Windows Woes

[Spiricore]

Hi all,

I was directed here by a friend of mine when continually trying to describe a problem that's been becoming more and more of a nuisance for me. I'll do my best to explain what's been happening and what I've tried to resolve my issues.

I'm not really even sure when it started, but as of now, almost every morning I wake up and my wireless internet is down. This has become somewhat of a common problem for me for unknown reasons with my router, but I've learned to deal with it since I haven't been able to find a proper answer to fix it.

[EDIT: Well, I guess it's not being devious just when I'm asleep - this problem occurred about five minutes after finishing this post. However, most of my settings (at least trillian's) weren't lost. Just the slow-to-freeze thing.]

Anyways, after noticing that my internet is down, I'll go through the process of "properly" closing down my apps such as Trillian, uTorrent and whatever else may be open. I notice my computer get slower and slower and eventually completely freeze up - I attempt to access Windows Task Manager but it never shows up; I'm forced to do a hard reboot.

I get no errors on bootup and it usually boots up without a hitch (with a couple exceptions of it hanging on "Windows is starting up" before the login screen). I attempt to load up Trillian and any other programs I was using, and my settings are CONSTANTLY getting deleted.

So far I've noticed these things:
-Trillian: My settings and buddylist being completely reset (with errors)
-Firefox: Bookmarks deleted, window position keeps being reset as well as the toolbar - they keep going back to default. My history seems to be intact.
-uTorrent/Azureus: All of my torrents are continually deleted and I have to re-add them. Settings reset.
-Newsleecher/Newsbin: Server settings and group database/download queue wiped out.

What I've tried:
-HijackThis: I'll post my log at the bottom, but I haven't noticed anything unusual.
-Memtest-86: Let it cycle 7 times with 0 errors.
-RegistryMechanic: Finds plenty of problems, but never seems to resolve any issues.
-Avast!Antivirus: It picked up two minor viruses when I ran the bootup scan and quarantined successfully, but the virus chest has been wiped out as well *sigh*.
-AVG: Picked up one minor virus and removed successfully, virus vault wiped out as well
-Panda Online Scan: Just spyware picked up
-AdAware SE: Nothing worth mentioning
-Diskeeper: Nothing worth mentioning, no errors
-SpyBot S&D: Nothing worth mentioning
-DxDiag: (lol) no errors reported

Programs I regularly run:
-Trillain 3.1 Pro
-uTorrent 1.5
-Rainlender 0.22.1
-Daemon Tools 4.03HE
-Winamp 5.2 Pro

The main stuff:
Windows XP Pro w/SP2 fully updated
ASUS SK8N w/8.00.09 (3/29/04) BIOS
AMD Athlon 64 FX-51 (2.2ghz)
2GB RAM
Pagefile: 455mb used, 2937mb avail
DirectX 9.0c (4.09.0000.0904)
Radeon 9800XT (Omega 3.8.231 drivers) 256mb
HP L2335 flat panel monitor
SoundBlaster Audigy 2 ZS (currently screwing with drivers, been a problem for me)
Linksys Wireless-G USB Network Adapter with SpeedBooster v2
Linksys WRT54G v5 Router
Western Digital 500gb MyBook external HDD
Maxtor OneTouch II 300gb external HDD
Lite-On DVDRW SOHW-812S
Plextor PX-716UF DVDRW/DL


Logfile of HijackThis v1.99.1
Scan saved at 12:59:49 PM, on 5/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\PROGRA~1\AVG7\avgamsvr.exe
C:\PROGRA~1\AVG7\avgupsvc.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\Program Files\Diskeeper\DkService.exe
C:\Program Files\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54GSv2.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\System32\svchost.exe
E:\utorrent1.5.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\RunOnce: [Inetreg] "C:\Program Files\InstallShield Installation Information\{AC85CD9E-BC46-4874-90E6-ADB558DE7D9E}\Setup.exe" /i_again -s
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1138523444984
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143659481500
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15016/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG7\avgupsvc.exe
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: WUSB54GSv2SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54GSv2.exe (file missing)

Yes, I just noticed that (file missing) with my wireless adapter. Meh. I've screwed with the router and that thing so much, I don't even know what I'm doing anymore.

Anyways, any help would be GREATLY appreciated as I really, really do not want to reformat unless absolutely necessary. It was done less than two months ago.

If any other info is needed please let me know as well.

[EDIT: I ended up sending the Application and System logs from Windows Event Viewer to a friend and there are some very strange errors going on. He concluded that it might be that someone is attacking my network and overloading my tcpip connection limits. I'm still hoping for some second opinions ]

[EDIT: I'm adding some information from the Event Log that occurred around the time my internet died and it began it's Cycle of Death and directly after it finished rebooting. I noticed it happening around 9:15ish after the computer had been idle for a bit:

5/19/2006    9:24:55 PM    BROWSER    Error    None    8032    N/A    DESKTOP    The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{2F80E25A-2205-4B7E-9DBF-5CC4D071D822}. The backup browser is stopping.
5/19/2006    9:23:11 PM    Service Control Manager    Information    None    7036    N/A    DESKTOP    The StyleXPService service entered the stopped state.
5/19/2006    9:23:11 PM    Service Control Manager    Information    None    7035    DESKTOP\Spiricore    DESKTOP    The StyleXPService service was successfully sent a stop control.
5/19/2006    9:23:06 PM    Tcpip    Information    None    4201    N/A    DESKTOP    The system detected that network adapter \DEVICE\TCPIP_{2F80E25A-2205-4B7E-9DBF-5CC4D071D822} was connected to the network, and has initiated normal operation over the network adapter.
5/19/2006    9:23:00 PM    Service Control Manager    Information    None    7036    N/A    DESKTOP    The SSDP Discovery Service service entered the running state.
5/19/2006    9:23:00 PM    Service Control Manager    Information    None    7035    NT AUTHORITY\SYSTEM    DESKTOP    The SSDP Discovery Service service was successfully sent a start control.
5/19/2006    9:21:38 PM    BROWSER    Warning    None    8021    N/A    DESKTOP    The browser was unable to retrieve a list of servers from the browser master \\TARA-T6SG6NTWA0 on the network \Device\NetBT_Tcpip_{2F80E25A-2205-4B7E-9DBF-5CC4D071D822}. The data is the error code.
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7035    NT AUTHORITY\SYSTEM    DESKTOP    The GTNDIS5 NDIS Protocol Driver service was successfully sent a start control.
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7036    N/A    DESKTOP    The Wireless Zero Configuration service entered the stopped state.
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7035    NT AUTHORITY\SYSTEM    DESKTOP    The Wireless Zero Configuration service was successfully sent a stop control.
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7036    N/A    DESKTOP    The Application Layer Gateway Service service entered the running state.
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7035    NT AUTHORITY\SYSTEM    DESKTOP    The Application Layer Gateway Service service was successfully sent a start control.
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7036    N/A    DESKTOP    The Network Location Awareness (NLA) service entered the running state.
5/19/2006    9:21:12 PM    Service Control Manager    Error    None    7034    N/A    DESKTOP    The Avid Startup service terminated unexpectedly.  It has done this 1 time(s).
5/19/2006    9:21:12 PM    Service Control Manager    Information    None    7035    NT AUTHORITY\SYSTEM    DESKTOP    The Network Location Awareness (NLA) service was successfully sent a start control.
5/19/2006    9:20:55 PM    Tcpip    Information    None    4201    N/A    DESKTOP    The system detected that network adapter \DEVICE\TCPIP_{2F80E25A-2205-4B7E-9DBF-5CC4D071D822} was connected to the network, and has initiated normal operation over the network adapter.
5/19/2006    9:19:30 PM    ati2mtag    Error    CPLIB     52225    N/A    DESKTOP    CPLIB :: Open Session  - Failed to load the library
5/19/2006    9:19:34 PM    EventLog    Information    None    6005    N/A    DESKTOP    The Event log service was started.
5/19/2006    9:19:34 PM    EventLog    Information    None    6009    N/A    DESKTOP    Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.
5/19/2006    9:14:43 PM    EventLog    Information    None    6006    N/A    DESKTOP    The Event log service was stopped.
5/19/2006    9:14:29 PM    EventLog    Information    None    6005    N/A    DESKTOP    The Event log service was started.
5/19/2006    9:14:29 PM    EventLog    Information    None    6009    N/A    DESKTOP    Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.
5/19/2006    7:58:32 PM    Tcpip    Warning    None    4226    N/A    DESKTOP    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
5/19/2006    6:09:16 PM    Tcpip    Warning    None    4226    N/A    DESKTOP    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
5/19/2006    5:22:21 PM    sptd    Error    None    4    N/A    DESKTOP    Driver detected an internal error in its data structures for .
5/19/2006    5:22:21 PM    sptd    Error    None    4    N/A    DESKTOP    Driver detected an internal error in its data structures for .
5/19/2006    5:14:16 PM    Tcpip    Warning    None    4226    N/A    DESKTOP    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
5/19/2006    4:46:09 PM    Tcpip    Warning    None    4226    N/A    DESKTOP    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
5/19/2006    4:12:01 PM    Tcpip    Warning    None    4226    N/A    DESKTOP    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Note: TARA-T6SG6NTWA0 is the other computer connected to the router: that computer is wired to it, mine is wireless.

Thanks
-Spiricore

 

[OldMX]

Did you diagnose the hard disk?
Is hard disk using an old ide cable?

oldmx

 

[aLc0h0Lic]

You could be rootkitted, which means no hope for your Windows install. Try Rootkit Revealer from SysInternals to see if such a problem exists.

I've seen similar symptoms (and strange system warnings) on my old roomate's computer, and he ended up being rootkitted out the ass. I had spent forever trying to fix it, too!

 

[nessus]

You could be rootkitted, which means no hope for your Windows install. Try Rootkit Revealer from SysInternals to see if such a problem exists.

I've seen similar symptoms (and strange system warnings) on my old roomate's computer, and he ended up being rootkitted out the ass. I had spent forever trying to fix it, too!

This is defintely the way to go. Also, you might want to make a BartPE cd on a clean machine. Follow the directions to set up the AdAware and McAfee extra.dat plugins. Boot from the BartPE CD and run your scans from there. If you are rootkitted, it can't load and hide itself from the scanners that way.