System always "NOT RESPONDING"

My PC always not responding whenever I want to do the following:
1) Post a question to the Newsgroup/Microsoft. It will take a very long time
and hang.
2) Cannot go to "Restart in MOS-DOS mode.
3) Not responding to most program on the desktop,
4) Need to restart the PC several times before it can perform task.
5) Outlook express cannot send or receive email. Need to remove account and
then recreate account before it can receive/send email.
6) Unable to do Defragmenter or Scan disk.

Thank you.

Please help.

Read the two articles in my signature. Then read them again, then apply.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Francis Chew" wrote in message
...
My PC always not responding whenever I want to do the following:
1) Post a question to the Newsgroup/Microsoft. It will take a very
long time
and hang.
2) Cannot go to "Restart in MOS-DOS mode.
3) Not responding to most program on the desktop,
4) Need to restart the PC several times before it can perform task.
5) Outlook express cannot send or receive email. Need to remove
account and
then recreate account before it can receive/send email.
6) Unable to do Defragmenter or Scan disk.

Thank you.

Please help.

"Gary S. Terhune" wrote in message
...
Read the two articles in my signature. Then read them again, then apply.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

Gary, is the second article more important, or pertinent, than the first?

They're both important. I can't say, from the OP, that the problem is
more malware than general clutter. I assume it's both, but clearing the
decks is really the first step. Getting rid of background apps, and more
importantly, dumping garbage files in TEMP, Temporary Internet Files,
3rd-party browser caches, and the Recycle Bin, etc., will make greatly
improve the ability of malware scanners to focus on stuff that's really
invaded your system, and not have to bother with the crap that is just
sitting in the cache files.

There are also a number of malware that insinuate themselves into the
Startup axis, and it's good to at least try to disable them before
installing and running scanners, since many are capable of messing with
the scanners, obfuscating themselves , etc. In fact, sometimes a simple
Clean Boot isn't enough, and you have to boot to Safe Mode... And
sometimes even *that* isn't enough.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Dave D" wrote in message
...

"Gary S. Terhune" wrote in message
...
Read the two articles in my signature. Then read them again, then
apply.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

Gary, is the second article more important, or pertinent, than the
first?

(1) Perhaps try a DOS-based virus scan, which takes any possible
infection of Windows out of the picture...
http://cquirke.mvps.org/9x/virtest.htm - formal scanning
www.f-prot.com - free DOS-based av
www.nod32.com - free DOS-based av evaluation
www.sophos.com - free DOS-based av evaluation

(2) Investigate your Startup Group, per Terhune's post.

(3)
http://support.microsoft.com/default...;EN-US;q287914
Articles about Scandisk
http://support.microsoft.com/default...;en-us;Q286263
Articles about Defrag

I must warn that Scandisk may not do a great job when there is a
great one to do...
http://cquirke.mvps.org/9x/scandisk.htm
Therefore, perhaps UNcheck "Automatically fix errors" on it's front
screen. It will then ask whether you want each error fixed. If it sounds
truly horrible, say "No!", and post the log. The log will be
"C:\Scandisk.log". Do not let it constantly restart, either.
(When running Scandisk in DOS, there won't be such a box to uncheck. You
must do it in "C:\Windows\Command\Scandisk.ini", per cquirke's advice.)
REALLY, in light of all THAT, the BEST thing to do is to have a full
system backup to run to! Would you like my list of backup apps?

1. Turn off screen saver (R-Clk Desktop, Properties, Screen Saver--
None)
2. Turn off power management (Control Panel, Power Management-- Always
On,Never,Never,Never)
3. Disable any permanent internet cable connection, perhaps.
4. Suspend Task Scheduler
5. Turn off interfering programs. Use "StartupCop" or "EndItAll2" from
PCMag (below). Or "START, Run, MSConfig, Startup tab". Note what is
unchecked. Then, go to the General tab & disable the entire Startup
Group, by clicking "Selective.." & unchecking "Load Startup...". Reboot.
Don't forget to re-enable before the next boot.
6. Use "HDValet" from PCMag, or
(a) "Control Panel, Internet Options, Delete Files button, bolt Delete
all offline content, OK, OK"
(b) "START, Run, %TEMP%", & delete all files that will let you. This
will likely be "C:\Windows\Temp". This is best done after a fresh boot,
unless you have not seen the message "Reboot to complete this install".
7. Run Scandisk (Thorough, usually w/o write testing. Check all three
items under "Scandisk, Advanced button, 'Check files for' box". If you
want to be informed as it does a fix, UNcheck "Automatically fix errors"
on the front screen, or look inside "C:\Scandisk.log" afterwards.)
8. "START, Run, Defrag /p /details". Apparently, "/p" Defrags the
unmovables.

The purpose of steps 1-5 is only to prevent constant restarts of
Scandisk & Defrag, if you get them; but DEFINITELY turn off the Virus
Scanner. Scandisk should be done perhaps once a month, and certainly
after every serious crash. Do a Defrag after a sluggish boot or when
this says so:
http://www.pcmag.com/ 's CrackUp, by Gregory A. Wolking & Bob Flanders.
Also, take DiskAction, to determine what is constantly writing to the
HDD, which causes the restarts. Take BHOCop & StartupCop too.

"DiskAction" reports the last 12 processes that access any partition. It
discovered the MS Critical Update Notification Tool was accessing my
HDD every five minutes. It can be uninstalled in "Control Panel,
Add/Remove Programs". Then, occasionally, "START, Windows Update" on
your own.

"BHOCop" found a Browser Helper Object called Wavehelper Class, created
by "Wavetop", that was building a monstrosity of an error log called
"Logit.txt" in here. "START, Find, F/F, Logit.txt"-- see one?

Now, my hard drive is quieter than my mouse. (Of course, I now also have
384 MB RAM, up from an initial 64, eliminating Swap File activity.)


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Francis Chew" wrote in message
...
| My PC always not responding whenever I want to do the following:
| 1) Post a question to the Newsgroup/Microsoft. It will take a very
long time
| and hang.
| 2) Cannot go to "Restart in MOS-DOS mode.
| 3) Not responding to most program on the desktop,
| 4) Need to restart the PC several times before it can perform task.
| 5) Outlook express cannot send or receive email. Need to remove
account and
| then recreate account before it can receive/send email.
| 6) Unable to do Defragmenter or Scan disk.
|
| Thank you.
|
| Please help.

On Tue, 19 Apr 2005 12:41:00 -0700, "Gary S. Terhune"

I can't say, from the OP, that the problem is more malware than
general clutter. I assume it's both, but clearing the decks is really
the first step. Getting rid of background apps, and more importantly,
dumping garbage files in TEMP, Temporary Internet Files, 3rd-party
browser caches, and the Recycle Bin, etc., will make greatly improve
the ability of malware scanners to focus on stuff that's really invaded
your system, and not have to bother with the crap that is just sitting
in the cache files.

Hm. A dirty little secret about mugshot-recognition scanners (av, and
anti-cm scanners such as AdAware, Spybot, etc.) is that they may look
for particular cues rather than recognise every component of a
malware. If it finds the cue component, then it looks for and manages
the rest, else it may miss it altogether.

In that sense, it may be that the original form of the malware has use
as a cue. Purging Temp and TIF may shed this useful information.

I also find it useful to see items in these locations, as an
indication of the malware's path of arrival. Something in Eudora's
Attach dir suggests it arrived as attachment, whereas if it's in
Netscape's cache rather than IE's TIF, that tells a story too.

There are also a number of malware that insinuate themselves into the
Startup axis, and it's good to at least try to disable them before installing
and running scanners, since many are capable of messing with the
scanners, obfuscating themselves , etc. In fact, sometimes a simple
Clean Boot isn't enough, and you have to boot to Safe Mode... And
sometimes even *that* isn't enough.

There are two ways to tackle malware, depending on what you believe.

If you believe that malware is capable of unbounded viciousness and
poses the biggest risk to the system, then you want to give it no
chance to shoot back. You don't waste time with scanning while
standing neck-deep in infected OS runtime, and you don't even bother
with Safe Mode. You get the hell out of the OS and you do not go back
again until you've formally detected and killed all dangerous malware.

If you believe that malware is just unwanted software that wouldn't do
anything really evil, then you'd be more concerned about accidental
breakage that may occur when you try to remove it. You do the mildest
things first, starting with Add/Remove, then scanning and cleaning in
normal Windows so System Restore can roll you back if you decide you'd
rather have a working but infected system. Only if those things don't
work, would you go Safe mode, then Safe Cmd Only, then mOS.

Which approach to use? Both are potentially valid, and you can only
answer once you know what malware you are dealing with. How do you
find that out, given the hardcore stuff may bomb your detection scans?

Finally, the malware picture is framed by a bigger one - the deeper
underlying abstraction layer of the hardware itself. As Gary says,
it's rare that you *know* malware is the sole problem; you are more
likely to suspect malware as the cause of broad-scope problems. As
hardware can cause those problems too, and may make things worse as
you work on the system, I'd want to check that first.

So, putting all the above together, this is what I do:

1) Verify hardware status
2) Formally scan for malware - but detect only, no cleaning
3) Read up detected malware for caveats
4) Formally clean what is dangerous
5) Informally clean what is safer but troublesome
6) Once system is clean and OK, purge Temp, TIF, SR etc.
7) Immediately set a new SR point and other baselines
8) Take this file bulk low-point as the chance for a good defrag
9) Patch, risk manage, set new SR points along the way

I do most traditional malware as (4), and most commercial malware as
(5), with some known-troublesome items (such as LSP intruders) as
informally and "front door" as possible, making sure that for those, I
still have SR as a fallback. But if you can't reliably determine what
the total malware load is -i.e. (2) - you're playing blind man's buff.



---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
---------- ----- ---- --- -- - - - -