Oddities in my Windows 7

[Jimmy_Banana]

I just spent like half an hour typing this message and adding images then I hit backspace on one of the images and that took me to the previous page and I lost it all GRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR!!!

Recently I deleted a whole bunch of programs off my system in an attempt to alleviate this @#$%#@$% horrible problem commonly referred to as "freezes" from my PC. And hey, it has improved significantly, but no smiley face just yet. Notable programs removed were Utorrent and a power saving feature which is a software to do with my motherboard or something (I would like to know how to remove this permantly or change it as my PC switches to this special standby mode after 20 minutes or something and I don't need this). Freezes in WMP and IE have been much less common since. Please note, unless I am having a big system freeze Nero works amazingly well for playing media on my annoying system.
My most common freeze now is opening a folder to display its contents, the green bar loads across the top reminiscent of searching my entire system for something, despite the 3.2Gb of accessible RAM. I tend to hear my Hard drive click when this happens.

I have noticed a few odd things on my system, maybe they are normal, but MAYBE they are causing these ghastly freezes so please take a moment and have a ponder over the images and my text.

**Sometimes when I download something like an image, I get theses strange looking icons, what are they?

**Today I was sent a dropbox link with audio which automatically opened WMP and began playing, then I had a total system freeze (basically I can move my cursor and that is all). After this my taskbar went odd as you can see in the image (bottom half not visible) which has happened before, I can not click on the icons in the new line which has appeared so it is not like a bit of a pixel left over or something, the image also shows multiple WMP's open and I assure you this was not the case:

**What are these files dulled out for and what does it mean?

Thanks for any help you can provide.

 

[Core]

I just spent like half an hour typing this message and adding images then I hit backspace on one of the images and that took me to the previous page and I lost it all

I highly recommend installing the Lazarus add-on for Firefox. With it you can accidentally move from a page and back again and you can recover what you've typed in a text form. It's been so reliable for me, in fact, that I've sometimes intentionally moved to another page in the same tab to look something up and then hit Back and continue typing, which of course I'd never have been able to do before. If you're using IE, though, well...there's always prayer and healthy living.

Recently I deleted a whole bunch of programs off my system in an attempt to alleviate this @#$%#@$% horrible problem commonly referred to as "freezes" from my PC

Run Memtest86 to check your memory, and test your hard drive too. Run CCleaner. Run HiJackThis while you're at it and post the output log here if you'd like.

The next time you have a system freeze, see if dump files have been created and upload them in our BSOD forum.

I don't know what you mean by the special standby mode. If it's a program that came with your PC, it's probably part of a bloated OEM suite which I'd recommend disposing of. Otherwise, check your Power Options in the Control Panel, go into Advanced settings and make sure it isn't set to spin down your hard drive after 20 minutes (default setting) of inactivity. I've had PCs before which did not recover well from this, and so I always keep it turned off.

You might want to turn off showing system files in Folder Options. Desktop.inis are harmless.

Typically system freezes like this are caused by faulty hardware, bad/old drivers, or some software conflicts (WMP sharing service + Windows Firewall + Norton firewall = goodnight nurse).

If it were me, though, I'd back up the data, nuke the drive from orbit ("it's the only way to be sure"), reinstall & start afresh.

 

[Elmer BeFuddled]

If you are using Firefox, take a look at the Lazarus add-on. Saved my temper a few times!

Desktop.ini's are usually placed inside a shell or "special" folder like My Documents / Pictures / Music. It contains the info about the folder being "special "/has a special icon. Why you're getting them when you download something.......

The dulled out folders are actually hidden folders. That's how you see them when you have "show hidden files and folders" enabled.

With your MoBo software I would think you would have to open the program and there would be a way of changing settings (time) in there somewhere. Then again it might be controlled through the Bios.

Whether you've had any crashes or not, it may be worth going into C:\Windows\Minidump. If there are any minidump.dmp files in there put copies in a zip file and attach them to a post. Someone will be along shortly to have a look-see for you.

 

[Elmer BeFuddled]

DAMN!! Core types faster than my one finger!

 

[Jimmy_Banana]

Goddam this really sux.
Thanks guys I appreciate your help.
Core I will run Hijackthis, as it was freeware and a quick google didn't reveal the others as such, my system denied acces to the host write file or something but it still came up with a lot of data, I couldn't see how to output the data so I had to quickly type it for you I hope there are no errors:

C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\CodeMeter\Runtime\bin\CodeMeterCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKLM\..\Policies\Explorer\Run: []
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Global Startup: CodeMeter Control Center.lnk = C:\Program Files\CodeMeter\Runtime\bin\CodeMeterCC.exe
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-au.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: CodeMeter Runtime Server (CodeMeter.exe) - WIBU-SYSTEMS AG - C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
--
End of file - 6378 bytes

 

[Elmer BeFuddled]

I personally would remove this lot from my start up:-.

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common  Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

I'd also remove these two as I don't need to use them "immediately":-

O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

There's far too much going on at Boot Up.

 

[Fire cat]

I personally would remove this lot from my start up:-.

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common  Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

I'd also remove these two as I don't need to use them "immediately":-

O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

There's far too much going on at Boot Up.

Virtual CloneDrive users Good man!

 

[Jimmy_Banana]

I personally would remove this lot from my start up.

So if these things are running at start up, they are running the whole time my PC is on?

 

[Fire cat]

So if these things are running at start up, they are running the whole time my PC is on?

Yes. In the background.

 

[Jimmy_Banana]

OK, thanks everyone, I will turn these things off and see how it turns out :unenthusisaticface:

 

[Elmer BeFuddled]

I'd actually go a tad further than just removing from Start Up for a couple of them.
First I'd download Java Ra ( a portable app.) and run the "extra options" to:-
Clear old version and useless files, disable the autorun /start up and remove the auto updater.

I'd then go to the Control Panel and, unless you are running specific "Air" products / programs, I'd uninstall Adobe Air as well.

I don't know if you are aware of Scotty, the little black dog. But he belongs to one program that's a pleasure to have in your start up, Win Patrol. He'll keep an eye open and alert you (with a Woof! if you want!!) when others try to muscle their way into the auto start registry locations.

 

[TrainableMan]

Just FYI the Desktop.ini files are settings for viewing that folding in windows explorer (sort order, display as detail list, etc). If you go to Organize ... Folder and Search Options ... View tab ... check "Hide protected operating system files" then you won't see them anymore. BTW, if you delete them it won'tcrash your system or anything; you simply will have to reset your folder settings (and the file will likely return).

Unfortunately Album Art is also considered a protected OS file and since I like to see those files I simply deal with seeing the desktop.ini or I delete it.

 

[Jimmy_Banana]

hEY THANKS FOR TAKING THE TIME GUYS, MY STUDIES ARE INTENSE RIGHT NOW i WILL BE BACK IN A COUPLE DAYS TO Look at all this in depth.

srry for caps :/

 

[Jimmy_Banana]

Thanks guys, I could not find all the programs you suggested I remove from startup in msconfig - is there a better place to do this?
Elmer I ran the Java Ra thanks, I had the latest version and it didn't find any old files, but worth a shot!

You know when you start a large program and you hear your hard drive going: vxzcxczvxczvxczvxc or whatever the sound is - well I hear that a lot! Sometimes when I am in bed and I know the computer is not doing anything it makes this noise for a couple of minutes like it is working hard doing something...?

 

[Elmer BeFuddled]

If it's at 2 o'clock in the morning, there's an excellent chance it's Adobe doing its daily check for updates!

You can remove the start up entries by putting a tick next to the 'offender' in HiJackThis and then pressing the "Fix checked" button.

Talking about HiJackThis, if you want to print a log.... when the program opens press the "Main Menu" button. At the top of the page press the "Do a system scan and save a log file" button. When it finishes HJT instantly opens the log (txt) file. The log file can be found in the HJT folder

 

[Jimmy_Banana]

Hey thanks!!! Removing just a few of these items from start up has resulted in a much cleaner looking performance in Task Manager.
Elmer you mentioned uninstalling Adobe Air, can you be more specific please, Adobe acrobat or whatever it is is usually a requirement of some websites to view a PDF document, Can I uninstall Adobe Air only, and without any problems?

I have a few more in hijackthis I want to ask if it would be safe to remove also, the last one says upnp which sounds like internet or something but it also says "magix" which is an old software DAW I don't have installed anymore. I feel delete happy but I wouldn't dare unless I got the ok from you guys. The squares I marked red, can I do away with any of these? **Please note: in hijack this when I click on "fix checked" it says it is going to permanently remove these items.. bit weird is that normal?

 

[Jimmy_Banana]

I would like to share a very pretty picture with you all, isn't it pretty \o/

 

[Elmer BeFuddled]

Yeah, you can uninstall Adobe Air and it shouldn't affect your "browsing experience". It's one of those things that when you install any Adobe stuff, even though you've said no I don't want it, it still gets installed. So as soon has Photoshop has finished installing I'm straight into the Control Panel and deleting Air. When you go to delete it, it will tell you what, if anything, will be affected.

BHO's I would go into the I.E. "Manage Add-ons" and Disable them to see how you get on. You may find you need one/both.

Services As long as they are all on manual and not on Automatic start OK. I would leave the two Nero. Windows does have its own UPnP service but I would search through all the services for Magix AX. If I found it I would disable / remove it. I'd definitely get rid of the Magix Shared from the Common Files if you no longer have the related program.

I'm not sure about the Lightscribe in your Auto Start. I'm sure it would work when you asked it so I'd be tempted to remove that as well.

 

[Jimmy_Banana]

Thanks mate

 

[TrainableMan]

BTW I was just rereading this thread ...

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

If you have special buttons on your keyboard, like mail or volume controls, then I wouldn't disable this one because it is likely what makes them function.