Can't fully boot up XP

jmart

OK, I'm new here, and new to XP so please bare with me and thanks very much in advance. Have XP and my PC won't fully boot up. I get past welcome, and when it gets to desktop thats it: programs don't load. And the clock just sits there. Control alt+delete takes me to task mgr. I see the following gobbling up 98-99% of my CPU

wscmd800.exe

Win start commander. Well, I know what it's called now, but not what it does, and sure don't know why its sucking the life out of my CPU. I am taking it for granted that indeed this is where the problem lies. I also see that beside it, it says " run once " as compared to most that simply state " run ".

I do have lots of goodies: Zone alarm Firewall, AVG, Adaware6, Spybot, and most recently Webroot Spy Sweeper ( trial ), and hijack this. To me this is acting like a trojan, but I do not detect. Or possibly I simply screwed something up somewhere. So here is my hijack log. If anyone knows anything about this, or any other appropriate changes I should make by looking at my hijack this file, thanks again. Your time and consideration are appreciated!

PS: Oh and 2 short questions: Should I run the stock ms firewall ( free with XP? ) along with zone alarm or can that be problematic? If so, how do I turn it off the ms or windows or what ever firewall came with this? Also, how do I let some pop ups through? I missed the welcome note here! ( Again I am new to XP ) Anyway, here's the file, the boot up issue is obviously the most important thing...

Logfile of HijackThis v1.99.1
Scan saved at 4:22:41 PM, on 6/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.juno.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Restart WSC Setting] C:\PROGRA~1\blcorp\UWCSuite\WSC\wscrestp.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\RunOnce: [WinStart Commander] WsCmd800.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {140F03AE-0588-11D4-BD45-0050048A82BF} (eShare Web Collaboration Class) - http://chat.microsoft.upgrade.com/netagent/objects/emagic.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117638807094
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Tex

have you tried to just uninstall winstart commander? Control panel/add remove programs etc..

Tex

jmart

No, I didn't know exactly what it does, so I didn't want to deinstall! Can I do that without harm?

What does the commander do Tex?

jmart

Ah ha! Looks like this is part of the Win Cleaner Utility Suite my neighbor gave me! Because I am new to XP I thought it was part of the XP start up process. I'll go ahead and delete it. Hopefully that'll solve the problem. I don't know how to access preferences on this utility suite. Also, if any can give me heads up on running the 2 firewalls, I appreciate it. Thanks

Tex

For now why not just turn on the windows XP built in firewall? Zonealarm is better but its also a pain to get all setup correctly.

Make very sure you have all the MS updates and all the spyware and virus programs are all fully updated.

Tex

Shadow2018

If you still have problems post a HiJack his log in the SVT FORUM.