Freezes until Task Manager opened/closed

[Dr Gonzo]

Hello everyone
First my computer specs : ASUS P5VDC-MX motherboard, 3.4ghz Pentium D, 2 x 1GB Corsair PC2-4300, Nvidia 6200, Antec TruePower 480W PSU, Sony dvd RW, Seagate 40GB IDE HDD, windows XP Pro SP3.

I've just assembled this machine from (working) spare parts to use as a spare. After installing windows and every time i turn the pc on, i get to my desktop and everything there, icons, start button etc is unavailable to me. By unavailable i mean i can see it but i can't click on anything to open it or pull up a menu. If i then press ctrl, alt, delete, bring up the task manager and simply close it again. . . then things seem to work ok.
IE works fine and i can go online but i prefer to use firefox. Firefox is unusable as for every page i open i have to open / close task manager to be able to click on links! Using Google is a nightmare! I have scanned with AVG, spy bot S&D, malwarebytes, Advanced systemcare 3, Uniblue registerybooster and cCleaner but still have this problem. . . Please help - i'm completley out of ideas

[glc]

Examine your startup items carefully.

[Dr Gonzo]

Thanks for the reply glc. The only way i know to check what runs on startup is by using the tools in the advanced mode of Spy bot S&D. I have done this and disabled everything that didn't look needed, like the nvidia tray icon, and onboard sound. Other than those i have no idea what else i should be looking for? or where else i should look?

[EzyStvy]

If you turn on your pc and let it sit idle for ten minutes - does everything work ok?

[Dr Gonzo]

ok, i tried that and was amazed when it worked the first time. . . . tried leaving it idle again on the 2nd, 3rd and forth tries and now it doesn't work and i'm back to square one. . . I've included a screen shot of my startup items if this helps? **I have since reinstalled a different copy of windows xp pro and i'm still having the exact same problem. . . Help

[glc]

Read the sticky thread in the Security forum, then post a HijackThis log. Run it after a fresh reboot before opening ANYTHING else.

[Dr Gonzo]

ok, I've read and followed the instructions in the security thread and only adaware picked up anything - 5 cookies. I ran hijackthis and the log is attatched but i couldn't run it before doing ANYTHING as i had to open and close task manager to be able to navigate away from the desktop. I hope you can make some sense of the log hijackthis.txt

[glc]

So others can read it easily:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25:51, on 19.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\UPHClean\uphclean.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Hijackthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5224 bytes

[Dr Gonzo]

thanks glc, i didn't know whether to attatch or paste

[Dr Gonzo]

Anyone????????

[glc]

Not really - but as a test, I'd try disabling or uninstalling CoolSwitch.

[Dr Gonzo]

Thanks for the reply glc - i did as you suggested and let hijackthis fix the coolswitch entry and it seems to be a partial solution. If i boot up the machine and leave it alone untill the stuff set to run on startup has loaded up - it's still exactly the same as before. . .
However, If i start the machine and click on a random desktop icon as soon as the desktop appears, such as AVG or the recycle bin and simply close the window or program. . . everything works fine including firefox!
Maybe this behaviour will give you more of an insight into what else could be causing the problem?
Anyway, thanks for your help so far

[glc]

Start disabling more startup stuff. Use msconfig so you can easily put it back if you have problems. Maybe try getting rid of Adwatch next.

[Dr Gonzo]

I disabled as much as i could understand how to do without success. Enclosed is the log file with all the stuff disabled and still the same partially solved problem. . . Both the RO entries re appear on startup and i don't know what to do about the running process's. . . could you pls give me some instructions as to what to try nxt? Would the startup list log help you? My knowledge of operating systems is basic although i have learnt how to build several (working, lol) computers from you guys. Thanks in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:01:44, on 26.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Explorer.EXE
C:\Hijackthis\hijackthis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe /auto

--
End of file - 758 bytes

[glc]

The R0's are fine, that O4 will be there if you are using msconfig. Is that the whole log?

[Dr Gonzo]

yes that's the whole log, it was taken either running in safe mode or using a system config utility to limit the startup process. . . i forget which
just another thought, in controll panel, under user accounts 2, there is a box to tick for "secure logon" - this requires the user to press ctrl alt delete before logging on. . . obviously the box is not ticked and i have not set a user account so no logon needed. . . could there be something wrong with this function causing my problem?
I have another machine running XP and in controll panel there is no "user accounts 2" icon, nor is there the option for this "secure logon" with ctrl alt delete. . . needless to say, i am having no problems with the other machine! Do you think there's any connection?

[glc]

Is this XP Pro? If so, is it set to domain instead of workgroup? (CP, system, computer name, change)

I can see where if it's set to domain and you don't HAVE a domain, this could cause a big delay logging on while it's trying to find the nonexistent domain. Note that putting it back to workgroup could cause problems with your profile so I'd back up your files to an external drive first. If you don't have any important stuff to speak of, I'd consider a wipe and proper reinstall.

[Dr Gonzo]

hey glc, Yes, this is XP pro and 've just checked what you said and it's set to WORKGROUP. This is also a clean install of XP. I have also swapped the HDD for a 20GB Maxtor, formatted and installed on that too, with exactly the same problem