And the values are “%SystemRoot%\Temp”…?
Yes
Okay. I’m still confused about the “Tea Timer” from Spybot Search and Destroy in the hijackthis log.
Does this folder exist: "C:\Program Files\Spybot - Search & Destroy" ?
Can you give a screenshot of Taskmanager (the running services tab)?
Go here: MBAM and run MBAM, just to make sure, there is no malware.
Also please post the content hosts file: C:\Windows\system32\drivers\etc\hosts (open file with editor)
We are running Malwarebytes
The folder of Spybot does not exist
http://img145.imageshack.us/img145/4014/23150247.jpg
(I hide the family name but I guess you had guessed)
Just a try…
Please disable apdproxy.exe for testing.
I don’t know if this will help you, i think we are back to guessing again…
asyn
Which host file you want me to display? Most are “examples” but Protocol & Services files seems to be not examples but real files.
No malware found
Apdproxy.exe shut down => nothing changed
Why that? It’s an (I believe) Adobe CS 3 Elements part…
There is only one file called “hosts” in that folder…
But anyway, I don’t have much hope the hosts file being the problem.
I see a lot of HP stuff there. Is it 1 printer from HP?
I’m down to guessing and wild shooting in the dark - would it be too much effort to uninstall the HP-printer completely and reboot, run CCleaner again…
How is that PC connected to Internet anyway? Via router?
I wish I could be of more help… makes you feel so stupid.
;D
I wish I could be of more help… makes you feel so stupid.
hey don’t give up!!! i saw you have two os in one machine that’s your advantage
you can reproduce his problem and you can solve it in your machine 
but he need only a reset. i mean cold boot but before that, he need to re configure his start up menu.
it has to much application running make the slowly response to the operation
best regards!!!
Well, the Hosts file display that:
# Copyright (c) 1993-2006 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host127.0.0.1 localhost
::1 localhost
Yes there is one printer and I know it caused a lot of trouble when they tried to make it work properly so it is not an option to uninstall it 
The PC has a cable connection and there is a cable modem to connect it to the internet
-
No I can’t reproduce, because my XP is running perfectly. No errors, no slow or sluggish internet. Nowhere to search.
-
He needs more than a restore. We’ve had that all through already.
-
I’m hanging on. But if you don’t know where to look… it’s hard.
That is bad luck, that we can’t uninstall the printer.
It is my biggest suspect at the moment.
How is the printer connected? Via USB?
BTW: as I thought, the hosts file is absolutely ok.
Well it’s just a shot in the dark… only because it has the word ‘proxy’ in it.
I thought if it is some kind of proxy, it could interfere somehow. As he stated, that it only happens sometimes, i guess it is related to a driver/prog, running at that specific time… Is the HJT log from a time the problem occured?
asyn
yes its bad luck how can you help him he show the task manager only name, pid and description, how about the status what is running? will the nearest thing to do is guess
and he only show local service how about the plug and play? how about the net service?
Shooting again:
Go to webshield, Expert Settings and disable Code-Emulation. (see screenshot)
I think it is connected via USB but cannot check at the moment since everybody is out
It would not surprise me if the printer was creating problem since it had a lot of time as I mentioned earlier. The owner of the computer told me he think he should switch to Microsoft Security Essentials and I wonder if this is not the easiest solution…hoping it works with his computer set up
Let me know if you have other ideas otherwise I think we will just go for changing antivirus option (I have been using Avast for long without any problem on my computer and I would have liked to avoid removing Avast on the other but if we cannot solve the problem…)
See one post above yours. 
Yes, I can understand if he switches. However, he could also go to add/remove programs, avast, change and uninstall the webshield.
I heard there will be a version update soon - and I believe it will solve the slowing down problem with webshield.
But we could stop the hp-drivers from loading. (with eg. ccleaner)
What do you think? Sould we give it a try?
IPV6 on XP? Have you installed a driver for IPV6? Here, you can see difference in hosts files in XP and Vista/7.
This is just yet another shot in wild, but how about copying the hosts file in a different place and deleting the entry “::1 localhost”?