Very slow computer....please help..

smicer07 · 21-05-2004, 10:53

Out of the blue, my computer is really really slow. When the Internet Explorer is started up, system resources go up to 100%, when I close Explorer it goes down to 1%. I've tried getting rid of spyware, virus scan, defrag, but to no avail. This laptop on the same network is fine, so I don't know how this has happened. I've just ran Hijack This, and here are my results:

Logfile of HijackThis v1.97.7
Scan saved at 10:42:52, on 21/05/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
D:\Program Files\Norton Personal Firewall\NISUM.EXE
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\snmp.exe
D:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Personal Firewall\SymProxySvc.exe
D:\Program Files\Norton Personal Firewall\NISSERV.EXE
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
D:\WINDOWS\System32\ezSP_Px.exe
D:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
D:\Program Files\Norton Personal Firewall\IAMAPP.EXE
d:\temp\Rar$EX00.703\HijackThis.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\System32\msiexec.exe
D:\WINDOWS\System32\msiexec.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = inktomi1-man.server.ntl.com :8080
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] D:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton Personal Firewall\IAMAPP.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...ctor/swdir.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...068.4728240741
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.telewest.co.uk/motive/fil...ivePreQual.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?316
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab

Can anyone help me? The problem appears to be with Norton I think, but I'm not sure...
Thanks
Simon

OldGeezer · 21-05-2004, 13:11

I've got the same problem.

It's caused by symproxysvc.exe hogging the CPU (that's Norton Firwall's HTTP proxy). I believe (but haven't yet checked) that it got updated by LiveUpdate.

I haven't had the chance to report it properly to Symantec yet (and as I'm running NIS 2002 I think it's no longer supported?), but I've temporarily got round it by disabling the firewall (I'm behind a router so not too worried).

Just wondering whether to dump it for something else.

smicer07 · 21-05-2004, 14:00

I'm running 2002 too...

smicer07 · 21-05-2004, 14:17

Disabling firewall has done the trick for me too... oh well, bye bye Norton by the looks of it!

paulyoung666 · 21-05-2004, 14:33

Quote:

Originally Posted by smicer07

Disabling firewall has done the trick for me too... oh well, bye bye Norton by the looks of it!

but please get another f/w solution as soon as possible , otherwise you might pick a trojan up quicker than you might think

dilli-theclaw · 21-05-2004, 14:36

Quote:

Originally Posted by paulyoung666

but please get another f/w solution as soon as possible , otherwise you might pick a trojan up quicker than you might think

Indeed - get Zone Alarm (free) or something...

paulyoung666 · 21-05-2004, 14:52

Quote:

Originally Posted by dilligaf1701

Indeed - get Zone Alarm (free) or something...

kerio is a good free choice

dilli-theclaw · 21-05-2004, 14:55

Quote:

Originally Posted by smicer07

Disabling firewall has done the trick for me too... oh well, bye bye Norton by the looks of it!

Also - how up to date is your anti-virus?

SMHarman · 21-05-2004, 15:22

It's a home network so he's behind a router/NAT/hardware firewall

Ramrod · 21-05-2004, 15:45

F-Secure and McAfee are both good imo

caledoniangold · 21-05-2004, 15:52

Would advise against Zonealarm. If it goes wrong it can truly **** your computer up good and proper. Use XP's firewall, does the trick and just as secured (try shields-up). If you ever have to un-install ZA make sure you read google/Zonelabs for the safe removal options. CG

paulyoung666 · 21-05-2004, 15:53

Quote:

Originally Posted by SMHarman

It's a home network so he's behind a router/NAT/hardware firewall

good point

iadom · 21-05-2004, 15:58

Quote:

Originally Posted by caledoniangold

Would advise against Zonealarm. If it goes wrong it can truly **** your computer up good and proper. Use XP's firewall, does the trick and just as secured (try shields-up). If you ever have to un-install ZA make sure you read google/Zonelabs for the safe removal options. CG

There is no way that the XP firewall is as secure as ZA Pro, XP blocks incoming port scans but cannot prevent anything nasty on your system trying to get out.

ZA Pro takes a bit of tweaking ( use Robin Walkers excellent advice) to get it set up. If it wasn't for the little blinking icon in the systray I would not even know it was there.