frozen screens

[iresqu]

I run XP and Firefox. Abourt two weeks ago when I access a security type site(like internet brokerage) the screen frezzes up and its difficult to end the program. Not sure if the prob. is XP or firefox? The brokerage site suggested I have temp files full?? I thought all those had been deleted when I close Firefox every time. Any suggestions? I am a novice PC user. Thanks for any advice. PS I have been using adaware and spybot regularly the last few years so I doubt its a malware prob.

[jholland1964]

Start off by cleaning out with the ATF-Cleaner...just click on the link, download and install.
Double click to open the program. Place a checkmark in Select All. Then click the Empty Selected button.
Next go up to the top of ATF-Cleaner and click on Firefox. Place a checkmark in Select All.
You will receive a box asking if you wish to delete your Firefox passwords. You may click NO.
Once you have done that then Click Empty Selected.
Once the program has finished, all of this takes just a couple minutes, then Reboot the computer.
Go back online and see if you can access the pages. If not, then follow the directions HERE
for the downloading, location and running of HiJackThis. Do a Full Scan with it. Save the log and post it back here. I will take a look and see what I think.
Judy

[iresqu]

Judy, thanks for the help. The ATF did not solve the prob. I have a laptop thats doing the same thing so maybe it is some malware. Here is the logfile on my main PC.
Rich
Logfile of HijackThis v1.99.1
Scan saved at 5:50:48 PM, on 8/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfx update.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Nana\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

[jholland1964]

Was this log run in safe mode? It is entirely too short. If you have items disabled in msconfig please go back and re-enable them. Turn off that Spybot TeaTimer, it is more trouble than it is worth.
Also please move HiJackThis out of the temp file and into a file of it's own. It should never be run from a temp file. Read instructions Here
for proper location and naming of HiJackThis.
Once you have re-enabled anything you have disabled and moved HiJackThis then run a new scan with it and post that new log here.

[TurcoLoco]

Not to step on J's toes but as a side suggestion, you might want to give this a shot:

Change your Firefox settings to match the ones in the screenshot I am attaching. Pay special attention to the ones that are high-lited, ok?

~ To get to the hidden configuration panel, type about:config in the address bar and press ENTER.
~ To modify the entries double-click on their name on the list.

Once done, close the browser window and re-launch FF.

Hope this helps.

[iresqu]

Again thanks for the help. I apologize in advance for some dumb questions I may ask next :-( I can imagine it may get frustrating for you. First things first: I have completed steps 1-8 that were listed on this site. with the exception of the Kaspersky virus scanner. I used lavasofts antivir which has a rootkit detect scan. I tried the trend Micro online scan but could not get it to load and run properly(maybe that gives you sme clues?)

I believe I loaded HJT correctly now.

in safe mode and dissconected I ran ATF, Spybot, and AVG no problems found.

Judy, I rebooted and ran the attached HJT logfile.......Judy is it possible that I just dont have much to scan? and why it is so short? I tried to disable teatimer...cannot find how to do it. I do not know how or what I should do with the MSCONFIG if anything, I dont even know what it is :-)

Turco... I reset my Firefox to the values in your attachment, and it has not stopped the screen freeze in the online brokerage acct.

So you all know I am a Fireman/Paramedic and I use my comp. for email, internet surfing, and online stock investing, I do not do multimedia, music, DVD's etc, so maybe it is why my files seem simplistic. And my obvious lack of knowledge :-)

Rich

[iresqu]

OK the HJT log did not attach! I am listing it here.

ogfile of HijackThis v1.99.1
Scan saved at 11:13:04 AM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfx update.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\hjtscan.exe\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

[jholland1964]

Go Start, Control Panel, and click on the Java icon. When the control panel opens click on About. Tell us what version is showing there.

[iresqu]

Java(TM) plug-in Control Panel
Java(TM) 2 Runtime Environment, Standard Edition 1.4.2_03
Default Virtual Machine Version 1.4.2_03-b02
Java(TM) Plug-in 1.4.2_03

[jholland1964]

Java(TM) plug-in Control Panel
Java(TM) 2 Runtime Environment, Standard Edition 1.4.2_03
Default Virtual Machine Version 1.4.2_03-b02
Java(TM) Plug-in 1.4.2_03

This may very well be at least part of your problem. Your java is way out of date.
First you should go to Start, Control Panel, Add/Remove and uninstall all versions of Java that you find.

Next you need to go to SunJava Manual Download
Download a new version of java which now is version Version 6 Update 2.
I usually recommend using that second choice which allows you to download and save the file and then install while off line. Once you have the new version installed, reboot the computer and then go to this page Verify Installation
to be certain that your new verison is installed and running.
Once you have done that then see if you can access your online brokerage acct.
Judy