Strange pc lock up when idle

[Aubryn]

Recently my computer has been acting strange when it sits idle for about 2 hrs or so. When I return my mouse moves very slow as if my framerate is low and my keyboard will not respond. I'm pretty much stumped as to what the problem could be. Thanks in advance for the help.

 

[CompTIA_Rep]

Sounds like a driver issue. I'd start by updating all your drivers, including bios/chipset and video.

 

[Aubryn]

Well I've just updated over 40 different windows updates, so hopefully that will help.

 

[Aubryn]

The problem still happens, I've updated all my windows updates and my video card drivers. I can still move the mouse around but everything stops responding including my keyboard. If I unplug my mouse and plug it back it back it will then freeze up. If I unplug my keyboard and plug it back in then it will work but it will not do anything.

 

[CompTIA_Rep]

Update ALL your drivers including chipset and bios

 

[Aubryn]

Alright well I will try my best...thanks for the advice.

 

[CompTIA_Rep]

Sure - another question we could ask is - does it lock up if you are using the PC for a long period of time? Or only when idle?

 

[Aubryn]

For now it seems to freeze only when idle. I turned off my screen saver btw.

Here is my HijackThis log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:12:41 AM, on 7/7/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: prio.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe


--
End of file - 6123 bytes

 

[CompTIA_Rep]

ALso check the event logs for issues.

Right click on my computer -> manage - event logs -> system/software logs. Look at the time it last froze.

 

[Aubryn]

Alright, I'm running Windows XP so when I get into management I go into event viewer then system correct?

 

[Aubryn]

I'm not entirely sure but I think i may of fixed the problem with combofix.

It looks as though my pc was infected with AutocompletePro\InstTracker.exe.

No freezing issues....yet and I am no longer redirected when i click on a link in firefox.

keeping my fingers crossed.

 

[Demonio]

It took ages to solve idle issue, but finally cracked it for my XP.

SOLUTION
for my issue:

Windows XP very slow after idle appears to be issue with pagefile system cache (PF Usage) taking up exessive I/O activity on the disk (writing to harddrives) due to highly fragmented pagefile.sys file. Hence no real CPU usage showing, and changing PF Usage levels may not have much effect as it is not the size of PF, it is the fragmentation of the PF (normal defragment tools do not touch this file).

There is no more slowdown after I did a defragment of pagefile.sys with a tool that can actually access it (PageDefrag v2.32 By Mark Russinovich). An even simpler solution may be to set computer to clear pagefile on shutdown (I didn’t try this but probably works too - see below).

The high I/O was not from a rogue program or virus. It was slow buildup in pagefile.sys file fragmentation, the disk area storing current virtual memory blocks. My pagefile.sys had something like 264,000 fragments. Virtual memory is stored in 4KB blocks, but the fragmented block pattern was taking up excessive I/O for the drive to read after computer had been in idle.

During idle lots of application data is sent to pagefile rather than kept in RAM. Then when you start using applications again the computer is getting it back out of pagefile.sys: but if the pagefile.sys is highly fragmented then it can be painfully slow disk read speed. i.e. I sit there with almost nothing happening for 30 seconds, or watching webpages load almost one pixel line at a time.

I defragmented pagefile.sys, but maybe it is simpler to clear the file, something like:

Click Start >

Click Control Panel >

Click Administrative Tools >

Click Local Security Policy >

Click the "+" next to Local Policies >

Click Security Options >

Doubleclick "Shutdown: Clear Virtual Memory

OR

Start Registry Editor (Regedt32.exe). >

Change the data value of the ClearPageFileAtShutdown value in the following registry key to a value of 1: >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management >

If the value does not exist, add the following value:

Value Name: ClearPageFileAtShutdown >
Value Type: REG_DWORD >
Value: 1 >

Good luck!

References:

http://home.comcast.net/~SupportCD/XPMyths.html

http://technet.microsoft.com/en-us/sysinternals/bb897426.aspx

http://blogs.msdn.com/b/ntdebugging/archive/2007/11/27/too-much-cache.aspx