> >> >>>
> >> >>> whatever it is
> >> >>>
> >> >>>>that's broken can be fixed.
> >> >>>>
> >> >>>>Rick
> >> >>>>
> >> >>>>
> >> >>>>
> >> >>>>
> >> >>>>.
> >> >>>>
> >> >>.
> >> >>
> >> >.
> >> >
> >
> >
> >.
> >

[John]

Got 'Stinger' thanks - came up clean. Am in the process
of pruning the startup and will look for the on line
scanner over the next few days. I'll get back to you with
any progress!
John.
>-----Original Message-----
>John
>Just copy the link below to your IE address bar - it
should automatically
>begin download when you click Go.
>
>http://download.nai.com/products/mcafee-avert/stinger.exe
>
>
>I'd also try using an on-line scanner, such as McAfee's,
Norton's, or
>Trend's - they're free, and are usually slightly more up-
to-the-job than
>the public version, since the heuristics can come into
play more (AIUI,
>anyhow).
>
>You should also look at your startup axis, and prune it...
>look here for instructions on how to clean up your
startup axis, preventing
>unnecessary programs loading
>http://www.pacs-portal.co.uk/startup_content.php
>
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>
>"John" > wrote in
message
...
>> Anti-virus (McAfee) is bang up-to-date and detects no
>> viruses.
>> Have tried in vain to locate 'stinger.exe' on the web
>> sites given, but will try again.
>> Download and running of 'cwshredder.exe' showed the
system
>> is clean.
>> 'BHODemon' only identified SDHelper.dll (ie the Search
and
>> Destroy programme).
>> 'Ad-aware' cleared some stuff off the system but the
>> problem still exists.
>> Tried running (in Safemode) 'regedit' but no sign
>> of 'Safeguard' and as stated above, there is no sign of
>> any dll files other than SDHelper.dll
>>
>> Managed to run defrag in safemode - it restarted a
couple
>> of times but then went through (slowly) without
problems.
>>
>> Any other thoughts / suggestions welcome.
>>
>> John.
>> >-----Original Message-----
>> >You may have a virus/spyware hijack
>> >
>> >download the Stinger from here and run it to make sure
>> that A-V-disabling
>> >viruses are not present on your PC
>> >http://download.nai.com/products/mcafee-
avert/stinger.exe
>> >
>> >- update your virus scanner and run a full system scan
of
>> all files.
>> >
>> >Reboot to Safe Mode and run CWShredder - to remove
>> variants of the
>> >CoolWebSearch hijacker.
>> >http://www.merijn.org/cwschronicles.html
>> >
>> >Use CWShredder, the removal tool:
>> >http://www.merijn.org/files/cwshredder.zip
>> >http://www.merijn.org/files/CWShredder.exe
>>
>http://www.spywareinfo.com/downloads/tools/CWShredder.exe
>> >http://www.zerosrealm.com/downloads/CWShredder.zip
>> >
>> >Try BHODemon - from
>> http://www.spywareinfo.com/downloads/bhod/
>> >
>> >Download AdAware from www.lavasoftusa.com, install,
>> update, and run it to
>> >remove spyware, adware,
>> >and other such nasties from your system.
>> >
>> >(thanks to Graham Womack for the following)
>> >Do all this in Safe Mode.......
>> >Make a Restore Point - just in case it gets worse.
>> >Using Regedit, search for 'Safeguard'. Make a note of
the
>> dll name (if
>> >there's an entry at all).
>> >Run BHODemon. Look for the same dll name The 'Details'
>> key should give you
>> >more information about when the entries were loaded.
>> Disable the registry
>> >entry.
>> >Search your hard drive for the dll file (should be in
>> Windows\System).
>> >Rename it and a similar named lib file - change the
>> extensions.
>> >Reboot, cross your fingers and try 'My Computer'
>> >
>> >HTH
>> >
>> >--
>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >
>> >Nil Carborundum Illegitemi
>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >
>> >Please read http://dts-l.org/goodpost.htm on how to
post
>> messages to NG's
>> >or
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> 27pmvp.asp
>> >"John" > wrote in
>> message
>> ...
>> >> Thought things were better - no such luck! System
>> crashed
>> >> about 40 mins after I entered the last message!
That'll
>> >> teach me to be optimistic!
>> >> >-----Original Message-----
>> >> >Have now got Spybot SD - it has cleared some of the
>> bits
>> >> >off the startup - however defrag now doesn't get
past
>> 0%
>> >> >although the machine is clearly running! Overall
the
>> >> >processes seem faster so probably part of the
problem
>> is
>> >> >fixed.
>> >> >I'm thinking of looking for defrag issues on the NG
to
>> >> see
>> >> >if there are other solutions ... unless it is
better to
>> >> >carry on with this (long) message? Thanks for the
help
>> >> so
>> >> >far - I'll check for responses over the next few
days
>> >> then
>> >> >if there's no reply I'll post a new message.
>> >> >
>> >> >John.
>> >> >>-----Original Message-----
>> >> >>John wrote:
>> >> >>
>> >> >>> Have uninstalled HARE - also ran scandisk from
boot
>> >> >disk
>> >> >>> with surface scan. It took a while(!) but
reported
>> no
>> >> >>> errors or bad sectors. Restarting and the
problem
>> >> >still
>> >> >>> exists. <ctrl-alt-del> shows 25 programms
running
>> but
>> >> >no
>> >> >>> trace of "winmgmt". Would it be useful to list
the
>> >> >>> programs running? OR is there some other way I
can
>> >> >work
>> >> >>> out what they are for?
>> >> >>
>> >> >>http://www.pacs-portal.co.uk/startup_content.php
>> >> >>will give you a good idea of all the stuff you've
got
>> >> >running at Startup.
>> >> >>
>> >> >>Start/Run/msconfig.exe/Startup(tab)
>> >> >>
>> >> >>
>> >> >>If any of them look sortof shady (for that matter
even
>> >> if
>> >> >they don't)
>> >> >>you should download and run some pest-control
>> software...
>> >> >>
>> >> >>free for personal use antivirus tool:
>> >> >>http://www.grisoft.com/us/us_dwnl_free.php
>> >> >>
>> >> >>free for personal use spybot/adware detection &
>> removal
>> >> >tools:
>> >> >>http://www.safer-networking.org/
>> >> >>http://www.lavasoftusa.com/
>> >> >>
>> >> >>
>> >> >>
>> >> >>Rick
>> >> >>
>> >> >>
>> >> >>
>> >> >>> John.
>> >> >>>
>> >> >>>>-----Original Message-----
>> >> >>>>Noel Paton wrote:
>> >> >>>>
>> >> >>>>
>> >> >>>>>Just a word of warning here - there is no such
>> thing
>> >> >as
>> >> >>>
>> >> >>> a 'good' memory
>> >> >>>
>> >> >>>>>optimiser for Win ME!
>> >> >>>>>ME has its own optimisation, and the
>> superimposition
>> >> >of
>> >> >>>
>> >> >>> another is
>> >> >>>
>> >> >>>>>guaranteed to cause problems.
>> >> >>>>>Free RAM (as you've already implied) is unused
>> RAM -
>> >> >>>
>> >> >>> and as such is best
>> >> >>>
>> >> >>>>>hung on the wall with the Mooseheads, as it's no
>> use
>> >> >in
>> >> >>>
>> >> >>> the computer!
>> >> >>>
>> >> >>>>>Looking at their 'demo' of the optimiser, all
they
>> >> >have
>> >> >>>
>> >> >>> done is to move all
>> >> >>>
>> >> >>>>>applications to the swapfile (and this in XP,
>> rather
>> >> >>>
>> >> >>> than a Win9x OS
>> >> >>>
>> >> >>>>>anyhow) - which will actually slow things down
>> rather
>> >> >>>
>> >> >>> than speed them up. It
>> >> >>>
>> >> >>>>>*may* hel;p you load more programs in XP - but
not
>> in
>> >> >>>
>> >> >>> ME, where the more
>> >> >>>
>> >> >>>>>likely limit is imposed by the small resources
heap
>> >> >>>
>> >> >>> that's available, rather
>> >> >>>
>> >> >>>>>than the available memory.
>> >> >>>>>
>> >> >>>>>In short - it's snake-oil!
>> >> >>>>>
>> >> >>>>
>> >> >>>>Well I see on their site some 88-bit kernel thing
>> >> which
>> >> >>>
>> >> >>> I'm not even
>> >> >>>
>> >> >>>>going to pretend to understand, but as far as
moving
>> >> >apps
>> >> >>>
>> >> >>> to the
>> >> >>>
>> >> >>>>swapfile.... that would be useful for subsequent
>> loads
>> >> >if
>> >> >>>
>> >> >>> the WinME
>> >> >>>
>> >> >>>>defrag "arrange files so programs start faster"
was
>> >> >>>
>> >> >>> busted or not used,
>> >> >>>
>> >> >>>>and there are more efficient algorithms than the
>> stock
>> >> >M$
>> >> >>>
>> >> >>> one (for
>> >> >>>
>> >> >>>>instance arranging multiple dlls sequentially).
>> >> >>>>
>> >> >>>>Not naysaying you, Noel, but a memory defragger
was
>> a
>> >> >>>
>> >> >>> must on Win95, and
>> >> >>>
>> >> >>>>I'd go out on a limb and say that it'd be useful
in
>> >> >WinME
>> >> >>>
>> >> >>> with 64-128MB
>> >> >>>
>> >> >>>>RAM (higher if the system is left on for any
length
>> of
>> >> >>>
>> >> >>> time).
>> >> >>>
>> >> >>>>Though the Hare product claims not to be a mem-
>> >> >defragger
>> >> >>>
>> >> >>> in any event.
>> >> >>>
>> >> >>>>Either way, IMHO, the OP's gotta uninstall it
until
>> >> >>>
>> >> >>> whatever it is
>> >> >>>
>> >> >>>>that's broken can be fixed.
>> >> >>>>
>> >> >>>>Rick
>> >> >>>>
>> >> >>>>
>> >> >>>>
>> >> >>>>
>> >> >>>>.
>> >> >>>>
>> >> >>.
>> >> >>
>> >> >.
>> >> >
>> >
>> >
>> >.
>> >
>
>
>.
>

[John]

Have pruned startup to 7 (when <ctrl Alt Del>) and Ad-
Aware shows 'only'22 running processes. Lots of stuff
sorted and deleted / disabled and computer starts much
faster (thanks) but the basic problem still seems to
remain! Any other thoughts?
John
>-----Original Message-----
>Got 'Stinger' thanks - came up clean. Am in the process
>of pruning the startup and will look for the on line
>scanner over the next few days. I'll get back to you
with
>any progress!
>John.
>>-----Original Message-----
>>John
>>Just copy the link below to your IE address bar - it
>should automatically
>>begin download when you click Go.
>>
>>http://download.nai.com/products/mcafee-avert/stinger.exe
>>
>>
>>I'd also try using an on-line scanner, such as McAfee's,
>Norton's, or
>>Trend's - they're free, and are usually slightly more
up-
>to-the-job than
>>the public version, since the heuristics can come into
>play more (AIUI,
>>anyhow).
>>
>>You should also look at your startup axis, and prune
it...
>>look here for instructions on how to clean up your
>startup axis, preventing
>>unnecessary programs loading
>>http://www.pacs-portal.co.uk/startup_content.php
>>
>>
>>--
>>Noel Paton (MS-MVP 2002-2004, Win9x)
>>
>>Nil Carborundum Illegitemi
>>http://www.btinternet.com/~winnoel/millsrpch.htm
>>
>>Please read http://dts-l.org/goodpost.htm on how to post
>messages to NG's
>>or
>>http://www.microsoft.com/presspass/features/2001/Mar01/Ma
r
>27pmvp.asp
>>
>>"John" > wrote in
>message
...
>>> Anti-virus (McAfee) is bang up-to-date and detects no
>>> viruses.
>>> Have tried in vain to locate 'stinger.exe' on the web
>>> sites given, but will try again.
>>> Download and running of 'cwshredder.exe' showed the
>system
>>> is clean.
>>> 'BHODemon' only identified SDHelper.dll (ie the Search
>and
>>> Destroy programme).
>>> 'Ad-aware' cleared some stuff off the system but the
>>> problem still exists.
>>> Tried running (in Safemode) 'regedit' but no sign
>>> of 'Safeguard' and as stated above, there is no sign of
>>> any dll files other than SDHelper.dll
>>>
>>> Managed to run defrag in safemode - it restarted a
>couple
>>> of times but then went through (slowly) without
>problems.
>>>
>>> Any other thoughts / suggestions welcome.
>>>
>>> John.
>>> >-----Original Message-----
>>> >You may have a virus/spyware hijack
>>> >
>>> >download the Stinger from here and run it to make sure
>>> that A-V-disabling
>>> >viruses are not present on your PC
>>> >http://download.nai.com/products/mcafee-
>avert/stinger.exe
>>> >
>>> >- update your virus scanner and run a full system
scan
>of
>>> all files.
>>> >
>>> >Reboot to Safe Mode and run CWShredder - to remove
>>> variants of the
>>> >CoolWebSearch hijacker.
>>> >http://www.merijn.org/cwschronicles.html
>>> >
>>> >Use CWShredder, the removal tool:
>>> >http://www.merijn.org/files/cwshredder.zip
>>> >http://www.merijn.org/files/CWShredder.exe
>>>
>>http://www.spywareinfo.com/downloads/tools/CWShredder.exe
>>> >http://www.zerosrealm.com/downloads/CWShredder.zip
>>> >
>>> >Try BHODemon - from
>>> http://www.spywareinfo.com/downloads/bhod/
>>> >
>>> >Download AdAware from www.lavasoftusa.com, install,
>>> update, and run it to
>>> >remove spyware, adware,
>>> >and other such nasties from your system.
>>> >
>>> >(thanks to Graham Womack for the following)
>>> >Do all this in Safe Mode.......
>>> >Make a Restore Point - just in case it gets worse.
>>> >Using Regedit, search for 'Safeguard'. Make a note of
>the
>>> dll name (if
>>> >there's an entry at all).
>>> >Run BHODemon. Look for the same dll name The 'Details'
>>> key should give you
>>> >more information about when the entries were loaded.
>>> Disable the registry
>>> >entry.
>>> >Search your hard drive for the dll file (should be in
>>> Windows\System).
>>> >Rename it and a similar named lib file - change the
>>> extensions.
>>> >Reboot, cross your fingers and try 'My Computer'
>>> >
>>> >HTH
>>> >
>>> >--
>>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>>> >
>>> >Nil Carborundum Illegitemi
>>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>>> >
>>> >Please read http://dts-l.org/goodpost.htm on how to
>post
>>> messages to NG's
>>> >or
>>>
>>http://www.microsoft.com/presspass/features/2001/Mar01/Ma
r
>>> 27pmvp.asp
>>> >"John" > wrote in
>>> message
>>> ...
>>> >> Thought things were better - no such luck! System
>>> crashed
>>> >> about 40 mins after I entered the last message!
>That'll
>>> >> teach me to be optimistic!
>>> >> >-----Original Message-----
>>> >> >Have now got Spybot SD - it has cleared some of the
>>> bits
>>> >> >off the startup - however defrag now doesn't get
>past
>>> 0%
>>> >> >although the machine is clearly running! Overall
>the
>>> >> >processes seem faster so probably part of the
>problem
>>> is
>>> >> >fixed.
>>> >> >I'm thinking of looking for defrag issues on the
NG
>to
>>> >> see
>>> >> >if there are other solutions ... unless it is
>better to
>>> >> >carry on with this (long) message? Thanks for the
>help
>>> >> so
>>> >> >far - I'll check for responses over the next few
>days
>>> >> then
>>> >> >if there's no reply I'll post a new message.
>>> >> >
>>> >> >John.
>>> >> >>-----Original Message-----
>>> >> >>John wrote:
>>> >> >>
>>> >> >>> Have uninstalled HARE - also ran scandisk from
>boot
>>> >> >disk
>>> >> >>> with surface scan. It took a while(!) but
>reported
>>> no
>>> >> >>> errors or bad sectors. Restarting and the
>problem
>>> >> >still
>>> >> >>> exists. <ctrl-alt-del> shows 25 programms
>running
>>> but
>>> >> >no
>>> >> >>> trace of "winmgmt". Would it be useful to list
>the
>>> >> >>> programs running? OR is there some other way I
>can
>>> >> >work
>>> >> >>> out what they are for?
>>> >> >>
>>> >> >>http://www.pacs-portal.co.uk/startup_content.php
>>> >> >>will give you a good idea of all the stuff you've
>got
>>> >> >running at Startup.
>>> >> >>
>>> >> >>Start/Run/msconfig.exe/Startup(tab)
>>> >> >>
>>> >> >>
>>> >> >>If any of them look sortof shady (for that matter
>even
>>> >> if
>>> >> >they don't)
>>> >> >>you should download and run some pest-control
>>> software...
>>> >> >>
>>> >> >>free for personal use antivirus tool:
>>> >> >>http://www.grisoft.com/us/us_dwnl_free.php
>>> >> >>
>>> >> >>free for personal use spybot/adware detection &
>>> removal
>>> >> >tools:
>>> >> >>http://www.safer-networking.org/
>>> >> >>http://www.lavasoftusa.com/
>>> >> >>
>>> >> >>
>>> >> >>
>>> >> >>Rick
>>> >> >>
>>> >> >>
>>> >> >>
>>> >> >>> John.
>>> >> >>>
>>> >> >>>>-----Original Message-----
>>> >> >>>>Noel Paton wrote:
>>> >> >>>>
>>> >> >>>>
>>> >> >>>>>Just a word of warning here - there is no such
>>> thing
>>> >> >as
>>> >> >>>
>>> >> >>> a 'good' memory
>>> >> >>>
>>> >> >>>>>optimiser for Win ME!
>>> >> >>>>>ME has its own optimisation, and the
>>> superimposition
>>> >> >of
>>> >> >>>
>>> >> >>> another is
>>> >> >>>
>>> >> >>>>>guaranteed to cause problems.
>>> >> >>>>>Free RAM (as you've already implied) is unused
>>> RAM -
>>> >> >>>
>>> >> >>> and as such is best
>>> >> >>>
>>> >> >>>>>hung on the wall with the Mooseheads, as it's
no
>>> use
>>> >> >in
>>> >> >>>
>>> >> >>> the computer!
>>> >> >>>
>>> >> >>>>>Looking at their 'demo' of the optimiser, all
>they
>>> >> >have
>>> >> >>>
>>> >> >>> done is to move all
>>> >> >>>
>>> >> >>>>>applications to the swapfile (and this in XP,
>>> rather
>>> >> >>>
>>> >> >>> than a Win9x OS
>>> >> >>>
>>> >> >>>>>anyhow) - which will actually slow things down
>>> rather
>>> >> >>>
>>> >> >>> than speed them up. It
>>> >> >>>
>>> >> >>>>>*may* hel;p you load more programs in XP - but
>not
>>> in
>>> >> >>>
>>> >> >>> ME, where the more
>>> >> >>>
>>> >> >>>>>likely limit is imposed by the small resources
>heap
>>> >> >>>
>>> >> >>> that's available, rather
>>> >> >>>
>>> >> >>>>>than the available memory.
>>> >> >>>>>
>>> >> >>>>>In short - it's snake-oil!
>>> >> >>>>>
>>> >> >>>>
>>> >> >>>>Well I see on their site some 88-bit kernel
thing
>>> >> which
>>> >> >>>
>>> >> >>> I'm not even
>>> >> >>>
>>> >> >>>>going to pretend to understand, but as far as
>moving
>>> >> >apps
>>> >> >>>
>>> >> >>> to the
>>> >> >>>
>>> >> >>>>swapfile.... that would be useful for subsequent
>>> loads
>>> >> >if
>>> >> >>>
>>> >> >>> the WinME
>>> >> >>>
>>> >> >>>>defrag "arrange files so programs start faster"
>was
>>> >> >>>
>>> >> >>> busted or not used,
>>> >> >>>
>>> >> >>>>and there are more efficient algorithms than the
>>> stock
>>> >> >M$
>>> >> >>>
>>> >> >>> one (for
>>> >> >>>
>>> >> >>>>instance arranging multiple dlls sequentially).
>>> >> >>>>
>>> >> >>>>Not naysaying you, Noel, but a memory defragger
>was
>>> a
>>> >> >>>
>>> >> >>> must on Win95, and
>>> >> >>>
>>> >> >>>>I'd go out on a limb and say that it'd be
useful
>in
>>> >> >WinME
>>> >> >>>
>>> >> >>> with 64-128MB
>>> >> >>>
>>> >> >>>>RAM (higher if the system is left on for any
>length
>>> of
>>> >> >>>
>>> >> >>> time).
>>> >> >>>
>>> >> >>>>Though the Hare product claims not to be a mem-
>>> >> >defragger
>>> >> >>>
>>> >> >>> in any event.
>>> >> >>>
>>> >> >>>>Either way, IMHO, the OP's gotta uninstall it
>until
>>> >> >>>
>>> >> >>> whatever it is
>>> >> >>>
>>> >> >>>>that's broken can be fixed.
>>> >> >>>>
>>> >> >>>>Rick
>>> >> >>>>
>>> >> >>>>
>>> >> >>>>
>>> >> >>>>
>>> >> >>>>.
>>> >> >>>>
>>> >> >>.
>>> >> >>
>>> >> >.
>>> >> >
>>> >
>>> >
>>> >.
>>> >
>>
>>
>>.
>>
>.
>

[Noel Paton]

OK - this thread has been going for some time, and I think it's necessary to
have a review of where we actually are....

1) what exact symptoms are you seeing, when?-
2) what spyware items did AdAware/Spy-bot remove? (don't bother with the
cookies, just eh actual spyware items)
3) is the mem 'doubler' uninstalled? - if not, then do so please!
4) what entries in SYSTEM.INI are there under the [vcache] and [386Enh]
headers?


--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp

"John" > wrote in message
...
> Have pruned startup to 7 (when <ctrl Alt Del>) and Ad-
> Aware shows 'only'22 running processes. Lots of stuff
> sorted and deleted / disabled and computer starts much
> faster (thanks) but the basic problem still seems to
> remain! Any other thoughts?
> John

[John]

The problems are a slow down of the computer after about
an hour then regular 'freezing' requiring <ctrl alt del>
to unfreeze. I have also had blue screens but not that
often. The main difficulty seems to be scandisk - keeps
reporting that it has restarted 10 times because 'Windows
or another programme has written to this disk' offering
the suggestion to close some programmes, but no other ones
are running as far as I can tell.
Spy bot removed 'Alexa Related' 1; 'Roings objsafe.tdb'
1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO Exploit'
8; 'Gain Dashbar' 1; 'Gain.Gator' 42 (including 'Date
Manager').
The 'mem doubler' is disabled.
There are no entries under [vcache] in system.ini and the
following entries under [386enh]
ebios=*ebios
woafont=dosapp.fon
mouse=*vmouse,msmouse.vxd
device=*dynapage
device=*vcd
device=*vpd
device=*int13
device=*enable
keyboard=*vkd
display=*vdd,vflatd
EMMExclude=C000-CFFF

Having run McAffee anti virus, still no viruses are
showing, but (still) these 'potentially unwanted
programmes' are shown- 'ProcKill-Term' 'Adware-
Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The file
locations for these are all c:\_restore\archive\ and I
cannot clean / quarrantine / delete them as the disc is
write protected.

John.
>-----Original Message-----
>OK - this thread has been going for some time, and I
think it's necessary to
>have a review of where we actually are....
>
>1) what exact symptoms are you seeing, when?-
>2) what spyware items did AdAware/Spy-bot remove? (don't
bother with the
>cookies, just eh actual spyware items)
>3) is the mem 'doubler' uninstalled? - if not, then do so
please!
>4) what entries in SYSTEM.INI are there under the
[vcache] and [386Enh]
>headers?
>
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>
>"John" > wrote in
message
...
>> Have pruned startup to 7 (when <ctrl Alt Del>) and Ad-
>> Aware shows 'only'22 running processes. Lots of stuff
>> sorted and deleted / disabled and computer starts much
>> faster (thanks) but the basic problem still seems to
>> remain! Any other thoughts?
>> John
>
>
>.
>

[Noel Paton]

OK
last things first- items in the C:\_Restore tree can be safely ignore for
the moment - look here for details
http://support.microsoft.com/?scid=263455

for the rest - Roings seems to be a particularly nasty piece of work - look
here
http://www.pestpatrol.com/PestInfo/r/roings_com.asp
Conducent....
http://sarc.com/avcenter/venc/data/adware.tsadbot.html
The two Gain items are both from Gator - have you uninstalled it? - but
should have been removed effectively by Spybot/Ad-Aware.
The DSO exploit could cover a multitude of sins - or nothing at all,
depending on the rest of the details.
'Alexa related' is actually installed with all versions of IE (above 5.0,
IIRC) - and is only activated if you use the 'related items' option in the
Search tool. - it is usually quite safe (but....<g>)

'HideWindow' is an interesting one - since it's in your Restore archive, it
should have been removed - but perhaps not, so look here for some details
http://vil.nai.com/vil/content/v_99939.htm

Make sure that you make a note of ALL error messages (if you get a 'Cascade'
effect , then only the first is usually relevant), and post back - these
messages offer a certain amount of info, which can be invaluable in
isolating a cause.

When you use C-A-D to unfreeze - what's running? - does the very action of
using the option unfreeze the PC, or do you have to end a task - is it
always the same task? Does anything show as 'Not responding??


HTH

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp

"John" > wrote in message
...
> The problems are a slow down of the computer after about
> an hour then regular 'freezing' requiring <ctrl alt del>
> to unfreeze. I have also had blue screens but not that
> often. The main difficulty seems to be scandisk - keeps
> reporting that it has restarted 10 times because 'Windows
> or another programme has written to this disk' offering
> the suggestion to close some programmes, but no other ones
> are running as far as I can tell.
> Spy bot removed 'Alexa Related' 1; 'Roings objsafe.tdb'
> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO Exploit'
> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42 (including 'Date
> Manager').
> The 'mem doubler' is disabled.
> There are no entries under [vcache] in system.ini and the
> following entries under [386enh]
> ebios=*ebios
> woafont=dosapp.fon
> mouse=*vmouse,msmouse.vxd
> device=*dynapage
> device=*vcd
> device=*vpd
> device=*int13
> device=*enable
> keyboard=*vkd
> display=*vdd,vflatd
> EMMExclude=C000-CFFF
>
> Having run McAffee anti virus, still no viruses are
> showing, but (still) these 'potentially unwanted
> programmes' are shown- 'ProcKill-Term' 'Adware-
> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The file
> locations for these are all c:\_restore\archive\ and I
> cannot clean / quarrantine / delete them as the disc is
> write protected.
>
> John.
> >-----Original Message-----
> >OK - this thread has been going for some time, and I
> think it's necessary to
> >have a review of where we actually are....
> >
> >1) what exact symptoms are you seeing, when?-
> >2) what spyware items did AdAware/Spy-bot remove? (don't
> bother with the
> >cookies, just eh actual spyware items)
> >3) is the mem 'doubler' uninstalled? - if not, then do so
> please!
> >4) what entries in SYSTEM.INI are there under the
> [vcache] and [386Enh]
> >headers?
> >
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >
> >"John" > wrote in
> message
> ...
> >> Have pruned startup to 7 (when <ctrl Alt Del>) and Ad-
> >> Aware shows 'only'22 running processes. Lots of stuff
> >> sorted and deleted / disabled and computer starts much
> >> faster (thanks) but the basic problem still seems to
> >> remain! Any other thoughts?
> >> John
> >
> >
> >.
> >

[John]

I believe 'roings' and 'conducent' have both been removed -
searching for files / folders only shows one file for
each, in the S&D Restore directory. The 'Gain' items have
also been removed.
Looking in the 'recovery' list of S&D it shows that all
the DSO entries have the following path -
HKEY_USERS\DEFAULT\software\microsoft\windows\curr entVersio
n\InternetSettings\Zones\0\1004!=W=3 (which means nothing
to me!)
The link to the web for 'HideWindow' gives removal
instructions but checking my directories, I do not have
the directories mentioned for the command line. Also,
having downloaded Norton 'navc' I am not convinced I have
a command line scanner ... nor can I get it to run. Put
that down to ignorance on my part! (I would like to be
able to get rid of 'HideWindow' if I can - I'm not sure I
like the sound of it!)
As regards the blue screens - last night having been on
the computer for just over three hours with things
seemingly OK, I went to use a game (Rhajonng Tile game)
and got the error message 'OE:0028:C0099D66' pressing the
spacebar returned me to the desk top (nothing else running
at the time. I was able to open Word and Works but
closing them and going to the internet thta seemed OK.
Closing down AOL immediately led to another error
message 'OE:28:C0030AE6' and the computer hung. Only way
out was <c a d> .
I've looked for the error messages on the internet, but
got nowhere fast.

In the past, when programmes have frozen, I've not always
got blue screens. Normally the only thing that comes up
as 'not responding' is the programme I'm in at the time (I
rarely have more than one open at a time). This can be
Word, Works, Games (these usually crash then give blue
screens but unfortunately I've not noted the error
messages). I'll do better in future! (so far tonight,
I've been on this for about 3 hours and all seems to be
going OK ....)
John.
>-----Original Message-----
>OK
>last things first- items in the C:\_Restore tree can be
safely ignore for
>the moment - look here for details
>http://support.microsoft.com/?scid=263455
>
>for the rest - Roings seems to be a particularly nasty
piece of work - look
>here
>http://www.pestpatrol.com/PestInfo/r/roings_com.asp
>Conducent....
>http://sarc.com/avcenter/venc/data/adware.tsadbot.html
>The two Gain items are both from Gator - have you
uninstalled it? - but
>should have been removed effectively by Spybot/Ad-Aware.
>The DSO exploit could cover a multitude of sins - or
nothing at all,
>depending on the rest of the details.
>'Alexa related' is actually installed with all versions
of IE (above 5.0,
>IIRC) - and is only activated if you use the 'related
items' option in the
>Search tool. - it is usually quite safe (but....<g>)
>
>'HideWindow' is an interesting one - since it's in your
Restore archive, it
>should have been removed - but perhaps not, so look here
for some details
>http://vil.nai.com/vil/content/v_99939.htm
>
>Make sure that you make a note of ALL error messages (if
you get a 'Cascade'
>effect , then only the first is usually relevant), and
post back - these
>messages offer a certain amount of info, which can be
invaluable in
>isolating a cause.
>
>When you use C-A-D to unfreeze - what's running? - does
the very action of
>using the option unfreeze the PC, or do you have to end a
task - is it
>always the same task? Does anything show as 'Not
responding??
>
>
>HTH
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>
>"John" > wrote in
message
...
>> The problems are a slow down of the computer after about
>> an hour then regular 'freezing' requiring <ctrl alt del>
>> to unfreeze. I have also had blue screens but not that
>> often. The main difficulty seems to be scandisk - keeps
>> reporting that it has restarted 10 times
because 'Windows
>> or another programme has written to this disk' offering
>> the suggestion to close some programmes, but no other
ones
>> are running as far as I can tell.
>> Spy bot removed 'Alexa Related' 1; 'Roings objsafe.tdb'
>> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO Exploit'
>> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42 (including 'Date
>> Manager').
>> The 'mem doubler' is disabled.
>> There are no entries under [vcache] in system.ini and
the
>> following entries under [386enh]
>> ebios=*ebios
>> woafont=dosapp.fon
>> mouse=*vmouse,msmouse.vxd
>> device=*dynapage
>> device=*vcd
>> device=*vpd
>> device=*int13
>> device=*enable
>> keyboard=*vkd
>> display=*vdd,vflatd
>> EMMExclude=C000-CFFF
>>
>> Having run McAffee anti virus, still no viruses are
>> showing, but (still) these 'potentially unwanted
>> programmes' are shown- 'ProcKill-Term' 'Adware-
>> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The file
>> locations for these are all c:\_restore\archive\ and I
>> cannot clean / quarrantine / delete them as the disc is
>> write protected.
>>
>> John.
>> >-----Original Message-----
>> >OK - this thread has been going for some time, and I
>> think it's necessary to
>> >have a review of where we actually are....
>> >
>> >1) what exact symptoms are you seeing, when?-
>> >2) what spyware items did AdAware/Spy-bot remove?
(don't
>> bother with the
>> >cookies, just eh actual spyware items)
>> >3) is the mem 'doubler' uninstalled? - if not, then do
so
>> please!
>> >4) what entries in SYSTEM.INI are there under the
>> [vcache] and [386Enh]
>> >headers?
>> >
>> >
>> >--
>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >
>> >Nil Carborundum Illegitemi
>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >
>> >Please read http://dts-l.org/goodpost.htm on how to
post
>> messages to NG's
>> >or
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> 27pmvp.asp
>> >
>> >"John" > wrote in
>> message
>> ...
>> >> Have pruned startup to 7 (when <ctrl Alt Del>) and
Ad-
>> >> Aware shows 'only'22 running processes. Lots of
stuff
>> >> sorted and deleted / disabled and computer starts
much
>> >> faster (thanks) but the basic problem still seems to
>> >> remain! Any other thoughts?
>> >> John
>> >
>> >
>> >.
>> >
>
>
>.
>

[Noel Paton]

Command line scanners can require to be run from real-mode DOS - and Norton
still doesn't really recognise the existence of ME, or (probably) the fact
that it doesn't support Real-Mode DOS under Windows.
Try running the scanner from a DOS boot with a floppy disk - see if that
enables it

HOWEVER - where did you get the program from?? - AFAICT, it hasn't been
updated for years, so is likely to be less than useless (if it's not
actually an infector itself!) searches on Norton site don't come up with
current versions.

If you want to check with a real DOS scanner - not a bad idea,
occasionally - download F-Prot for DOS from www.f-prot.com on a known-clean
machine, create the boot disks from the download, and use that on your PC.
Note that allowing any such scanner to delete items in the C:\_Restore
archive will break System Restore, and you'll need to reset it on the reboot
to Windows


--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp

"John" > wrote in message
...
> I believe 'roings' and 'conducent' have both been removed -
> searching for files / folders only shows one file for
> each, in the S&D Restore directory. The 'Gain' items have
> also been removed.
> Looking in the 'recovery' list of S&D it shows that all
> the DSO entries have the following path -
> HKEY_USERS\DEFAULT\software\microsoft\windows\curr entVersio
> n\InternetSettings\Zones\0\1004!=W=3 (which means nothing
> to me!)
> The link to the web for 'HideWindow' gives removal
> instructions but checking my directories, I do not have
> the directories mentioned for the command line. Also,
> having downloaded Norton 'navc' I am not convinced I have
> a command line scanner ... nor can I get it to run. Put
> that down to ignorance on my part! (I would like to be
> able to get rid of 'HideWindow' if I can - I'm not sure I
> like the sound of it!)
> As regards the blue screens - last night having been on
> the computer for just over three hours with things
> seemingly OK, I went to use a game (Rhajonng Tile game)
> and got the error message 'OE:0028:C0099D66' pressing the
> spacebar returned me to the desk top (nothing else running
> at the time. I was able to open Word and Works but
> closing them and going to the internet thta seemed OK.
> Closing down AOL immediately led to another error
> message 'OE:28:C0030AE6' and the computer hung. Only way
> out was <c a d> .
> I've looked for the error messages on the internet, but
> got nowhere fast.
>
> In the past, when programmes have frozen, I've not always
> got blue screens. Normally the only thing that comes up
> as 'not responding' is the programme I'm in at the time (I
> rarely have more than one open at a time). This can be
> Word, Works, Games (these usually crash then give blue
> screens but unfortunately I've not noted the error
> messages). I'll do better in future! (so far tonight,
> I've been on this for about 3 hours and all seems to be
> going OK ....)
> John.
> >-----Original Message-----
> >OK
> >last things first- items in the C:\_Restore tree can be
> safely ignore for
> >the moment - look here for details
> >http://support.microsoft.com/?scid=263455
> >
> >for the rest - Roings seems to be a particularly nasty
> piece of work - look
> >here
> >http://www.pestpatrol.com/PestInfo/r/roings_com.asp
> >Conducent....
> >http://sarc.com/avcenter/venc/data/adware.tsadbot.html
> >The two Gain items are both from Gator - have you
> uninstalled it? - but
> >should have been removed effectively by Spybot/Ad-Aware.
> >The DSO exploit could cover a multitude of sins - or
> nothing at all,
> >depending on the rest of the details.
> >'Alexa related' is actually installed with all versions
> of IE (above 5.0,
> >IIRC) - and is only activated if you use the 'related
> items' option in the
> >Search tool. - it is usually quite safe (but....<g>)
> >
> >'HideWindow' is an interesting one - since it's in your
> Restore archive, it
> >should have been removed - but perhaps not, so look here
> for some details
> >http://vil.nai.com/vil/content/v_99939.htm
> >
> >Make sure that you make a note of ALL error messages (if
> you get a 'Cascade'
> >effect , then only the first is usually relevant), and
> post back - these
> >messages offer a certain amount of info, which can be
> invaluable in
> >isolating a cause.
> >
> >When you use C-A-D to unfreeze - what's running? - does
> the very action of
> >using the option unfreeze the PC, or do you have to end a
> task - is it
> >always the same task? Does anything show as 'Not
> responding??
> >
> >
> >HTH
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >
> >"John" > wrote in
> message
> ...
> >> The problems are a slow down of the computer after about
> >> an hour then regular 'freezing' requiring <ctrl alt del>
> >> to unfreeze. I have also had blue screens but not that
> >> often. The main difficulty seems to be scandisk - keeps
> >> reporting that it has restarted 10 times
> because 'Windows
> >> or another programme has written to this disk' offering
> >> the suggestion to close some programmes, but no other
> ones
> >> are running as far as I can tell.
> >> Spy bot removed 'Alexa Related' 1; 'Roings objsafe.tdb'
> >> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO Exploit'
> >> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42 (including 'Date
> >> Manager').
> >> The 'mem doubler' is disabled.
> >> There are no entries under [vcache] in system.ini and
> the
> >> following entries under [386enh]
> >> ebios=*ebios
> >> woafont=dosapp.fon
> >> mouse=*vmouse,msmouse.vxd
> >> device=*dynapage
> >> device=*vcd
> >> device=*vpd
> >> device=*int13
> >> device=*enable
> >> keyboard=*vkd
> >> display=*vdd,vflatd
> >> EMMExclude=C000-CFFF
> >>
> >> Having run McAffee anti virus, still no viruses are
> >> showing, but (still) these 'potentially unwanted
> >> programmes' are shown- 'ProcKill-Term' 'Adware-
> >> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The file
> >> locations for these are all c:\_restore\archive\ and I
> >> cannot clean / quarrantine / delete them as the disc is
> >> write protected.
> >>
> >> John.
> >> >-----Original Message-----
> >> >OK - this thread has been going for some time, and I
> >> think it's necessary to
> >> >have a review of where we actually are....
> >> >
> >> >1) what exact symptoms are you seeing, when?-
> >> >2) what spyware items did AdAware/Spy-bot remove?
> (don't
> >> bother with the
> >> >cookies, just eh actual spyware items)
> >> >3) is the mem 'doubler' uninstalled? - if not, then do
> so
> >> please!
> >> >4) what entries in SYSTEM.INI are there under the
> >> [vcache] and [386Enh]
> >> >headers?
> >> >
> >> >
> >> >--
> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >
> >> >Nil Carborundum Illegitemi
> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >
> >> >Please read http://dts-l.org/goodpost.htm on how to
> post
> >> messages to NG's
> >> >or
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> 27pmvp.asp
> >> >
> >> >"John" > wrote in
> >> message
> >> ...
> >> >> Have pruned startup to 7 (when <ctrl Alt Del>) and
> Ad-
> >> >> Aware shows 'only'22 running processes. Lots of
> stuff
> >> >> sorted and deleted / disabled and computer starts
> much
> >> >> faster (thanks) but the basic problem still seems to
> >> >> remain! Any other thoughts?
> >> >> John
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

[John]

Am still looking for access to a 'known-clean' computer to
follow your last suggestion. Looked at downloading F-Prot
AntiVirus for DOS to my desktop - success downloading, but
it stops running after about 20 minutes and the only way
out is to use A-C-D to end task. (Incidentally, there was
no option to create boot disks with the download - unless
I've missed the point!)

Since starting this thread, the symptoms have eased - now
the computer will run for between three and four hours
before frezing - last time it was on the internet and I
had to resort to turning off the power, as C-A-D didn't
work, neither did Start-Shutdown. I don't always get blue
screens, and when I do, there are not always error codes.

Having re-run Adaware and Spybot, nothing is showing as
other than cookies and 'low risk data miners (all of which
I get rid of). McAffee still up to date but shows no
viruses jus the 'potentially unwanted programmes'.

Maybe I just need to be satisfied with only using the
computer for less than 3 hours at a time?!
John.
>-----Original Message-----
>Command line scanners can require to be run from real-
mode DOS - and Norton
>still doesn't really recognise the existence of ME, or
(probably) the fact
>that it doesn't support Real-Mode DOS under Windows.
>Try running the scanner from a DOS boot with a floppy
disk - see if that
>enables it
>
>HOWEVER - where did you get the program from?? - AFAICT,
it hasn't been
>updated for years, so is likely to be less than useless
(if it's not
>actually an infector itself!) searches on Norton site
don't come up with
>current versions.
>
>If you want to check with a real DOS scanner - not a bad
idea,
>occasionally - download F-Prot for DOS from www.f-
prot.com on a known-clean
>machine, create the boot disks from the download, and use
that on your PC.
>Note that allowing any such scanner to delete items in
the C:\_Restore
>archive will break System Restore, and you'll need to
reset it on the reboot
>to Windows
>
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>
>"John" > wrote in
message
...
>> I believe 'roings' and 'conducent' have both been
removed -
>> searching for files / folders only shows one file for
>> each, in the S&D Restore directory. The 'Gain' items
have
>> also been removed.
>> Looking in the 'recovery' list of S&D it shows that all
>> the DSO entries have the following path -
>>
HKEY_USERS\DEFAULT\software\microsoft\windows\curr entVersio
>> n\InternetSettings\Zones\0\1004!=W=3 (which means
nothing
>> to me!)
>> The link to the web for 'HideWindow' gives removal
>> instructions but checking my directories, I do not have
>> the directories mentioned for the command line. Also,
>> having downloaded Norton 'navc' I am not convinced I
have
>> a command line scanner ... nor can I get it to run. Put
>> that down to ignorance on my part! (I would like to be
>> able to get rid of 'HideWindow' if I can - I'm not sure
I
>> like the sound of it!)
>> As regards the blue screens - last night having been on
>> the computer for just over three hours with things
>> seemingly OK, I went to use a game (Rhajonng Tile game)
>> and got the error message 'OE:0028:C0099D66' pressing
the
>> spacebar returned me to the desk top (nothing else
running
>> at the time. I was able to open Word and Works but
>> closing them and going to the internet thta seemed OK.
>> Closing down AOL immediately led to another error
>> message 'OE:28:C0030AE6' and the computer hung. Only
way
>> out was <c a d> .
>> I've looked for the error messages on the internet, but
>> got nowhere fast.
>>
>> In the past, when programmes have frozen, I've not
always
>> got blue screens. Normally the only thing that comes up
>> as 'not responding' is the programme I'm in at the time
(I
>> rarely have more than one open at a time). This can be
>> Word, Works, Games (these usually crash then give blue
>> screens but unfortunately I've not noted the error
>> messages). I'll do better in future! (so far tonight,
>> I've been on this for about 3 hours and all seems to be
>> going OK ....)
>> John.
>> >-----Original Message-----
>> >OK
>> >last things first- items in the C:\_Restore tree can be
>> safely ignore for
>> >the moment - look here for details
>> >http://support.microsoft.com/?scid=263455
>> >
>> >for the rest - Roings seems to be a particularly nasty
>> piece of work - look
>> >here
>> >http://www.pestpatrol.com/PestInfo/r/roings_com.asp
>> >Conducent....
>> >http://sarc.com/avcenter/venc/data/adware.tsadbot.html
>> >The two Gain items are both from Gator - have you
>> uninstalled it? - but
>> >should have been removed effectively by Spybot/Ad-
Aware.
>> >The DSO exploit could cover a multitude of sins - or
>> nothing at all,
>> >depending on the rest of the details.
>> >'Alexa related' is actually installed with all versions
>> of IE (above 5.0,
>> >IIRC) - and is only activated if you use the 'related
>> items' option in the
>> >Search tool. - it is usually quite safe (but....<g>)
>> >
>> >'HideWindow' is an interesting one - since it's in your
>> Restore archive, it
>> >should have been removed - but perhaps not, so look
here
>> for some details
>> >http://vil.nai.com/vil/content/v_99939.htm
>> >
>> >Make sure that you make a note of ALL error messages
(if
>> you get a 'Cascade'
>> >effect , then only the first is usually relevant), and
>> post back - these
>> >messages offer a certain amount of info, which can be
>> invaluable in
>> >isolating a cause.
>> >
>> >When you use C-A-D to unfreeze - what's running? - does
>> the very action of
>> >using the option unfreeze the PC, or do you have to
end a
>> task - is it
>> >always the same task? Does anything show as 'Not
>> responding??
>> >
>> >
>> >HTH
>> >
>> >--
>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >
>> >Nil Carborundum Illegitemi
>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >
>> >Please read http://dts-l.org/goodpost.htm on how to
post
>> messages to NG's
>> >or
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> 27pmvp.asp
>> >
>> >"John" > wrote in
>> message
>> ...
>> >> The problems are a slow down of the computer after
about
>> >> an hour then regular 'freezing' requiring <ctrl alt
del>
>> >> to unfreeze. I have also had blue screens but not
that
>> >> often. The main difficulty seems to be scandisk -
keeps
>> >> reporting that it has restarted 10 times
>> because 'Windows
>> >> or another programme has written to this disk'
offering
>> >> the suggestion to close some programmes, but no other
>> ones
>> >> are running as far as I can tell.
>> >> Spy bot removed 'Alexa Related' 1; 'Roings
objsafe.tdb'
>> >> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO Exploit'
>> >> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42 (including 'Date
>> >> Manager').
>> >> The 'mem doubler' is disabled.
>> >> There are no entries under [vcache] in system.ini and
>> the
>> >> following entries under [386enh]
>> >> ebios=*ebios
>> >> woafont=dosapp.fon
>> >> mouse=*vmouse,msmouse.vxd
>> >> device=*dynapage
>> >> device=*vcd
>> >> device=*vpd
>> >> device=*int13
>> >> device=*enable
>> >> keyboard=*vkd
>> >> display=*vdd,vflatd
>> >> EMMExclude=C000-CFFF
>> >>
>> >> Having run McAffee anti virus, still no viruses are
>> >> showing, but (still) these 'potentially unwanted
>> >> programmes' are shown- 'ProcKill-Term' 'Adware-
>> >> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The
file
>> >> locations for these are all c:\_restore\archive\ and
I
>> >> cannot clean / quarrantine / delete them as the disc
is
>> >> write protected.
>> >>
>> >> John.
>> >> >-----Original Message-----
>> >> >OK - this thread has been going for some time, and I
>> >> think it's necessary to
>> >> >have a review of where we actually are....
>> >> >
>> >> >1) what exact symptoms are you seeing, when?-
>> >> >2) what spyware items did AdAware/Spy-bot remove?
>> (don't
>> >> bother with the
>> >> >cookies, just eh actual spyware items)
>> >> >3) is the mem 'doubler' uninstalled? - if not, then
do
>> so
>> >> please!
>> >> >4) what entries in SYSTEM.INI are there under the
>> >> [vcache] and [386Enh]
>> >> >headers?
>> >> >
>> >> >
>> >> >--
>> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >> >
>> >> >Nil Carborundum Illegitemi
>> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >> >
>> >> >Please read http://dts-l.org/goodpost.htm on how to
>> post
>> >> messages to NG's
>> >> >or
>> >>
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> >> 27pmvp.asp
>> >> >
>> >> >"John" > wrote
in
>> >> message
>> >> ...
>> >> >> Have pruned startup to 7 (when <ctrl Alt Del>) and
>> Ad-
>> >> >> Aware shows 'only'22 running processes. Lots of
>> stuff
>> >> >> sorted and deleted / disabled and computer starts
>> much
>> >> >> faster (thanks) but the basic problem still seems
to
>> >> >> remain! Any other thoughts?
>> >> >> John
>> >> >
>> >> >
>> >> >.
>> >> >
>> >
>> >
>> >.
>> >
>
>
>.
>

[Noel Paton]

Hmm - I just downloaded f-prot myself, and found that they'd changed it
considerably since last time.

the DOS download is actually designed to run under windows for some reason -
removing the entire point of a DOS scanner!

However - if you create a DOS boot disk for ME, and boot with that, you can
then run f-prot from the a:\> prompt and floppies by following the
instructions here
http://www.f-prot.com/support/dos/fpdos_faq/06.html

HTH - and good luck

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp

"John" > wrote in message
...
> Am still looking for access to a 'known-clean' computer to
> follow your last suggestion. Looked at downloading F-Prot
> AntiVirus for DOS to my desktop - success downloading, but
> it stops running after about 20 minutes and the only way
> out is to use A-C-D to end task. (Incidentally, there was
> no option to create boot disks with the download - unless
> I've missed the point!)
>
> Since starting this thread, the symptoms have eased - now
> the computer will run for between three and four hours
> before frezing - last time it was on the internet and I
> had to resort to turning off the power, as C-A-D didn't
> work, neither did Start-Shutdown. I don't always get blue
> screens, and when I do, there are not always error codes.
>
> Having re-run Adaware and Spybot, nothing is showing as
> other than cookies and 'low risk data miners (all of which
> I get rid of). McAffee still up to date but shows no
> viruses jus the 'potentially unwanted programmes'.
>
> Maybe I just need to be satisfied with only using the
> computer for less than 3 hours at a time?!
> John.
> >-----Original Message-----
> >Command line scanners can require to be run from real-
> mode DOS - and Norton
> >still doesn't really recognise the existence of ME, or
> (probably) the fact
> >that it doesn't support Real-Mode DOS under Windows.
> >Try running the scanner from a DOS boot with a floppy
> disk - see if that
> >enables it
> >
> >HOWEVER - where did you get the program from?? - AFAICT,
> it hasn't been
> >updated for years, so is likely to be less than useless
> (if it's not
> >actually an infector itself!) searches on Norton site
> don't come up with
> >current versions.
> >
> >If you want to check with a real DOS scanner - not a bad
> idea,
> >occasionally - download F-Prot for DOS from www.f-
> prot.com on a known-clean
> >machine, create the boot disks from the download, and use
> that on your PC.
> >Note that allowing any such scanner to delete items in
> the C:\_Restore
> >archive will break System Restore, and you'll need to
> reset it on the reboot
> >to Windows
> >
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >
> >"John" > wrote in
> message
> ...
> >> I believe 'roings' and 'conducent' have both been
> removed -
> >> searching for files / folders only shows one file for
> >> each, in the S&D Restore directory. The 'Gain' items
> have
> >> also been removed.
> >> Looking in the 'recovery' list of S&D it shows that all
> >> the DSO entries have the following path -
> >>
> HKEY_USERS\DEFAULT\software\microsoft\windows\curr entVersio
> >> n\InternetSettings\Zones\0\1004!=W=3 (which means
> nothing
> >> to me!)
> >> The link to the web for 'HideWindow' gives removal
> >> instructions but checking my directories, I do not have
> >> the directories mentioned for the command line. Also,
> >> having downloaded Norton 'navc' I am not convinced I
> have
> >> a command line scanner ... nor can I get it to run. Put
> >> that down to ignorance on my part! (I would like to be
> >> able to get rid of 'HideWindow' if I can - I'm not sure
> I
> >> like the sound of it!)
> >> As regards the blue screens - last night having been on
> >> the computer for just over three hours with things
> >> seemingly OK, I went to use a game (Rhajonng Tile game)
> >> and got the error message 'OE:0028:C0099D66' pressing
> the
> >> spacebar returned me to the desk top (nothing else
> running
> >> at the time. I was able to open Word and Works but
> >> closing them and going to the internet thta seemed OK.
> >> Closing down AOL immediately led to another error
> >> message 'OE:28:C0030AE6' and the computer hung. Only
> way
> >> out was <c a d> .
> >> I've looked for the error messages on the internet, but
> >> got nowhere fast.
> >>
> >> In the past, when programmes have frozen, I've not
> always
> >> got blue screens. Normally the only thing that comes up
> >> as 'not responding' is the programme I'm in at the time
> (I
> >> rarely have more than one open at a time). This can be
> >> Word, Works, Games (these usually crash then give blue
> >> screens but unfortunately I've not noted the error
> >> messages). I'll do better in future! (so far tonight,
> >> I've been on this for about 3 hours and all seems to be
> >> going OK ....)
> >> John.
> >> >-----Original Message-----
> >> >OK
> >> >last things first- items in the C:\_Restore tree can be
> >> safely ignore for
> >> >the moment - look here for details
> >> >http://support.microsoft.com/?scid=263455
> >> >
> >> >for the rest - Roings seems to be a particularly nasty
> >> piece of work - look
> >> >here
> >> >http://www.pestpatrol.com/PestInfo/r/roings_com.asp
> >> >Conducent....
> >> >http://sarc.com/avcenter/venc/data/adware.tsadbot.html
> >> >The two Gain items are both from Gator - have you
> >> uninstalled it? - but
> >> >should have been removed effectively by Spybot/Ad-
> Aware.
> >> >The DSO exploit could cover a multitude of sins - or
> >> nothing at all,
> >> >depending on the rest of the details.
> >> >'Alexa related' is actually installed with all versions
> >> of IE (above 5.0,
> >> >IIRC) - and is only activated if you use the 'related
> >> items' option in the
> >> >Search tool. - it is usually quite safe (but....<g>)
> >> >
> >> >'HideWindow' is an interesting one - since it's in your
> >> Restore archive, it
> >> >should have been removed - but perhaps not, so look
> here
> >> for some details
> >> >http://vil.nai.com/vil/content/v_99939.htm
> >> >
> >> >Make sure that you make a note of ALL error messages
> (if
> >> you get a 'Cascade'
> >> >effect , then only the first is usually relevant), and
> >> post back - these
> >> >messages offer a certain amount of info, which can be
> >> invaluable in
> >> >isolating a cause.
> >> >
> >> >When you use C-A-D to unfreeze - what's running? - does
> >> the very action of
> >> >using the option unfreeze the PC, or do you have to
> end a
> >> task - is it
> >> >always the same task? Does anything show as 'Not
> >> responding??
> >> >
> >> >
> >> >HTH
> >> >
> >> >--
> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >
> >> >Nil Carborundum Illegitemi
> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >
> >> >Please read http://dts-l.org/goodpost.htm on how to
> post
> >> messages to NG's
> >> >or
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> 27pmvp.asp
> >> >
> >> >"John" > wrote in
> >> message
> >> ...
> >> >> The problems are a slow down of the computer after
> about
> >> >> an hour then regular 'freezing' requiring <ctrl alt
> del>
> >> >> to unfreeze. I have also had blue screens but not
> that
> >> >> often. The main difficulty seems to be scandisk -
> keeps
> >> >> reporting that it has restarted 10 times
> >> because 'Windows
> >> >> or another programme has written to this disk'
> offering
> >> >> the suggestion to close some programmes, but no other
> >> ones
> >> >> are running as far as I can tell.
> >> >> Spy bot removed 'Alexa Related' 1; 'Roings
> objsafe.tdb'
> >> >> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO Exploit'
> >> >> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42 (including 'Date
> >> >> Manager').
> >> >> The 'mem doubler' is disabled.
> >> >> There are no entries under [vcache] in system.ini and
> >> the
> >> >> following entries under [386enh]
> >> >> ebios=*ebios
> >> >> woafont=dosapp.fon
> >> >> mouse=*vmouse,msmouse.vxd
> >> >> device=*dynapage
> >> >> device=*vcd
> >> >> device=*vpd
> >> >> device=*int13
> >> >> device=*enable
> >> >> keyboard=*vkd
> >> >> display=*vdd,vflatd
> >> >> EMMExclude=C000-CFFF
> >> >>
> >> >> Having run McAffee anti virus, still no viruses are
> >> >> showing, but (still) these 'potentially unwanted
> >> >> programmes' are shown- 'ProcKill-Term' 'Adware-
> >> >> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The
> file
> >> >> locations for these are all c:\_restore\archive\ and
> I
> >> >> cannot clean / quarrantine / delete them as the disc
> is
> >> >> write protected.
> >> >>
> >> >> John.
> >> >> >-----Original Message-----
> >> >> >OK - this thread has been going for some time, and I
> >> >> think it's necessary to
> >> >> >have a review of where we actually are....
> >> >> >
> >> >> >1) what exact symptoms are you seeing, when?-
> >> >> >2) what spyware items did AdAware/Spy-bot remove?
> >> (don't
> >> >> bother with the
> >> >> >cookies, just eh actual spyware items)
> >> >> >3) is the mem 'doubler' uninstalled? - if not, then
> do
> >> so
> >> >> please!
> >> >> >4) what entries in SYSTEM.INI are there under the
> >> >> [vcache] and [386Enh]
> >> >> >headers?
> >> >> >
> >> >> >
> >> >> >--
> >> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >> >
> >> >> >Nil Carborundum Illegitemi
> >> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >> >
> >> >> >Please read http://dts-l.org/goodpost.htm on how to
> >> post
> >> >> messages to NG's
> >> >> >or
> >> >>
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> >> 27pmvp.asp
> >> >> >
> >> >> >"John" > wrote
> in
> >> >> message
> >> >> ...
> >> >> >> Have pruned startup to 7 (when <ctrl Alt Del>) and
> >> Ad-
> >> >> >> Aware shows 'only'22 running processes. Lots of
> >> stuff
> >> >> >> sorted and deleted / disabled and computer starts
> >> much
> >> >> >> faster (thanks) but the basic problem still seems
> to
> >> >> >> remain! Any other thoughts?
> >> >> >> John
> >> >> >
> >> >> >
> >> >> >.
> >> >> >
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

[John]

Noel, Thanks for the ongoing support! Have run f-prot and
had to leave it overnight but it reported -
0 infected; 1 suspicious (although didn't say what or
where!) and as I asked it only to report, it didn't delete
disinfect or rename. It checked 56,640 files 1 MBR 1 boot
sector and 129,261 objects in a time of 236:18 (which I
presume is just under 4 hours).

As the computer was on in 'DOS' mode overnight, I assume
the problem is only evident when windows is running, but
then again, the time seems to vary from between 3 and 4
hours before it crashes or freezes.

Perhaps the time has come to wait and see how I get on
over the next few weeks then post a new message if things
get no better - unless you have any thoughts about the
blue screen error messages or other suggestions .... other
than shoot the computer!
John.
>-----Original Message-----
>Hmm - I just downloaded f-prot myself, and found that
they'd changed it
>considerably since last time.
>
>the DOS download is actually designed to run under
windows for some reason -
>removing the entire point of a DOS scanner!
>
>However - if you create a DOS boot disk for ME, and boot
with that, you can
>then run f-prot from the a:\> prompt and floppies by
following the
>instructions here
>http://www.f-prot.com/support/dos/fpdos_faq/06.html
>
>HTH - and good luck
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>
>"John" > wrote in
message
...
>> Am still looking for access to a 'known-clean' computer
to
>> follow your last suggestion. Looked at downloading F-
Prot
>> AntiVirus for DOS to my desktop - success downloading,
but
>> it stops running after about 20 minutes and the only way
>> out is to use A-C-D to end task. (Incidentally, there
was
>> no option to create boot disks with the download -
unless
>> I've missed the point!)
>>
>> Since starting this thread, the symptoms have eased -
now
>> the computer will run for between three and four hours
>> before frezing - last time it was on the internet and I
>> had to resort to turning off the power, as C-A-D didn't
>> work, neither did Start-Shutdown. I don't always get
blue
>> screens, and when I do, there are not always error
codes.
>>
>> Having re-run Adaware and Spybot, nothing is showing as
>> other than cookies and 'low risk data miners (all of
which
>> I get rid of). McAffee still up to date but shows no
>> viruses jus the 'potentially unwanted programmes'.
>>
>> Maybe I just need to be satisfied with only using the
>> computer for less than 3 hours at a time?!
>> John.
>> >-----Original Message-----
>> >Command line scanners can require to be run from real-
>> mode DOS - and Norton
>> >still doesn't really recognise the existence of ME, or
>> (probably) the fact
>> >that it doesn't support Real-Mode DOS under Windows.
>> >Try running the scanner from a DOS boot with a floppy
>> disk - see if that
>> >enables it
>> >
>> >HOWEVER - where did you get the program from?? -
AFAICT,
>> it hasn't been
>> >updated for years, so is likely to be less than useless
>> (if it's not
>> >actually an infector itself!) searches on Norton site
>> don't come up with
>> >current versions.
>> >
>> >If you want to check with a real DOS scanner - not a
bad
>> idea,
>> >occasionally - download F-Prot for DOS from www.f-
>> prot.com on a known-clean
>> >machine, create the boot disks from the download, and
use
>> that on your PC.
>> >Note that allowing any such scanner to delete items in
>> the C:\_Restore
>> >archive will break System Restore, and you'll need to
>> reset it on the reboot
>> >to Windows
>> >
>> >
>> >--
>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >
>> >Nil Carborundum Illegitemi
>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >
>> >Please read http://dts-l.org/goodpost.htm on how to
post
>> messages to NG's
>> >or
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> 27pmvp.asp
>> >
>> >"John" > wrote in
>> message
>> ...
>> >> I believe 'roings' and 'conducent' have both been
>> removed -
>> >> searching for files / folders only shows one file
for
>> >> each, in the S&D Restore directory. The 'Gain' items
>> have
>> >> also been removed.
>> >> Looking in the 'recovery' list of S&D it shows that
all
>> >> the DSO entries have the following path -
>> >>
>>
HKEY_USERS\DEFAULT\software\microsoft\windows\curr entVersio
>> >> n\InternetSettings\Zones\0\1004!=W=3 (which means
>> nothing
>> >> to me!)
>> >> The link to the web for 'HideWindow' gives removal
>> >> instructions but checking my directories, I do not
have
>> >> the directories mentioned for the command line.
Also,
>> >> having downloaded Norton 'navc' I am not convinced I
>> have
>> >> a command line scanner ... nor can I get it to run.
Put
>> >> that down to ignorance on my part! (I would like to
be
>> >> able to get rid of 'HideWindow' if I can - I'm not
sure
>> I
>> >> like the sound of it!)
>> >> As regards the blue screens - last night having been
on
>> >> the computer for just over three hours with things
>> >> seemingly OK, I went to use a game (Rhajonng Tile
game)
>> >> and got the error message 'OE:0028:C0099D66' pressing
>> the
>> >> spacebar returned me to the desk top (nothing else
>> running
>> >> at the time. I was able to open Word and Works but
>> >> closing them and going to the internet thta seemed
OK.
>> >> Closing down AOL immediately led to another error
>> >> message 'OE:28:C0030AE6' and the computer hung. Only
>> way
>> >> out was <c a d> .
>> >> I've looked for the error messages on the internet,
but
>> >> got nowhere fast.
>> >>
>> >> In the past, when programmes have frozen, I've not
>> always
>> >> got blue screens. Normally the only thing that
comes up
>> >> as 'not responding' is the programme I'm in at the
time
>> (I
>> >> rarely have more than one open at a time). This can
be
>> >> Word, Works, Games (these usually crash then give
blue
>> >> screens but unfortunately I've not noted the error
>> >> messages). I'll do better in future! (so far
tonight,
>> >> I've been on this for about 3 hours and all seems to
be
>> >> going OK ....)
>> >> John.
>> >> >-----Original Message-----
>> >> >OK
>> >> >last things first- items in the C:\_Restore tree
can be
>> >> safely ignore for
>> >> >the moment - look here for details
>> >> >http://support.microsoft.com/?scid=263455
>> >> >
>> >> >for the rest - Roings seems to be a particularly
nasty
>> >> piece of work - look
>> >> >here
>> >> >http://www.pestpatrol.com/PestInfo/r/roings_com.asp
>> >> >Conducent....
>> >>
>http://sarc.com/avcenter/venc/data/adware.tsadbot.html
>> >> >The two Gain items are both from Gator - have you
>> >> uninstalled it? - but
>> >> >should have been removed effectively by Spybot/Ad-
>> Aware.
>> >> >The DSO exploit could cover a multitude of sins - or
>> >> nothing at all,
>> >> >depending on the rest of the details.
>> >> >'Alexa related' is actually installed with all
versions
>> >> of IE (above 5.0,
>> >> >IIRC) - and is only activated if you use
the 'related
>> >> items' option in the
>> >> >Search tool. - it is usually quite safe (but....<g>)
>> >> >
>> >> >'HideWindow' is an interesting one - since it's in
your
>> >> Restore archive, it
>> >> >should have been removed - but perhaps not, so look
>> here
>> >> for some details
>> >> >http://vil.nai.com/vil/content/v_99939.htm
>> >> >
>> >> >Make sure that you make a note of ALL error messages
>> (if
>> >> you get a 'Cascade'
>> >> >effect , then only the first is usually relevant),
and
>> >> post back - these
>> >> >messages offer a certain amount of info, which can
be
>> >> invaluable in
>> >> >isolating a cause.
>> >> >
>> >> >When you use C-A-D to unfreeze - what's running? -
does
>> >> the very action of
>> >> >using the option unfreeze the PC, or do you have to
>> end a
>> >> task - is it
>> >> >always the same task? Does anything show as 'Not
>> >> responding??
>> >> >
>> >> >
>> >> >HTH
>> >> >
>> >> >--
>> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >> >
>> >> >Nil Carborundum Illegitemi
>> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >> >
>> >> >Please read http://dts-l.org/goodpost.htm on how to
>> post
>> >> messages to NG's
>> >> >or
>> >>
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> >> 27pmvp.asp
>> >> >
>> >> >"John" > wrote
in
>> >> message
>> >> ...
>> >> >> The problems are a slow down of the computer after
>> about
>> >> >> an hour then regular 'freezing' requiring <ctrl
alt
>> del>
>> >> >> to unfreeze. I have also had blue screens but not
>> that
>> >> >> often. The main difficulty seems to be scandisk -
>> keeps
>> >> >> reporting that it has restarted 10 times
>> >> because 'Windows
>> >> >> or another programme has written to this disk'
>> offering
>> >> >> the suggestion to close some programmes, but no
other
>> >> ones
>> >> >> are running as far as I can tell.
>> >> >> Spy bot removed 'Alexa Related' 1; 'Roings
>> objsafe.tdb'
>> >> >> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO
Exploit'
>> >> >> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42
(including 'Date
>> >> >> Manager').
>> >> >> The 'mem doubler' is disabled.
>> >> >> There are no entries under [vcache] in system.ini
and
>> >> the
>> >> >> following entries under [386enh]
>> >> >> ebios=*ebios
>> >> >> woafont=dosapp.fon
>> >> >> mouse=*vmouse,msmouse.vxd
>> >> >> device=*dynapage
>> >> >> device=*vcd
>> >> >> device=*vpd
>> >> >> device=*int13
>> >> >> device=*enable
>> >> >> keyboard=*vkd
>> >> >> display=*vdd,vflatd
>> >> >> EMMExclude=C000-CFFF
>> >> >>
>> >> >> Having run McAffee anti virus, still no viruses
are
>> >> >> showing, but (still) these 'potentially unwanted
>> >> >> programmes' are shown- 'ProcKill-Term' 'Adware-
>> >> >> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The
>> file
>> >> >> locations for these are all c:\_restore\archive\
and
>> I
>> >> >> cannot clean / quarrantine / delete them as the
disc
>> is
>> >> >> write protected.
>> >> >>
>> >> >> John.
>> >> >> >-----Original Message-----
>> >> >> >OK - this thread has been going for some time,
and I
>> >> >> think it's necessary to
>> >> >> >have a review of where we actually are....
>> >> >> >
>> >> >> >1) what exact symptoms are you seeing, when?-
>> >> >> >2) what spyware items did AdAware/Spy-bot remove?
>> >> (don't
>> >> >> bother with the
>> >> >> >cookies, just eh actual spyware items)
>> >> >> >3) is the mem 'doubler' uninstalled? - if not,
then
>> do
>> >> so
>> >> >> please!
>> >> >> >4) what entries in SYSTEM.INI are there under the
>> >> >> [vcache] and [386Enh]
>> >> >> >headers?
>> >> >> >
>> >> >> >
>> >> >> >--
>> >> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >> >> >
>> >> >> >Nil Carborundum Illegitemi
>> >> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >> >> >
>> >> >> >Please read http://dts-l.org/goodpost.htm on how
to
>> >> post
>> >> >> messages to NG's
>> >> >> >or
>> >> >>
>> >>
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> >> >> 27pmvp.asp
>> >> >> >
>> >> >> >"John" >
wrote
>> in
>> >> >> message
>> >> >> ...
>> >> >> >> Have pruned startup to 7 (when <ctrl Alt Del>)
and
>> >> Ad-
>> >> >> >> Aware shows 'only'22 running processes. Lots
of
>> >> stuff
>> >> >> >> sorted and deleted / disabled and computer
starts
>> >> much
>> >> >> >> faster (thanks) but the basic problem still
seems
>> to
>> >> >> >> remain! Any other thoughts?
>> >> >> >> John
>> >> >> >
>> >> >> >
>> >> >> >.
>> >> >> >
>> >> >
>> >> >
>> >> >.
>> >> >
>> >
>> >
>> >.
>> >
>
>
>.
>

[Noel Paton]

We've really done about all we can to make sure that the box is clear of
malware of any kind, so we're set for the next round in the fight!<g>

0E:0028 errors are often the results of driver problems - usually the
graphics.
Reboot to Safe Mode
Open Device Manager
Remove ALL Display Adapters
Remove ALL Monitors
Reboot to Normal Mode - Windows will reinstall the required drivers

play with a few programs, and see if that helps.


Errors/Freezes can also be caused by problems with the RAM - download
DocMemory from www.simmtester.com and create the boot disk. Use this to boot
the PC, and run the test overnight to check the RAM thoroughly.
See what it reports.
If you get ANY errors, try using memtest86 from www.memtest86.com - between
the two, they should identify the problem stick, if you rerun with only the
one stick in at a time.

HTH
--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp

"John" > wrote in message
...
> Noel, Thanks for the ongoing support! Have run f-prot and
> had to leave it overnight but it reported -
> 0 infected; 1 suspicious (although didn't say what or
> where!) and as I asked it only to report, it didn't delete
> disinfect or rename. It checked 56,640 files 1 MBR 1 boot
> sector and 129,261 objects in a time of 236:18 (which I
> presume is just under 4 hours).
>
> As the computer was on in 'DOS' mode overnight, I assume
> the problem is only evident when windows is running, but
> then again, the time seems to vary from between 3 and 4
> hours before it crashes or freezes.
>
> Perhaps the time has come to wait and see how I get on
> over the next few weeks then post a new message if things
> get no better - unless you have any thoughts about the
> blue screen error messages or other suggestions .... other
> than shoot the computer!
> John.
> >-----Original Message-----
> >Hmm - I just downloaded f-prot myself, and found that
> they'd changed it
> >considerably since last time.
> >
> >the DOS download is actually designed to run under
> windows for some reason -
> >removing the entire point of a DOS scanner!
> >
> >However - if you create a DOS boot disk for ME, and boot
> with that, you can
> >then run f-prot from the a:\> prompt and floppies by
> following the
> >instructions here
> >http://www.f-prot.com/support/dos/fpdos_faq/06.html
> >
> >HTH - and good luck
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >
> >"John" > wrote in
> message
> ...
> >> Am still looking for access to a 'known-clean' computer
> to
> >> follow your last suggestion. Looked at downloading F-
> Prot
> >> AntiVirus for DOS to my desktop - success downloading,
> but
> >> it stops running after about 20 minutes and the only way
> >> out is to use A-C-D to end task. (Incidentally, there
> was
> >> no option to create boot disks with the download -
> unless
> >> I've missed the point!)
> >>
> >> Since starting this thread, the symptoms have eased -
> now
> >> the computer will run for between three and four hours
> >> before frezing - last time it was on the internet and I
> >> had to resort to turning off the power, as C-A-D didn't
> >> work, neither did Start-Shutdown. I don't always get
> blue
> >> screens, and when I do, there are not always error
> codes.
> >>
> >> Having re-run Adaware and Spybot, nothing is showing as
> >> other than cookies and 'low risk data miners (all of
> which
> >> I get rid of). McAffee still up to date but shows no
> >> viruses jus the 'potentially unwanted programmes'.
> >>
> >> Maybe I just need to be satisfied with only using the
> >> computer for less than 3 hours at a time?!
> >> John.
> >> >-----Original Message-----
> >> >Command line scanners can require to be run from real-
> >> mode DOS - and Norton
> >> >still doesn't really recognise the existence of ME, or
> >> (probably) the fact
> >> >that it doesn't support Real-Mode DOS under Windows.
> >> >Try running the scanner from a DOS boot with a floppy
> >> disk - see if that
> >> >enables it
> >> >
> >> >HOWEVER - where did you get the program from?? -
> AFAICT,
> >> it hasn't been
> >> >updated for years, so is likely to be less than useless
> >> (if it's not
> >> >actually an infector itself!) searches on Norton site
> >> don't come up with
> >> >current versions.
> >> >
> >> >If you want to check with a real DOS scanner - not a
> bad
> >> idea,
> >> >occasionally - download F-Prot for DOS from www.f-
> >> prot.com on a known-clean
> >> >machine, create the boot disks from the download, and
> use
> >> that on your PC.
> >> >Note that allowing any such scanner to delete items in
> >> the C:\_Restore
> >> >archive will break System Restore, and you'll need to
> >> reset it on the reboot
> >> >to Windows
> >> >
> >> >
> >> >--
> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >
> >> >Nil Carborundum Illegitemi
> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >
> >> >Please read http://dts-l.org/goodpost.htm on how to
> post
> >> messages to NG's
> >> >or
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> 27pmvp.asp
> >> >
> >> >"John" > wrote in
> >> message
> >> ...
> >> >> I believe 'roings' and 'conducent' have both been
> >> removed -
> >> >> searching for files / folders only shows one file
> for
> >> >> each, in the S&D Restore directory. The 'Gain' items
> >> have
> >> >> also been removed.
> >> >> Looking in the 'recovery' list of S&D it shows that
> all
> >> >> the DSO entries have the following path -
> >> >>
> >>
> HKEY_USERS\DEFAULT\software\microsoft\windows\curr entVersio
> >> >> n\InternetSettings\Zones\0\1004!=W=3 (which means
> >> nothing
> >> >> to me!)
> >> >> The link to the web for 'HideWindow' gives removal
> >> >> instructions but checking my directories, I do not
> have
> >> >> the directories mentioned for the command line.
> Also,
> >> >> having downloaded Norton 'navc' I am not convinced I
> >> have
> >> >> a command line scanner ... nor can I get it to run.
> Put
> >> >> that down to ignorance on my part! (I would like to
> be
> >> >> able to get rid of 'HideWindow' if I can - I'm not
> sure
> >> I
> >> >> like the sound of it!)
> >> >> As regards the blue screens - last night having been
> on
> >> >> the computer for just over three hours with things
> >> >> seemingly OK, I went to use a game (Rhajonng Tile
> game)
> >> >> and got the error message 'OE:0028:C0099D66' pressing
> >> the
> >> >> spacebar returned me to the desk top (nothing else
> >> running
> >> >> at the time. I was able to open Word and Works but
> >> >> closing them and going to the internet thta seemed
> OK.
> >> >> Closing down AOL immediately led to another error
> >> >> message 'OE:28:C0030AE6' and the computer hung. Only
> >> way
> >> >> out was <c a d> .
> >> >> I've looked for the error messages on the internet,
> but
> >> >> got nowhere fast.
> >> >>
> >> >> In the past, when programmes have frozen, I've not
> >> always
> >> >> got blue screens. Normally the only thing that
> comes up
> >> >> as 'not responding' is the programme I'm in at the
> time
> >> (I
> >> >> rarely have more than one open at a time). This can
> be
> >> >> Word, Works, Games (these usually crash then give
> blue
> >> >> screens but unfortunately I've not noted the error
> >> >> messages). I'll do better in future! (so far
> tonight,
> >> >> I've been on this for about 3 hours and all seems to
> be
> >> >> going OK ....)
> >> >> John.
> >> >> >-----Original Message-----
> >> >> >OK
> >> >> >last things first- items in the C:\_Restore tree
> can be
> >> >> safely ignore for
> >> >> >the moment - look here for details
> >> >> >http://support.microsoft.com/?scid=263455
> >> >> >
> >> >> >for the rest - Roings seems to be a particularly
> nasty
> >> >> piece of work - look
> >> >> >here
> >> >> >http://www.pestpatrol.com/PestInfo/r/roings_com.asp
> >> >> >Conducent....
> >> >>
> >http://sarc.com/avcenter/venc/data/adware.tsadbot.html
> >> >> >The two Gain items are both from Gator - have you
> >> >> uninstalled it? - but
> >> >> >should have been removed effectively by Spybot/Ad-
> >> Aware.
> >> >> >The DSO exploit could cover a multitude of sins - or
> >> >> nothing at all,
> >> >> >depending on the rest of the details.
> >> >> >'Alexa related' is actually installed with all
> versions
> >> >> of IE (above 5.0,
> >> >> >IIRC) - and is only activated if you use
> the 'related
> >> >> items' option in the
> >> >> >Search tool. - it is usually quite safe (but....<g>)
> >> >> >
> >> >> >'HideWindow' is an interesting one - since it's in
> your
> >> >> Restore archive, it
> >> >> >should have been removed - but perhaps not, so look
> >> here
> >> >> for some details
> >> >> >http://vil.nai.com/vil/content/v_99939.htm
> >> >> >
> >> >> >Make sure that you make a note of ALL error messages
> >> (if
> >> >> you get a 'Cascade'
> >> >> >effect , then only the first is usually relevant),
> and
> >> >> post back - these
> >> >> >messages offer a certain amount of info, which can
> be
> >> >> invaluable in
> >> >> >isolating a cause.
> >> >> >
> >> >> >When you use C-A-D to unfreeze - what's running? -
> does
> >> >> the very action of
> >> >> >using the option unfreeze the PC, or do you have to
> >> end a
> >> >> task - is it
> >> >> >always the same task? Does anything show as 'Not
> >> >> responding??
> >> >> >
> >> >> >
> >> >> >HTH
> >> >> >
> >> >> >--
> >> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >> >
> >> >> >Nil Carborundum Illegitemi
> >> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >> >
> >> >> >Please read http://dts-l.org/goodpost.htm on how to
> >> post
> >> >> messages to NG's
> >> >> >or
> >> >>
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> >> 27pmvp.asp
> >> >> >
> >> >> >"John" > wrote
> in
> >> >> message
> >> >> ...
> >> >> >> The problems are a slow down of the computer after
> >> about
> >> >> >> an hour then regular 'freezing' requiring <ctrl
> alt
> >> del>
> >> >> >> to unfreeze. I have also had blue screens but not
> >> that
> >> >> >> often. The main difficulty seems to be scandisk -
> >> keeps
> >> >> >> reporting that it has restarted 10 times
> >> >> because 'Windows
> >> >> >> or another programme has written to this disk'
> >> offering
> >> >> >> the suggestion to close some programmes, but no
> other
> >> >> ones
> >> >> >> are running as far as I can tell.
> >> >> >> Spy bot removed 'Alexa Related' 1; 'Roings
> >> objsafe.tdb'
> >> >> >> 1; 'Conducent TimeSink addon2vb.dll' 1; 'DSO
> Exploit'
> >> >> >> 8; 'Gain Dashbar' 1; 'Gain.Gator' 42
> (including 'Date
> >> >> >> Manager').
> >> >> >> The 'mem doubler' is disabled.
> >> >> >> There are no entries under [vcache] in system.ini
> and
> >> >> the
> >> >> >> following entries under [386enh]
> >> >> >> ebios=*ebios
> >> >> >> woafont=dosapp.fon
> >> >> >> mouse=*vmouse,msmouse.vxd
> >> >> >> device=*dynapage
> >> >> >> device=*vcd
> >> >> >> device=*vpd
> >> >> >> device=*int13
> >> >> >> device=*enable
> >> >> >> keyboard=*vkd
> >> >> >> display=*vdd,vflatd
> >> >> >> EMMExclude=C000-CFFF
> >> >> >>
> >> >> >> Having run McAffee anti virus, still no viruses
> are
> >> >> >> showing, but (still) these 'potentially unwanted
> >> >> >> programmes' are shown- 'ProcKill-Term' 'Adware-
> >> >> >> Gator' 'HideWindow' 'Adware-Gator, TSADBOT'. The
> >> file
> >> >> >> locations for these are all c:\_restore\archive\
> and
> >> I
> >> >> >> cannot clean / quarrantine / delete them as the
> disc
> >> is
> >> >> >> write protected.
> >> >> >>
> >> >> >> John.
> >> >> >> >-----Original Message-----
> >> >> >> >OK - this thread has been going for some time,
> and I
> >> >> >> think it's necessary to
> >> >> >> >have a review of where we actually are....
> >> >> >> >
> >> >> >> >1) what exact symptoms are you seeing, when?-
> >> >> >> >2) what spyware items did AdAware/Spy-bot remove?
> >> >> (don't
> >> >> >> bother with the
> >> >> >> >cookies, just eh actual spyware items)
> >> >> >> >3) is the mem 'doubler' uninstalled? - if not,
> then
> >> do
> >> >> so
> >> >> >> please!
> >> >> >> >4) what entries in SYSTEM.INI are there under the
> >> >> >> [vcache] and [386Enh]
> >> >> >> >headers?
> >> >> >> >
> >> >> >> >
> >> >> >> >--
> >> >> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >> >> >
> >> >> >> >Nil Carborundum Illegitemi
> >> >> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >> >> >
> >> >> >> >Please read http://dts-l.org/goodpost.htm on how
> to
> >> >> post
> >> >> >> messages to NG's
> >> >> >> >or
> >> >> >>
> >> >>
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> >> >> 27pmvp.asp
> >> >> >> >
> >> >> >> >"John" >
> wrote
> >> in
> >> >> >> message
> >> >> >> ...
> >> >> >> >> Have pruned startup to 7 (when <ctrl Alt Del>)
> and
> >> >> Ad-
> >> >> >> >> Aware shows 'only'22 running processes. Lots
> of
> >> >> stuff
> >> >> >> >> sorted and deleted / disabled and computer
> starts
> >> >> much
> >> >> >> >> faster (thanks) but the basic problem still
> seems
> >> to
> >> >> >> >> remain! Any other thoughts?
> >> >> >> >> John
> >> >> >> >
> >> >> >> >
> >> >> >> >.
> >> >> >> >
> >> >> >
> >> >> >
> >> >> >.
> >> >> >
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >