Link to home
Start Free TrialLog in
Avatar of y2jk
y2jk

asked on

PC Running very slowly online - how to diagnose and fix?

Before I get to the main body of my question, please note:

1) If you feel this question is not posted in the most appropriate topic area, please advise where else I should try, so I can post another question there linking to this one.

2) This is a topic I am especially weak on, so any advice will need to be very detailed (an idiot's guide, basically!) so that I understand it. Almost as important as fixing the problem, I want to understand it so that I am better prepared for next time (and I'm sure there will be a next time!). Depending on the effort required to help me, I am more than prepared to up the points. Thank you.

Now onto my problem. My son has an XP pc, with broadband connection via a wireless (Belkin) network, running IE6, and signed up to all the usual teenage sites (MSN, MySpace, Bebo, etc). I have an XP laptop also on Belkin wireless, and all works perfectly for me (just thought I should mention that, in case it helps). For the last couple of weeks my son's pc has had trouble connecting to the Internet, MSN, etc. It "seemed" to coincide with the subscription to McAfee running out, as it kept asking us to go to their site to verify our subscription, but we just couldn't connect to the Internet. I ran a couple of "old faithful" virus checkers (SpyBot S&D and Ad-Aware), they found and cleared a few minor bugs, but it made no difference. As I'd had a few issues with McAfee since I bought the pc, but the Norton on my laptop never played up, I completely uninstalled all McAfee products and bought Norton Internet Security 2007 and installed that. I ran a full system scan and it found nothing.

He was then able to connect to all his usual online stuff again, so I assumed McAfee was the problem, the expired subscription perhaps blocking online connectivity / activity. However, it takes an absolute age for the pc to fully boot up (I'm talking over 5 minutes before the Norton icon appears in the system tray and any online apps start working!!). Even when connected, on MSN he has to wait at least another minute or 2 before he can select any menu options or links (the app just appears frozen). And a really weird thing, if he clicks on any link that opens up a web site, the whole pc freezes (we have to CTRL, ALT & DEL and End Task). However, if we connect to the Internet first, clicking on a link from MSN, or within an e-mail etc, then opens up a new browser window which connects to the relevant site ok (albeit slowly!). So I thought I'd found a workaround for the issue, that being as long as he opens up a browser window before doing anything else, the rest of his online activity should work ok. Not an ideal solution, but better than nothing.

However, the slowness of the pc is getting worse, (although all other apps seem to work fine, WORD, Excel, games etc, it's only online stuff that's a problem, and the initial startup). I am assuming it's not a virus issue, as Norton didn't find anything on a full system scan, but for a Pentium 4 pc with 1GB of RAM, the performance is just rubbish. There's definitely an IE issue, having to open an initial browser window to enable all other online activity to work, that's just bizarre!

What I'd like to know is how to diagnose the problem and fix it. I've read various other questions on this site (about various topics) where the most common answer to fix a problem is to uninstall and re-install software. However, I don't want to do that if I can help it, especially the Belkin software. With the trouble I had installing it in the first place, and the numerous calls to the help desk, often on hold for 87 hours before I got to speak to anyone (good job it's a toll free number!!), it's the very last thing I want to tamper with. And as my pc has no problems, and his has only been playing up for the last few weeks, I don't think the network is part of the problem anyway. Not that I really know what I'm talking about!!

Issues I have with this type of problem are:
- I am not confident with editing the registry (I've done it once before, but only when following some very detailed instructions, I wouldn't know what to do myself)
- In Task Manager he does not have any curious applications runing, but there are around 60 processes running, and I don't know if there are any clues to be found there or not
- Looking at the Event Viewer Logs, I can't see anything that points to any possible cause
- I don't know of any diagnostic tools on the pc that I could use (or on the net to download), and probably wouldn't understand how to use them anyway!

So, there you have it. A pc that's started running like a dog and I have no idea how to diagnose and fix the cause(s). What can I do? I previously read about another virus type tool called Hijack This, where you post a copy of some system log or other on a site and it is diagnosed by experts (such as yourselves) and advice given on changes to make. Does this sound like a good idea for my problem (wouldn't Norton have picked up anything like that though?)? Is it worth posting a screen print of all the processes running?

As an aside, could Norton itself be part of the problem (I very much doubt it's the whole problem)? Previous versions were notorious for being very memory hungry and slowing systems down, but the sales blurb for this 2007 version claims to have fixed that issue. Do you believe that, or in your opinion is the latest Norton just as "bad" as previous versions? My only suspicion is the extraordinary length of time it now takes to boot up (as I said earlier, well over 5 minutes). It was nowhere near that slow before I installed Norton. I did wonder about running the pc without any anti-virus software (just as a test) but thought better of it!!

Any advice would be very much appreciated. If you recommend the use or download of any diagnostic tools, could you please detail exactly how I should use them and what to look for.
Avatar of LeeTutor
LeeTutor
Flag of United States of America image

Yes, I think it would be a good idea to try the free program you mentioned (HijackThis) -- install it in its own folder, don't download to your Desktop:

http://www.spychecker.com/download/download_hijackthis.html

HijackThis is a tool that is for advanced users, because it lists all the installed browser add-on and startup items, allowing you to inspect them and then optionally remove any ones you select.  You must be careful in choosing what to remove, although the program can create a backup of your original settings.  But put a check mark to fix any home page or search page setting that HijackThis detects which you have not entered yourself.  The program has an option to download online updates of the hijack data.

You should first post the log at this site:  

http://www.hijackthis.de/index.php?langselect=english

and it will be automatically analyzed for you (after you click on the button labeled "Analyze" near the bottom of the page), telling you which entries (called "Nasty") should be fixed.  You will also be told if you have any items that are "Possibly Nasty", or "Unnecessary", or "Unknown". If you don't know what to do about these, you might find something on the module name by doing a Google search of the internet.

If you have any questions about what it is asking you to fix that you would like the E-E experts to comment on, then do this:  right above the Analyze button you will see this message: "The following analyses has been stored temporarily", and there will be a link where the analysis file will be saved (for a period of three days). Click on it and then copy the link of that page from the address bar of your browser and paste it here, and experts can check it for you.  (Please DON'T post the entire log itself in your question.)

In case you would like to learn more yourself how to use HijackThis, here are a couple of urls:

http://www.tomcoyote.org/hjt/
HijackThis Quick Start

http://www.spywareinfo.com/~merijn/htlogtutorial.html
HijackThis log tutorial
Hi y2jk,
I am one of those who quickly blames Norton for a wide variety of problems - it can be very processor intensive.
One question is how far away from your Wireless Access Point (WAP) is your son's computer (and how far away is yours)?
Just a few feet can make a large difference.

The sites your son is visiting would weigh heavily on me - "sharing" sites always seems to bring problems with them.

Here are some of my favorites:

You can do an 'on-line' scan from this site without un-installing Norton:
On-Line Anti-virus Scan
http://www.trendmicro.com/hc_intro/default.asp

You can do that scan in 'Normal Mode' or in 'Safe Mode with Networking' (tap the F8 key during boot, then select your choice of Modes).


I would load MS Defender (http://www.microsoft.com/athome/security/spyware/software/default.mspx)

Download and install Superantispyware
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
Load Superantispyware and click the "check for updates" button.
Once the update is finished, close SuperAntispyware again, we'll perform the scan later in safe mode

* Start Superantispyware.
Click the "scan your computer" button.
Check "Perform Complete Scan" and then next.
Superantispyware will now scan your computer and when its finished it will list all the infections it has found.
Make sure that they all have a check next to them and press next.
Click finish and you will be taken back to the main interface.
Click "Preferences" and then click the "statistics/logs" tab. Click the dated log and press view log and a text file will appear.

After loading MS Defender and SuperAS, I would update the defintions, definitely boot to Safe Mode and do complete system scans.



Post back when you can.
Vic
Avatar of y2jk
y2jk

ASKER

Thank you both for your suggestions. I have started from the top and used Hijack This. Here is the link to the log file:

http://www.hijackthis.de/logfiles/5669c63209c4dfbb907c2c1bbae0edb4.html

I wouldn't know what to do with the suggestions made from the Analysis, so a second (Expert!) opinion would be much appreciated. Along with your recommendations, could you please explain what I actually need to do (delete system registry entries, uninstall products??).

Slight odd thing with the Analysis, it says it did not detect a firewall, yet my Norton has all the firewall options ticked, so I'm assuming it's actually working. How do I check? I haven't looked at the 2 user guide links LeeTutor included yet, but I will.

younghv - I'll download your suggested tools dependant on the results of the Hijack This analysis. However, to answer your first question - my laptop is a few feet away from the wireless router, my son's pc is upstairs. His signal strength has always been weak and the speed slow, but the boot up and general online activity have noticably slowed down in the last couple of weeks. That said, I have brought his pc downstairs to do all this analysis, and on initial boot up I have to admit, it did fire up very quickly!!

I'll get my son to use it downstairs for a day or 2, to see if there's any improvement. But I still believe there's a problem somewhere for it to be behaving to slowly upstairs (after a year of working perfectly).
The first thing I spotted was 'MyWebSearch' - ugly.

Use this info from one of the All-Stars here to get rid of it.
More to follow.

https://www.experts-exchange.com/questions/21183874/help-me-remove-mywebsearch-VERY-URGENT.html
Advice below is from the Virus TA Page Editor.
You might want to consider removing your son's account from any form of 'administrator' privs.
Almost all of the junk that is getting installed would be stopped if he were a limited user.

Vic

Download and install DrWebCureit:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
to your desktop.
Doubleclick the "drweb-cureit.exe" and click "ok" in the prompt window that will open , asking "start the express scan now".
It will first make a quick scan of your system, let it clean what it find, and when it says "done"
Click on the green screwdriver-
Actions Tab- Adware-Dialers-Riskware-Hacktools, use dropdown menu and select -Delete
Click on the drive(s) you want to scan . A red dot will mark the selected drive(s) . Then hit the green  arrow in lower right corner It will now scan your  drive(s), say yes to all

After the scan, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
Avatar of y2jk

ASKER

OK, so far I have downloaded HijackThis, SuperAntiSpyware, Windows Defender and Drweb-cureit. Whilst I wait for advice on my HijackThis log I have run Drwed-cureit. It took several hours last night to run, found quite a few items (mostly mywebsearch related) and deleted them all. I will run the other 2 apps later today (in safe mode as suggested) to see what they find.

Why is it that I can spend £50 on a professional antivirus product, then download something like drweb-cureit for free, which finds 48 Malware items that Norton doesn't? Some of these free products even auto start and run in the background constantly. These, together with Windows' own firewall and IE7's phishing filter indicate to me that professional antivirus products seem to be a waste of time and money. Would you risk running a system without them, or do they safeguard your system in other ways that make them worth using?

Anyway, that's my rant about Norton over with. I will continue to run all these apps to clean the pc up as much as possible and exhaust all possible virus causes for the problem, but I still have a feeling that it's not virus related, and that the pc (o/s, registry, or something) has just got it's knickers in a twist causing this slowness problem. After running drweb-cureit last night and re-booting, the system reloaded ok (although on shutdown, it did hang for a while saying that ccApp was not responding and gave me the "End Task" or "Wait" options), but when I opened up Outlook Express it just hung (I had to End Task). When I opened up a browser window, then tried Outlook again, it went straight in and checked for new mail.

So there's still a problem with apps clashing/hanging/whatever, all of which seem to be "cured" if I just open up a browser window before doing anything else. That's why my main question was really about diagnostic tools that could identify and fix the problem. As I said above, I will go through all the virus options first, and wait to see what is recommended from my HijackThis log, but I suspect I will still have this problem at the end of it.

So if you do know of any diagnostic tools I could use, and/or what to look for on the pc, I would be very grateful for the advice.
"ccApp" is (of course) one of the Norton processes hanging up.

I won't go into my normal Norton/Symantec rant, but I refuse to run it on any computer I am responsible for.
Some of the free stuff out there is cutting edge good and it has to be.
When you're creating a product to compete with the established names, you better have something so good that it will make us users switch.

I did notice in the HJT log that there seem to be a lot of 'extra' programs starting and running. That is typical of so many youthful users out there, because they hear about all of this new stuff out there and want to give it a try.

When you finish up with what you're doing, please run another HJT and post the new log for us.

Vic
Avatar of y2jk

ASKER

OK, so far I have now downloaded and run drweb-cureit, SuperAntiSpyware and Windows Defender. I have run each in safe mode, both as an administrator and my sons account. I have run all the scans (in full) several times until each came back reporting nothing. That took hours!!

No difference. The pc is still slow to boot up and hangs unless I open a new browser window first which seems to clear the "blockage". I have now downloaded & installed IE7. This has actually made a difference. I can boot up, open up an e-mail and click on a link, and it will open a browser window and go to the site.

So I think by installing IE7 I may have fixed whatever was causing the hanging / conflict problem. However, it's still slow (not hanging, but slow). Therefore I have done another Hijack This and here is the log:

http://www.hijackthis.de/logfiles/933b46fe1030596b6d42cd4eec443092.html

I think perhaps just removing all the 'extra' stuff you mentioned may speed things up and 'clean' the pc up. However, I noticed a couple of oddities in the Analysis file:

1) One of the "possible nasties" had SmileyCentral in the reference. This is a pop-up I only get when visiting this very site (EE). I think I can ignore it, as I am fairly sure I can trust this site(!), but as I have pop-up blocker enabled, why does it still appear?

2) The other nasty I found related to myWebSearch. With all the scans I have been doing I have removed all entries, so where did HijackThis find it? Is it a redundant registry entry or something? If so, how do I clean it up? Is it by ticking the slected items in the log and selecting the "fix" option, or do I need a registry cleanre tool? Do you know of any free ones I can download? I've used some on the net before, but the ones I found previously only do a free scan, you have to buy the product for it to fix the registry.
Persistent little bugger, isn't it.
Try this: http://www.klitetools.com/comments.php?catid=81&shownews=1230

I'll check on our Virus TA for another and post back.

Vic
I think "SmileyCentral" is associated with "MyWebSearch" - it should be removed also.

There is an awful lot of 'stuff' installed on his computer.
I would go ahead and start stripping out any programs that are not needed - in your opinion - to make the computer functional.

Some users just seem to love installing all the extra 'Tool-bars' and other cool programs.
The plain fact is, the more stuff installed, the slower the computer is going to run.

Strip it down to bare bones, get it running normally, then remove his admin privs.

I'll keep looking.

Vic
Avatar of y2jk

ASKER

Could you advise on the 'stuff' you mention? My trouble is, I don't really know what I'm looking at in the HijackThis log.
ASKER CERTIFIED SOLUTION
Avatar of younghv
younghv
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of y2jk

ASKER

I tried using that SmileyCentral killer but I keep getting an error message I've never seen before (and don't understand!). It keeps saying "Cannot ping machine under 1500ms. Please try again". What does that mean?
You may have to run some of these applications in 'Safe Mode'.
Many forms of malware run 'protective' services/processes that prevent removal during 'Normal Mode'.
Avatar of y2jk

ASKER

Still didn't work in safe mode (same error message), but mywebsearch and smileycentral did get removed by selecting them in the HijackThis log and clicking the Fix Checked Items button. I did another scan and they no longer appear. At the same time I removed a few other items as suggested.

So I think I'm just about there now. Startup is still a little slow (but I put that down to Norton), but my son can now go onto Windows Live Messenger (not MSN, as I said previously, but the same sort of teenage rubbish!!), click on links to mySpace.com and open up a browser window without delay. There's now no need to open up a browser window first to make sure things work properly.

I think the main fix was downloading IE7 which made the most noticeable difference (it seemed to cure the conflict/hanging issue) but thanks to your advice and links to virus tools I'd not previously used before, I have been able to clean the pc up a bit and further improve speed. So I have selected one of your last comments as the "Accepted" answer, but for the benefit of anyone else looking at this question for similar tips, I think it was a combination of all your comments that helped sort out the problem.

Many thanks for all your help vic.
My pleasure - thank you for the points.

Removing any 'Admin' rights on the basice account (even if you give him a second account for computer management) always needs to be considered.

If his 'surfing' account doesn't have any install rights, it can eliminate a lot of the accidental infections.


Vic