Computer freezing and basically breaking

[chimpy]

It has only started today but my comp has crashed 6 times, that is the whole screen has seized up including the start menu so that only way of shutting it down is to press the power button which I know is not good for it, and just pressed return when the options to start in normal mode came up.

I have scanned with MBAM and SB and it was fine although on the MBAM scan it frozen along with the screen and when I tried to access taskmananger it came up on the screen that it was not there (taskmanager.exe was missing and I think the MBAM was MBAM.ink), it no longer existed, and the MBAM log did not exist either (and it doesn't appear in the logs), when I clicked on any icon on my desk top it said something along the lines of "does not know what prog to open with, would you like to check online or browse" so again I turned it off and on again and it went back to normal (this was MBAM second scan, the first was clean and it did say before it went weird that that scan was also clean.)

I then ran both a check disc on the C:\ and sfc/scannow, both were fine and nothing needed repairing.

I did notice that the CPU usage was at 65+ % and the Physical memory was at 90+ % before I then shut it down and according to the CPU list FF had the number 30 in it but that was increasing so I am not sure what that list means as others have high numbers in it but have mem usage in the single digits. Also the comp sounded like it was working even though all I was doing was browsing as normal

I also notice that I updated sandboxie today (i am pretty sure I had atleast one crash before updating so its not linked to that I think as if my memory serves me right that was in the event viewer "The desk top windows manger has encountered a fatal error 0x8007000e) and that seems to use 50+ CPU when I browse.

[exile360]

Hello chimpy

It's possible that since you installed the new version of Sandboxie today and the issue started today that the two are related. I'd uninstall Sandboxie and reinstall the previous version you had before the issues began to see if it was the cause. If it is, then you should take a look here to see if anyone else has had the issue and has corrected it, and if not, then see if anyone has posted about it here, and if they have not, then you should create a topic there describing your problem so they can look into it and hopefully get it resolved.

[chimpy]

Thanks for the links Exile, Strangely after I shut down at 9 and then re booted at 11pm yesterday the issue has not returned but I am going to keep a eye on it. Also in my other post about Spybot which happened at around the same time frame when immunizing a message popped up with something about "AVG might detect SB as malware...something something immunizing" or something like that ( clicked it close before reading which was stupid of me ) then I noticed that thousands of things were left unimmunized so I had to reboot and re try it again which worked.

I don't know if some how the rebooting re set my SB as I got the "ad Robots" message which I cannot remember ever seeing but saying that I installed SB 3+ years ago on this machine.

I checked my hosts file and there's plenty of entry's there and they all link back to the local host but it looks different.

When I look in C:\Windows\system32\drivers\etc\hosts I see the top line as "# Start of entries inserted by Spybot - Search & Destroy"

But when I look in the host file that I have on my desk top that I made so I could amend a entry last year it reads " # Copyright

[exile360]

It's no big deal. Every line with a # next to it is a comment line, meaning it has no effect on the actual performance of your HOSTS file. Spybot most likely just removed the comments in the default HOSTS file as they were unnecessary .

As for the other issue, it's possible that AVG freaked out a bit and that's what was locking up the system. As long as it's working now you should be fine. Just post back if the symptoms return and we can investigate it further.

[chimpy]

Ah right thanks Exile, that is weird as I have always used SB and this is the first time I noticed a change in the hosts file, I noticed that there is a list of backups and this one is the most recent C:\Windows\System32\drivers\etc\hosts.20100221-202431.backup but it cannot open it, it says "To open this file windows needs to know what program to open it" then two options which are either use the web to find it or select a prog from a list of installed ones which I have for now just pressed cancel (incidentally that was the same message I got on one of the crashes on everything I clicked on the desk top!) . I am keeping a close eye on it. Also I have not forgotten about the other "Event ID" issue you were helping me on, I am keeping a eye on it as it has 'touch wood' not happened again, but if it does I will post in that thread.

[exile360]

Yep, we'll get your PC straightened out yet .

[chimpy]

Whoops I edited it!

[exile360]

Hehe, saw that. The backups of the HOSTS file are the same as the HOSTS file itself, they have no file extension so you must choose a program to open them with every time. You can use either Wordpad or Notepad, but I usually recommend Notepad since it will also allow you to save it without a file extension if you alter it manually .

[chimpy]

That worked perfectly! I am learning something new everyday yep it was the same.

Once again Exile many thanks.

[exile360]

You're welcome

For info, Spybot Search & Destroy always creates a backup of the previous HOSTS file when new sites are added to its list and you use the Immunize function to apply them. Generally, I just delete the backups but that's because my HOSTS file is pretty massive these days once you include all the entries I've added manually and all the entries added by HostsMan.

[chimpy]

I have 32 in just less than 3 years... I really need to update it a bit more frequently

One day I will get hosts man, One day when I have a little more time to study the DL of it .

[exile360]

You can delete the older backups if you'd like . Besides, if something ever went horribly horribly wrong and you needed to reset your HOSTS file it's not that difficult to do so :

Please download the Microsoft Fix-it HOSTS Reset Tool from here and save it to your desktop

• Double click on MicrosoftFixit50267.exe to start the installation
  
• Click I Agree then click Next and follow its instructions to allow it to reset your HOSTS file
  

As for HostsMan, you can always ask mountaintree16, she's an old pro at it now

[Marcus]

Exile, been following this thread carefully; that tool you've provided a link to above(MicrosoftFixit50267.msi) is a 633KB download!

Are you sure it fixes only the hosts file and nothing else?

By "fixing it" does that mean restoring to installation default values?

Not doubting your knowledge at all, exile; I'm just being cautious here (probably over-, )

[chimpy]

Exile I might have to re-set the Hosts file as I decided to check when the file altered, and the one before the last back up C:\Windows\System32\drivers\etc\hosts.20100220-154919.backup is totally empty! But the one before that one has all the writing at that top like normal C:\Windows\System32\drivers\etc\hosts.20090119-190710.backup.

So for some reason I have a blank backup then the new version (which was made as you can see the day before the back that has the new version, but I am more than sure I did not try to update on that day, I update maybe once a month at most and I was not on the computer that long to do anything.), I do not have any re-direct symptoms and all seem to have the local host number 127.0.0.1 next to each entry so I am confused as to whether something dodgy happened to the file.

[exile360]

Exile, been following this thread carefully; that tool you've provided a link to above(MicrosoftFixit50267.msi) is a 633KB download!

Are you sure it fixes only the hosts file and nothing else?

Yep, that's it

By "fixing it" does that mean restoring to installation default values?

Precisely

Not doubting your knowledge at all, exile; I'm just being cautious here (probably over-, )

I don't blame you in the least, it's always best to err on the side of caution .

Exile I might have to re-set the Hosts file as I decided to check when the file altered, and the one before the last back up C:\Windows\System32\drivers\etc\hosts.20100220-154919.backup is totally empty! But the one before that one has all the writing at that top like normal C:\Windows\System32\drivers\etc\hosts.20090119-190710.backup.

So for some reason I have a blank backup then the new version (which was made as you can see the day before the back that has the new version, but I am more than sure I did not try to update on that day, I update maybe once a month at most and I was not on the computer that long to do anything.), I do not have any re-direct symptoms and all seem to have the local host number 127.0.0.1 next to each entry so I am confused as to whether something dodgy happened to the file.

It's possible (even likely) that Spybot Search & Destroy simply blanks out the older backups when a newer one is created so that you don't end up with a lot of large HOSTS files sitting in that folder, ever decreasing your free disk space. It could also be that AVG blocked it from writing that file for some reason when it was having issues previously during the Immunization process. If you want to find out for certain you can install HostsMan. You don't have to start using it yet for actually adding entries to your HOSTS file or for downloading other HOSTS files, but it has a very handy function that allows it to open your HOSTS file, similar to the way you do with notepad/wordpad, but it lets you sort the entries for viewing based on several columns, one of which is Possible Hijacks, meaning that if a site listed is redirected to anywhere besides 127.0.0.1, they will appear first in the list and you can easily remove them with HostsMan. It's a great tool for editing and managing HOSTS files, not just downloading them .

[chimpy]

It is the only backup that is blank out of all the ones I have and the date on it is a date I know I did not access SB for anything, not even a scan and its the day before the weirdness happened with my computer , I will get hosts man and have a look at it then probably just re-set the file do you think?

[exile360]

Perhapst it was AVG messing with it. I see no reason that malware would create a backup HOSTS file, as they don't do anything. The only active HOSTS file on your system is the one that's called HOSTS, those backups have no effect at all. However, if you're that worried about it, delete the HOSTS backups, reset it with the tool I posted and re-immunize with Spybot Search & Destroy .

[chimpy]

Its just strange as SB the day after the blank back up, when I went to update and immunize acted like it was its first install, I seemed to be unprotected from most if not all things and the little warning pop up about the ad robots appeared so It seems that something must have deleted the host file the day before, I have no clue to find out what happened though!

How do I remove and delete the back ups?

[exile360]

Yeah, it looks like something reset Spybot Search & Destroy, registry settings and all, that's why the pop up came up.

To delete the backups just open the etc folder and delete them .

[chimpy]

Thanks Exile I was looking in the ect/hosts and trying to delete from there , I deleted all the backups in the ect but when I look in C:\Windows\System32\drivers\etc\hosts I still have records of some of them there but windows cannot find them to open, the only one that does open is C:\Windows\System32\drivers\etc\hosts.old, will this affect the re-immunization or can I safely remove that too? there are a few other files also in the ect folder will I leave those or remove them? Should I remove then re install SB? It is worrying that something has reset it.

Thanks for you're help

[exile360]

There's a folder called HOSTS in your etc folder? That's not normal.

It's normal for there to be other files in your HOSTS folder, leave them alone .

[chimpy]

I mean that I was trying to look in ect/hosts but it just brought up the hosts file itself, but there now is a file called "hosts" in the ect folder and when you click on it it bring up the hosts file that it should have deleted, its called C:\Windows\System32\drivers\etc\hosts.old now though, should I remove that? seems strange that it is there, it was modified on the 21-02-10.

Do you think I should remove SB and get a fresh install?

[exile360]

Please do the following so I can check something:

• Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DataBasePath>"%userprofile%\desktop\HOSTSPath.txt"
  "%userprofile%\desktop\HOSTSPath.txt"
  del /f /q "%userprofile%\desktop\HOSTSPath.txt"
  del /f /q %0

  Once you've done that click on File and select Save As...
  

• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file HOSTSCheck.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.
  

Thanks

edit: No, there's no need to remove Spybot Search & Destroy, it's essentially a portable program so it will recreate its settings once you use it, even if they were previously deleted .

[chimpy]

I did that and the black cmd box just popped up then disappeared, nothing else happened for me to paste.

[exile360]

My apologies, forgot one of the " marks, please try it again (and no worries, since I'm using reg query it isn't making any changes to your registry so this typo was completely harmless ).