Help - Search - Members - Calendar
Full Version: Help! Unexplained slowdown...
Gladiator Security Forum > Malware Help Forum > HELP! Think you are Infected?
Pages: 1, 2
Mosaic1
I'd hold off on that. When you bought this device, did it come with an install CD? And did you use the install CD to uninstall it?


What does Creative say are the minimum requirements to use this MP3 Player?
Seebald
Microsoft Windows 95/98/ME or XP
Intel Pentium II 350 MHz or higher.
64MB RAM (128 Recommended)
USB-1.1 port (2.0 recommended)
55MB free HD space
CD-ROM drive with digital audio extraction support <- that's the only one i'm not sure i got...
Mosaic1
And for this question?

QUOTE
When you bought this device, did it come with an install CD? And did you use the install CD to uninstall it?



If you didn't have any buzzing before you installed this thing then this thing is the cause of the problem unless you have had a hardware event of some sort in the meantime.


Are youusing the CD Drive when the buzzing happens? OR cn this happen even with a file you have on the hard drive and are playing?
Seebald
Use the CD to uninstall:

No, the CD did not offer such a service, I uninstalled the programs with systemmanager/software/add-remove.

Problem only occurring when using CD-Drive:

No, the problem also occurs if I dont use the CD drive (listen to MP3s on the hard drive, play games that dont require CD)
Mosaic1
Often, when you put the CD in and press install it will know the program was already installed and give you an uninstall option. That didn't happen here?


I just don't see why suddenly your system can't handle the same load it did before you installed this. OR were you putting it to the same amount of work before you installed this player?
Mosaic1
http://us.creative.com/support/downloads/

I see two updates in your Downbloaded program files.

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab


O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15016/CTPID.cab


Is it possible the problems began after you updated your MP3 player? And had you selected the autoupdate option?
Mosaic1
Creative does have a forum like this one. Mabye try there?

http://forums.creative.com/creativelabs/board?board.id=dap

Let me know if you find any help.

It's a shame to waste money on a piece of hardware and not have it work. It's even a bigger shame to find your System is not working as it should.

At this point I would also recommend that you rteinstall and or upgrade Windows Media Player to be sure you have the usual Windows Audio Codecs in place.


Being in the Security forums I tend not to get out much. It took a while for me to piece together your story. When you post at a forum, you need to give details.


Let me know how you do with this.
Seebald
oh, I already posted there (see here) but they're not as helpful as you were so far.
Mosaic1
I wish I were helpful. However we are not on solid ground here. Everything worked just fine until you installed, correct? And when was that install?

Do try the media player reinstall or upgrade. I am trying to get more but am coming up empty on this issue.

Reading your first log, I see you had Nero installed. How many CD Burning programs are currently installed on your system?

For maintenance, let's see how your file system is doing.

To run Chkdsk go to start >Run and type

cmd.exe
Press enter

Copy this command to your clipboard:
chkdsk /r /f

When the prompt appears Right click in the window and click paste on the menu.

Press enter.
You'll be told that the drive is locked and asked if you want to run the check at next boot. Choose yes.

Restart and allow it to run.

When you get back, go to Start >Run and type
Eventvwr.msc

Press enter


Double click on Application in the left pane.
Look in the right pane for an item whose source says winlogon.

Double click on that to get the report chkdsk created.

What does it say?

If you want to copy it, look at the icon which looks like two pages and click on it.

That copies it to your clipboard. Paste that in here.
Mosaic1
For General Slowdown and maybe even the sound hissing, let's look at your Device Manager again. This time expand the IDE Controllers branch.

Under that, double click on Primary Ide Channel to bring up its properties page.

Click the Advanced Settings tab.

If the Current Transfer Mode is PIO then Click the Driver Tab and uninstall the driver. Restart the computer. Check to see if it is now in DMA mode. And if it is, has your computer gained speed?


This is about all I can think of for now. After you post back we'll assess the situation again.
Seebald
QUOTE
I wish I were helpful. However we are not on solid ground here. Everything worked just fine until you installed, correct? And when was that install?


I don't exactly know about that. I installed on Jan6 and thats the day I first noticed the problems. I also uninstalled Quicktime that day, and threw the 1000 files that had been blocking the norton quarantine into the recycle bin.

My computer's currently busy with chkdsk. What I still need to know: how do I uninstall Windows Media Player? It's not listed in add/remove. I tried to upgrade it too, but windows update won't offer one that I havent already got at the time.
Seebald
Here's the asked log: (Sorry, it's german, tell me if you need translation)


Ereignistyp: Informationen
Ereignisquelle: Winlogon
Ereigniskategorie: Keine
Ereigniskennung: 1001
Datum: 23.01.2006
Zeit: 11:28:17
Benutzer: Nicht zutreffend
Computer: SEEBI-Z19CZRBKD
Beschreibung:
Dateisystem auf C: wird überprüft.
Der Typ des Dateisystems ist NTFS.
Die Volumebezeichnung lautet BOOT.

Eine Datenträgerüberprüfung ist geplant.
Die Datenträgerüberprüfung wird jetzt ausgeführt.
Kleinere Inkonsistenzen auf dem Laufwerk werden aufgeräumt.
151 nicht verwendete Indexeinträge aus Index $SII der Datei 0x9 werden aufgeräumt.
151 nicht verwendete Indexeinträge aus Index $SDH der Datei 0x9 werden aufgeräumt.
151 nicht verwendete Sicherheitsbeschreibungen werden aufgeräumt.
CHKDSK überprüft Dateidaten (Phase 4 von 5)...
Fehler beim Lesen mit Status 0xc0000185 bei Offset 0x83668e000 für 0x10000 Bytes.
Fehler beim Lesen mit Status 0xc000009c bei Offset 0x836694000 für 0x1000 Bytes.
Fehlerhafte Cluster in der Datei 82129
mit Namen \PROGRA~1\WARCRA~1\war3.mpq wurden ersetzt.
Dateidatenüberprüfung beendet.
CHKDSK überprüft freien Speicherplatz (Phase 5 von 5)...
Verifizierung freien Speicherplatzes ist beendet.
2 fehlerhafte Cluster werden zur Datei der fehlerhaften Cluster hinzugefügt.
CHKDSK hat freien Speicher gefunden, der in der MFT-Bitmap (Master
File Table) als zugeordnet gekennzeichnet ist.
Fehler in Volumebitmap werden berichtigt.
Windows hat Probleme im Dateisystem behoben.

38917431 KB Speicherplatz auf dem Datenträger insgesamt
26784520 KB in 78538 Dateien
28328 KB in 5444 Indizes
8 KB in fehlerhaften Sektoren
241079 KB vom System benutzt
65536 KB von der Protokolldatei belegt
11863496 KB auf dem Datenträger verfügbar

4096 Bytes in jeder Zuordnungseinheit
9729357 Zuordnungseinheiten auf dem Datenträger insgesamt
2965874 Zuordnungseinheiten auf dem Datenträger verfügbar

Interne Informationen:
6a a3 02 00 18 48 01 00 0c d3 01 00 00 00 00 00 j....H..........
82 05 00 00 00 00 00 00 de 03 00 00 00 00 00 00 ................
a8 fb 0e 2a 00 00 00 00 96 30 f2 64 00 00 00 00 ...*.....0.d....
ba 52 b2 36 00 00 00 00 f8 6f 8b 02 19 00 00 00 .R.6.....o......
9a 91 2d 23 01 00 00 00 b6 83 80 02 1b 00 00 00 ..-#............
99 9e 36 00 00 00 00 00 18 3a 07 00 ca 32 01 00 ..6......:...2..
00 00 00 00 00 20 cc 62 06 00 00 00 44 15 00 00 ..... .b....D...

Die Überprüfung des Datenträgers wurde abgeschlossen.
Bitte warten Sie bis der Computer neu gestartet wurde.


Weitere Informationen über die Hilfe- und Supportdienste erhalten Sie unter http://go.microsoft.com/fwlink/events.asp.
Mosaic1
Thanks. I don't speak German and BabelFish translations are dismal. Please don't post a large block of text or send me to a site written in German like you did the other day. It makes it difficult for me to help.

I get the general idea of what the chkdsk is showing. You have some bad sectors on the drive. You may have a hard drive problem.

I would go to the Hard Drive Manufacturer's web site and download the Disk Tools it they have them. Run them and get a good diagnostic on the hard drive.

And check that PIO mode next too please.
Mosaic1
If you are in hard drive failure or showing signs of it, then don't play games or stress that system. Skip the Media player procedure or anything else. It is urgent that we find out the condition of the drive.

Developing bad sectors is not a good sign.


For later, here's a Media Player Page:
http://www.microsoft.com/windows/windowsme...er/faq.aspx#2_3
Seebald
Ok, i'm done running the thing. It said that I had two bad sectors and cleared them. It also said that some tests could not be done properly. Here's the report I got




SeaTools Desktop v3.02.03
Copyright © 2005 Kroll Ontrack Inc.

1/23/2006 @ 11:35 PM

The following information has been generated by SeaTools Desktop. Use
this information to help you recognize and resolve potential data access
problems.


System Information:
BIOS Date 09/11/02
Conventional Memory size 639 K
Extended Memory size 58532 K
IO Channel type PCI





Diagnostic Results:



System Memory Test Result: Passed



========================================================
Mosaic1
QUOTE
It also said that some tests could not be done properly


Did it tell you which tests and why?
Mosaic1
Please do check to see about the PIO mode. I posted that a while ago.
Seebald
QUOTE
Did it tell you which tests and why?


Yes. The quick harddrive test and controller test. I startet the program once more and the tests went ok. But my main hard drive appeared red after the test, indicating, that it's broken and if the warranty time wasn't expired, I could get a new one.
Mosaic1
Go for it if the warranty is still in effect. Burn whatever personal files you need to CD first. That's what I would do.
Mosaic1
If the warranty is not in effect, then you have to do something. Either have a new one installed, or get a new system. That's your choice.
Mosaic1
Is the entire system under warranty? How old is the computer? If so, I would take it in and tell then you want them to go over it. Who knows what else is going on. You may have other hardware problems.
Seebald
I did the PIO thing you asked me, and it showed massive improvement: Startup takes only 15 seconds again, not 1.5min like it did before. Also the needle skips in sound are reduced from 20 to 1 in one music piece. The current transmission mode is Ultra DMA mode 5.
Mosaic1
The Speed is due to the DMA being in place and not PIO which is deadly slow. The transfer rate is up again. But do those disk test again. Get the log and don't ignore the problem. If your drive is going, it is going.
Seebald
Was this PIO/DMA thing the original cause of the problem? Or is this just an intermediate fix to get my computer going while I fight the real problem?
Mosaic1
If you have DMA capability and your computer reverts to PIO mode there is a reason. I have no idea what exactly happened to cause that. Your Hardware problem may have been the root cause. But if your Drive has bad sectors and you run a test. That test marks your drive as bad. You ignore that.... foolish!


Read this: DMA = Direct memory access

http://www.pcguide.com/ref/hdd/if/ide/modesDMA-c.html


So it speeds up the transfer of data. But you still need a healthy hard drive.


Do the tests again. That's my best advice.


You can also reinstall those latest sound drivers.

BUT DO NOT Ignore a failing hardware item. If you do, you'll lose all your information if that drive dies.
Seebald
I didn't ignore it, don't you worry. Here's the full story: After you told me that there might be something wrong with my harddisk, I went straight to http://www.seagate.com/ and downloaded SeaTools. I created a floppy to boot my system and check my harddisk. This check showed first, that I had two repairable bad sectors (caused possibly by malware) and advised me to clear those (set everything in it to 0) wich i did. But that time it said also that several tests could not be done so I ran it again. The second run all test were executed, but the result showed, that my harddrive was somehow not fully functional, although it didnt detect anymore bad sectors. After I reverted to DMA however, the tests say that my harddrive is absolutely ok. :dance: ?

Is it possible, that the bad areas caused the system to switch to PIO, but after they were cleared PIO somehow disturbed the harddrive test?

And what did I on Jan6, that triggered the switch to PIO?
Mosaic1
Bad sectors is a physical problem. Chkdsk should have marked those as bad and no data will be stored there.

Read more and judge for yourself:

http://www.pcguide.com/ts/x/comp/hdd/errorsBadSectors-c.html

Now that you are using DMA again your drive is actually going to be working harder.

You may have had a power surge, you may have had any number of events related to other hardware in the case. It may have been a problem with plugging that new device into your USB port. Or not.

I am not really sure what else you did and all those files you deleted.

RE: The tests. They showed you that the drive was not functioning at the speed it should have been. Now you may think everything is fine.....
Seebald
uhm.gif What must I do now? Rerun the chkdsk?

QUOTE
Now you may think everything is fine.....


Don't you think everything is fine?
Mosaic1
Did you read the article on bad sectors? You never told me how old your system and that hard drive are or if under warranty.

This is a judgement call. Bad sectors on a hard drive are not good. Running chkdsk regularly is a good idea. It is needed in fact to find out information you might not otherwise have, like if you have bad sectors.


You make the call. IS that drive trustworthy? DO you have other options?

Example: How long were those bad sectors there? We don't know.

Question: How many things can go wrong with the hardware?
Seebald
I bought it in 2003 and apparently its got only 1 year warranty so it's expired.

In the article it's written, that harddisks can sometimes develop bad sectors over time, caused by often usage. Since the sectors my system developed, were repairable I don't worry too much myself, because I read at Seagate that those can be caused also by virusses.

I'll do those chkdsks now.
Mosaic1
QUOTE
Since the sectors my system developed, were repairable I don't worry too much myself, because I read at Seagate that those can be caused also by virusses.




Bad sectors are not repairable. They are physical. The are marked as bad and not used by the System but they are still there, just hidden.
Mosaic1
My final and best advice is that if you are not going to replace the drive, that you do regualr chkdsks to see if any new bad sectors develop.

Check to see if you have reverted to PIO mode on a regular basis.

Bottom line: Monitor your system.
Seebald
I'll do that, thx. At the moment everything looks allright, I'll let you know if something drops again.

I think I'll also create a CD with the files I need to survive.

Maybe in time I'll go get a new HD too.

However infinite thanks to you for your tireless effort. You're the :king: . That you sticked by me even after the malware was killed and patiently helped me locate the problem, wow! No way I could've done this without you. winner_first.gif So if you ever need free surgery...(you'll only have to wait 4 more years at least till i'm through with med school)

Want me to post some more Chkdsk logs? (I'll translate them for you)
Mosaic1
You're welcome. Although it took me some time to get my focus back into Operating system mode vs spyware...

LOL Now if only you were in Dental School! Then we'd have a deal.


Good luck with your studies.

Look for changes in your chkdsk logs. And backing up files is the best idea! Especially if you are using that system for any school work or papers, research etc. I have heard horror stories about lost work.



Mo
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.