Computer Is Snail-Not a Virus

My Windows XP (SP3) PC is running like a snail. It takes forever to bring up or refresh many screens: Outlook (3-8 minutes), IE7 (1-3 minutes). Am current with all Windows system updates/patches. AVG 9 not reporting any viruses. No virus reported from others incl Anti-Mailware, Glary Util, etc. The system after reboot runs OK but after a while, it slows way down. I see that Explorer.exe takes over and uses up 100% of CPU. I see this effect both in Task Manager and in ProcExp.exe. Systems runs fine until Exploreer takes over every time—then it's curtains. There's a definite relationship between the 100% CPU usage and poor machine performance. This slow down can happen when I have no applications running or even one application such as Outlook. Something is taking over my system and slowing it down. I have disabled all startup apps through Glary Util but makes no difference. I'm attaching a copy of the startup list. Most recently, I DID note that as soon as I kicked in IE (with Outlook and QuickBooks already running) the CPU maxed out again. Ran all utilities avail recently incl Defrag and two different Registry Cleaners (Glary & PC Health Optomizer. Optomize disk for performance using Control Panel/System Properties/Advanced/Pewrformnance\Visual Effects: Adjust foir Best performance and the Advanced tab has "Programs" checked for both options. I am running a 2 GB hard disk paging file. Hard drive is 150 GB and has 85GB available. PC has 1.25 GB of memory, 2GHz Pentium Need help troubleshooting what is causing my system to run slowly.

Explorer.exe is your My Computer Windows Explorer. <– since you mispelled it once, please confirm this is what you are referring to and not iexplore.exe I see you have ACT, which can be kinda a hog if running searches or indexing a huge data base, but you would need many thousands of data items in your data base to approach that. _______________________– The only single one of the StartUps necessary to keep is the AVG. All others are user optional. ________________________________- Otherwise, I'd suspect some sort of trojan spyware. Any of your svchost.exe processes running with high consumption when you have this problem? If so, consider downloading, installing, updating, and running Malwarebytes, followed by post over into our Infections Removal Forum.

Thanks, Doug. The problem is with Explorer.exe (My Computer) —not Iexplore.exe (IE7). As stated in my first post, I DID run Malwarebytes Anti-malware; downloaded & ran the latest update file avaliable at the time. Did thorough system test (4 hoiurs) found NOTHING. Correct me if I'm wrong, but the AVG startup item that you mentioned just puts the AVG icon in the lower right portion of the TaskBar. AVG is actually running in the background (without that icon in the startup group). I say this because I see several AVGxxxx processes running in Task Manager, one of which is avgcsrvx.exe. I think that's the main kahuna. By the way, I also ran SpyBot, Adaware and HitManPro and they found nothing either., so I unistalled those so as to not overload my resources leaving only AVG running all the time. I'm going to try Avast. If that doesn't work, I'll try the Infections Removal Forum (if I can find it). Thanks

Hi LarryFromVegas,

Thanks for the verification and additional information.

Personally, I agree with your plan to move from AVG to AVAST!.
I was a satisfied AVG user for about 7 of the past 10 years, but then started noticing increased consumption of system resources.
I moved to Avira on some machines and Avast! on others, with good result.

While such a move may not solve your present problem, it may be beneficial nonetheless.
______________________-

Is this machine a Desktop or Laptop?
Laptops use settings to "throttle-down" CPU cycles, usually in increments of 1/2.
This feature can be adjusted/prevented in Display Properties - Screen Saver - Power Settings
______________________

You describe having completed an extensive inspection of StartUp applications and processes.

I like the simple utility CodeStuff Starters for both viewing and managing start-up items.
It may be of use to you.
And you can post a report from CodeStuff Starters - StartUps, if you would like to. (use Save As Plain Text)
______________________

Is there any possibility that you could get that machine online with IE 7 and run the PCPitstop Full Tests, then post a link to your results ?
If you can, we could get a more informed picture of your machine's configuration and current functioning.
http://www.pcpitstop.com/techexpress/howto1.asp

Post the URL link back into this Topic here at WTT if you decide to give it a try.
(ignore the various paid product offers.)

Good guess but it's a desktop. Thanks for all your suggestions. I'll your following suggestions over the weekend and will then come back to this post with results: - CodeStuff Starters - PCPitstop Full Tests My system sure is erratic, however. It's been stable all day and I've run the problem apps several times (IE7, Outlook). Maybe Avast worked. But I didn't see it report any problems. Thanks much.

Still have intermittent slow speed problems, so ran PC Pitstop per your recommendations.

See my logs at:
http://www.pcpitstop.com/betapit/sec.asp?c…;report=Summary

I see from the log that I need some updated drivers. I will load those in the meantime. But this seems to be a CPU-related problem. Something is overtaking and dominating my CPU.

Per your recommendations, I went over to your Trojan Infection Forum. I ran all recommended trojan-detection logs and posted them earlier today, and will pursue the trojan possibility there. I really don't think it's virus- or trojan-related but rather some software issue.

Do you see anything from my PC Pitstop results?

Thanks. You folks provide an amazing service.

The possibility of infection remains. However, you have so many resource intensive applications running on that machine at the same time, that alone could account for the snail-pace.

Hello Larry

Run Sysinternals Process Explorer (last v11.33).

When notice CPU spike – high % , double-click on the explorer.exe (or other process of interest), than switch to the Threads page.

Here is detailed list of the threads running in the selected process. Select thread with the highest CPU usage (usually on top).

Press the Module button to launch Explorer's file properties dialog box for the image file that contains the start address of the currently selected thread.

Press the Stack button to see the current stack of the selected thread.

Tell us what you found.

My PC

📎Processexp.jpg

ARTech. I ran ProcExp and got the results stated in the attached ProcExp_Results_2010_02_06.txt file. Waiting on your expert advice. I contacted Stardock, the developer of the Desktop Dock app. They said they fixed all memory hog problems in the version that I have, and said it couldn't be them that is the problem. They told me to have my anti-virus stop scanning their files, but that didn't work either. I don't know how to read the log, but their name sure appears a lot in the stack. Now what? LarryFromVegas

If you didn't yet, you have to configure Process Explorer to retrieve symbols for operating system images from the Microsoft public symbol server, and than you'll see the names of the thread start functions in the thread list.

To configure symbols in Process Explorer:

1) Download and install the current version of the Debugging Tools for Windows. Look out 32 or 64-bit processor.

2) Note the location to which the Debugging Tools for Windows are installed (likely c:\Program Files\Debugging Tools for Windows)

3) Start Process Explorer as an Administrator. In the Options -> Configure Symbols dialog, for the Dbghelp.dll path, specify or browse to the dbghelp.dll that was installed by the Debugging Tools for Windows (for example, c:\Program Files\Debugging Tools for Windows\dbghelp.dll). Do not specify the dbghelp.dll that is in %systemroot%\system32 - that copy of dbghelp.dll does not include the functionality required.
For the Symbols path, specify the following: srv*C:\Symbols*http://msdl.microsoft.com/download/symbols

Note: Set Options -> Replace Task Manager and you can run Process Explorer simply and fast as Task Manager Ctrl/Alt/Delete.

My PC

📎Symbols.jpg

Try again

Larry Don’t worry about an "image file" or a "start address" terms. Goal is to we find which subprocess or subprocesses make the highest CPU spikes inside the explorer.exe. It will be enough to you get something as on my picture in Post #8. In explorer.exe Properties box (my example) we can see the name of file SHLWAPI.dll, file version, description, company,… which is in my case subprocess on the top of explorer.exe activity. After that we’ll try to analyze result. Note: maybe it isn’t necessarily to make steps from Post #10? But you have to run Process Explorer as Administrator, and have to tell as above mentioned file(s) data.

Hi LarryFromVegas
As you have submitted logs over in the Infections Removal forum, please do not run any more scans or make any system changes until you have received a response from a malware fighter on how best to proceed (We don''t want to make their job of analysing your system, determining if any "undesirable elements" are present, and designing a strategy for checking/cleaning your machine, any more difficult than it already is.

Once your machine has been declared clean by a member of the Malware Team, please post back here in this topic here if you are still having issues with it and we will do our best to help.

Please don't send a follow up post to your original post in Infections Removal until you have received a response from them (they look first for topics with zero responses) however, if you have not recieived a response from them in 3 days then please go here:
http://forums.whatthetech.com/What_Do_If_Y…931#entry406931

Regards
paws

I agree with paws that you not run any system changes (install Debugging Tools) until you have received a response from a malware fighter (didn’t know for parallel activity). However, as Doug said “you have so many resources intensive applications running on that machine at the same time”, think that running inoffensive Process Explorer scans with a view to determining PCU spikes creator can’t change anything. We can buy us a time. Process Explorer is Windows verified method and only shows information about which handles and DLLs processes have opened or loaded. Best Regards

ArTech, Please follow the instructions posted by Paws and wait for the Infections Removal work to be completed before taking any new actions here in this Thread. For a few reasons: –As a courtesy to Malware Team, whose work is enourmously complicated and should be protected from distraction. –Because even very small changes can disrupt the processes and tools being used by Malware Team. –Because suggesting small changes or "inoffensive scans" can make it appear that we allow other activity to compete with actively on-going malware removal procedures…which we don't.

OK. I won't do any of the other recommended tests stated above until I hear back from Infections Team. It has only been 1 day since I sent them my scans. Thanks LarryFromVegas