system
April 23, 2008, 8:12am
1
Recently I’ve noticed a drop in performance of my laptop and after running a complete scan with Avast and Super Anti spyware have found nothing.
I’ve run a hi jack this log and was wondering if someone more knowledgeable than me could perhaps have a look at the entries and tell me if there is anythiing suspicious.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
April 23, 2008, 8:13am
2
C:\Program Files\Royal Mail\SmartStamp\BINARY\STRAY.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.virginmedia.com/
system
April 23, 2008, 8:14am
3
O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://www.creative.com/su/ocx/15030/CTSUEng.cab http://sell.autotrader.co.uk/uk-ola/common/TraderMediaX.cab http://upload.facebook.com/controls/FacebookPhotoUploader3.cab http://www.bitdefender.co.uk/scan_uk/scan8/oscan8.cab http://upload.facebook.com/controls/FacebookPhotoUploader.cab http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1185829752515 http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1185829738531 http://www.adobe.com/products/acrobat/nos/gp.cab http://www.creative.com/su/ocx/15030/CTPID.cab
I’ve notice some entries for Nero 8 which I unintalled months ago and was wondering if it would do any harm to remove these entries.
system
April 23, 2008, 8:47am
4
Slow computer doesn’t means that it was cause by malware or any other viruses. How much free space do your computer have now? Why i said this because you might installed a lot of software on your computer and eating up the space of your computer. Try deleting some of the software you doesn’t need or Delete all thehttp://www.ccleaner.com/
Or you can search some information about why computer running slow on google
DavidR
April 23, 2008, 12:36pm
5
A cursory look at your log shows you still have symantec installed, so I’m not surprised you are reporting sluggish performance. What also surprises me is when you installed avast it didn’t have a good whinge about finding symantec also installed.
symlcsvc.exe is an application which belongs to Norton's Internet Security Suite, and provides additional security features.
Having two resident scanners installed is not recommended as rather than provide twice the protection it can cause conflicts that could leave you more vulnerable.
So you either need to uninstall N.I.S completely or uninstall, reboot and do a custom install excluding the AV element of the NIS.
You also have a very large amount of running programs, you should audit those you have running and only have essential applications run on boot, the others can be started when required and closed when not in use, that will likely improve things also.
system
April 23, 2008, 12:48pm
6
But it is not Symantec AV. Norton Ghost etc. Probably their use side by side with avast! should be correct.
NIS has a bad interaction with avast… maybe some firewall features conflict with avast (NetShield and WebShield).
DavidR
April 23, 2008, 1:21pm
8
I can’t see why Ghost would be using files for NIS which is installed in its own folder (“C:\Program Files\Norton Ghost\Agent\GhostTray.exe”) and there are other symantec/NIS files there as well, I only showed one.
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
This for me is a little to much for just Norton Ghost installed ???
system
April 23, 2008, 4:10pm
9
You guys are spot on. The only Norton application I have is Ghost.
DavidR
April 23, 2008, 4:37pm
10
Perhaps it was installed as trial ware on the new system ?
Check this out, which is a program removal tool that can remove the remnants of a number of different Norton Programs:Removing your Norton program using SymNRT
Though if you don’t know exactly what version of NIS that is/was on the system I don’t know if the tool will work.
You could run HJT again and tick (fix) the 3 services in my post above that are running. That would stop them running but not remove the files (just the registry entries for them). By default HJT backs up the changes so they can be reversed.
Others:
Only fix the Symantec/NIS specific entries (no others) so should you need to reverse the fix they will all be together. Then run Norton Ghost to ensure it has the services to work correctly, you could also check the Ghost service in the services.msc and see what dependencies it has.
system
April 24, 2008, 12:16pm
11
Sorry if I’m being dumb David, but would removing the entries that you suggested not have an adverse effect on Ghost?
If I did remove the entries what benefit would it have?
DavidR
April 24, 2008, 12:35pm
12
I don’t believe so if you do a google search on the file names the invariably come up as NIS, what it boils down to also is did you ever have NIS on this system ?
Also that is why I suggested to ensure that the back-up function is enabled before you fix anything so it can be restored if required.
Removing the entries gets rid of unnecessary services (using resources) from running and Norton is notorious for conflicts even after being uninstalled because of the remnants and why we suggest the SymNRT to get rid of any remnants.
system
April 24, 2008, 12:37pm
13
Thanks David but can you tell me what NIS is?
DavidR
April 24, 2008, 12:59pm
14
I did in Reply #4 in the quoted text from a google search, the abbreviation I used in that reply being NIS.
symlcsvc.exe is an application which belongs to Norton's Internet Security Suite, and provides additional security features.
system
April 24, 2008, 2:13pm
15
According http://www.greatis.com/appdata/a/s/symlcsvc.exe.htm many Symantec application (probably Ghost too)
DavidR
April 24, 2008, 3:20pm
16
As I said before that is just one of the many symantec services, etc. so the jury is most certainly out and it would have to be Rodney78 that confirms if there was ever NIS installed on that system.
system
April 25, 2008, 9:15am
17
Thanks for all you replys.
I can confirm that I have never (and will never!) had Norton Internet Security Suite installed on my laptop.
I closed these processes down from task manager and TBH I didn’t think that I noticed an improvement in performance so I think I will leave as is unless anyone else had got any more ideas.