19 replies to this topic

[Canary]

I've run programs like Ewido, Spybot, Windows Defender, Spyware Blaster, Ad-Aware and CCleaner and my system seems to be working fine, but it is getting slower and slower at start-up.
Any ideas on how to restore its start-up speed? (I've also defragged.)

[Andavari]

By slower how slow is it actually?
Did the slowdown start after you installed Windows Defender?

Along with defrag there's ChkDsk that should be ran to scan all your hard disks to make sure it isn't error related.

Although you've scanned with multipe anti-malware products you may still want to post a HijackThis log in the proper forum area to be sure you don't have any malware.

[Canary]

Once I've gone past the Welcome screen, it's a good three or four minutes before I can start opening applications without it taking an age for them to respond.

I've had Windows Defender installed for some time, so I don't think that has been the cause of it.

I'll post a Hijack This log in a moment - any advice gratefully received!

[Canary]

Logfile of HijackThis v1.99.1
Scan saved at 18:36:18, on 21/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IEEE 802.11g Wireless LAN Utility\wlanUtl.exe
C:\Documents and Settings\Adam\Desktop\PC protection\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thehunger...bjects/CTDSites
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk/broadband
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/broadband
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-30.cab
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/downl...lscbase3401.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1122373160281
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[krit86lr]

Hi Canary. Sorry if there was any confusion, but you'll probably get a quicker and better analysis if you post your HJT log here.

[Canary]

Done it. Thanks!

[krit86lr]

When you're done getting your computer cleaned you can come back to this thread to get suggestions on replacing some of the programs that you use.

This is a sensitive topic for some, but you are using some programs that are heavy on resources. My suggestions (after cleaning your computer) are to replace Norton, Adobe, and MS Office.

What firewall are you using? I didn't see one, but I'll look again. Norton's firewall?

[Andavari]

krit86lr, on Mar 21 2006, 01:34 PM, said:

My suggestions (after cleaning your computer) are to replace Norton, Adobe, and MS Office.

What's wrong with MS Office?

[krit86lr]

Andavari, on Mar 21 2006, 01:42 PM, said:

What's wrong with MS Office?

Personal preference I suppose.

But from experience my computer runs a whole lot better using Open Office. As soon as I install MS Office I get errors all over the place. I installed my MS Office for one day about a month ago, just to export some templates, and in that day had 10 errors in MS Office. I've never had even 1 error with Open Office. My roommate has had the same experience.

By any chance...do you know what the size difference is between the two? Open Office is 243mb. I don't remember what the size is of MS Office.

[Andavari]

MS Office 2003 Small Business Edition (Installed files only): 337 MB
MS Office Cache (to quickly repair installed files): 216 MB
Total disk space just to use my version of MS Office: 553 MB

[Canary]

Yep - Norton's firewall.

[lokoike]

Andavari, on Mar 21 2006, 01:42 PM, said:

What's wrong with MS Office?

BWA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA-HA!!!!!!!!!!!!

Oh my goodness, Andavari, you crack me up! Thanks for the laugh!

at your expense, hehe

[krit86lr]

*Removed by Krit*

[lokoike]

krit86lr, on Mar 22 2006, 12:37 AM, said:

Lokoike, that isn't very nice. Andavari uses MS Office.

Apologize.

Oh.... fine... pout... I'm sorry Andavari

snicker

[krit86lr]

I thought that I would try to get the thread back on topic.


Canary, how is your computer doing now that your thread is completed in the HJT forum?

[Canary]

I've had a helpful reply from Andy, which I'm working through at the moment.

But what is strange is that a couple of things have happened simultaneously. One of them is that a Windows Security Center bubble pops up at start-up, stating that Norton Security isn't on, even though it IS on.

And all the icons in the tray at the bottom right-hand corner are taking an age to appear at start-up.

[krit86lr]

The Security Center pop-up is okay. It doesn't mean that anything is wrong is what I am trying to say. It isn't an accurate detector. If I were you I would click on the balloon when it pops up > click Recommendations > then
click the box marked "I have an antivirus program that I'll monitor myself" > reboot.

You also you could try turning it off, then turn it back on and reboot. I actually had the exact same thing happen a few weeks ago after doing a lot of scans on my computer. Unfortunately, I don't remember exactly what I did to make the Security Center detect the antivirus again.

[lokoike]

krit86lr, on Mar 22 2006, 07:48 AM, said:

The Security Center pop-up is okay. It doesn't mean that anything is wrong is what I am trying to say. It isn't an accurate detector. If I were you I would click on the balloon when it pops up > click Recommendations > then
click the box marked "I have an antivirus program that I'll monitor myself" > reboot.

You also you could try turning it off, then turn it back on and reboot. I actually had the exact same thing happen a few weeks ago after doing a lot of scans on my computer. Unfortunately, I don't remember exactly what I did to make the Security Center detect the antivirus again.

Was it saying that the antivirus was turned off, or that you were using an outdated version? Whenever I have that problem, I always just download the antivirus's newest updates, and it fixes it right up.

[Andavari]

lokoike, on Mar 22 2006, 12:44 AM, said:

Oh.... fine... pout... I'm sorry Andavari

snicker

This forum needs to implement a feature of Homeland Security but instead modify it for thread hijacking probabilities. Of course we'd always be stuck in red.

[Canary]

Problem solved - thanks for all your help!

To avoid duplication, I've posted some observations at http://forum.ccleane...?showtopic=4533 - it seems that Windows Defenders might have had somethng to do with it.