surfinsurveyor
Solid State Member
- Messages
- 14
Over the last week or so my screen freezes intermitantly and ctrl-alt-del does nothing. A reboot is necessary. (XP Pro SP2, 3gig P4, 1 gig ram) I have been trying to find out the cause and have done the usual virus, spybot, adaware scans and found nothing. There does not seem to be anything untoward running in 'Processes'. I have now had a look at Event Viewer and the only recuring warning is in 'system' relating to TCPIP and I have followed though the advice from Microsoft as follows:-
User Action
This event is a warning that a malicious program or a virus might be running on the system. To troubleshoot the issue, find the program that is responsible for the failing connection attempts and, if the program might be malicious, close the program as follows.
To close the program
At the command prompt, type
Netstat –no
Find the process with a large number of open connections that are not yet established.
These connections are indicated by the TCP state SYN_SEND in the State column of the Active Connections information.
Note the process identification number (PID) of the process in the PID column.
Press CTRL+ALT+DELETE and then click Task Manager.
On the Processes tab, select the processes with the matching PID, and then click End Process.
If you need to select the option to view the PID for processes, on the View menu, click Select Columns, select the PID (Process Identifier) check box, and then click OK.
The only program I can identify this way has a PID of 0 which turns out to be a 'system idle process' which I think is an essential one for Windows. Using 'netstat -no' the state is showing a number of entries for this process as 'Time_wait'. The only other entries relate to Kazaa and these show as 'established'.
Can anyone say if these circumstances are normal and then perhaps I can disregard TCPIP as the cause of my main problem.
Cheers.
User Action
This event is a warning that a malicious program or a virus might be running on the system. To troubleshoot the issue, find the program that is responsible for the failing connection attempts and, if the program might be malicious, close the program as follows.
To close the program
At the command prompt, type
Netstat –no
Find the process with a large number of open connections that are not yet established.
These connections are indicated by the TCP state SYN_SEND in the State column of the Active Connections information.
Note the process identification number (PID) of the process in the PID column.
Press CTRL+ALT+DELETE and then click Task Manager.
On the Processes tab, select the processes with the matching PID, and then click End Process.
If you need to select the option to view the PID for processes, on the View menu, click Select Columns, select the PID (Process Identifier) check box, and then click OK.
The only program I can identify this way has a PID of 0 which turns out to be a 'system idle process' which I think is an essential one for Windows. Using 'netstat -no' the state is showing a number of entries for this process as 'Time_wait'. The only other entries relate to Kazaa and these show as 'established'.
Can anyone say if these circumstances are normal and then perhaps I can disregard TCPIP as the cause of my main problem.
Cheers.
