Link to home
Start Free TrialLog in
Avatar of SD_Bolts
SD_BoltsFlag for United States of America

asked on

Possible Virus, Computer Lagging

To All,

I have a user whos computer is lagging on start up very badly.  At some points the computer will lag so bad the mouse will not even track on the screen.  This is what has happened so far.

The individual ran a virus scan using Symantec Corporat ED.  No viruses came up but I did find in the "View>Backup Items" folder a file called "index[2].htm was infected and it was listed as a Trojan.Fakeavalert.  I went to the Smantec site and followed all there instruction form removing and correcting this situation.  No Change.

I then ran Malwarebytes in safemode and the scan came up clean.  I have used this several times on different machines and I have never seen a scan come up clean.

Next I ran ComboFix in safemode.  I am not very good at reading the output file from Combo fix, so I am hoping one of you could take a look and tell me what you see.  I have attached the file as well.

After running all three scans the computer is not lagging no where near as bad, but sporatically it will bog down.

Thanks All
ComboFix 09-04-27.04 - administrator 04/28/2009  8:06.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1526.1272 [GMT -4:00]
Running from: d:\ncma\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\windows\system32\lsapiw32.dll
 
.
(((((((((((((((((((((((((   Files Created from 2009-05-28 to 2009-4-28  )))))))))))))))))))))))))))))))
.
 
2009-04-28 00:34 . 2009-04-28 00:34	--------	d-----w	c:\documents and settings\sam.smith\Application Data\Malwarebytes
2009-04-28 00:34 . 2009-04-06 19:32	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-04-28 00:34 . 2009-04-06 19:32	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 00:34 . 2009-04-28 00:34	--------	d-----w	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 00:34 . 2009-04-28 00:39	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-04-16 13:04 . 2009-03-06 14:22	284160	-c----w	c:\windows\system32\dllcache\pdh.dll
2009-04-16 13:04 . 2009-02-09 12:10	401408	-c----w	c:\windows\system32\dllcache\rpcss.dll
2009-04-16 13:04 . 2009-02-06 11:11	110592	-c----w	c:\windows\system32\dllcache\services.exe
2009-04-16 13:04 . 2009-02-09 12:10	473600	-c----w	c:\windows\system32\dllcache\fastprox.dll
2009-04-16 13:04 . 2009-02-06 10:10	227840	-c----w	c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 13:04 . 2009-02-09 12:10	453120	-c----w	c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 13:04 . 2009-02-09 12:10	729088	-c----w	c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 13:04 . 2009-02-09 12:10	617472	-c----w	c:\windows\system32\dllcache\advapi32.dll
2009-04-16 13:04 . 2009-02-09 12:10	714752	-c----w	c:\windows\system32\dllcache\ntdll.dll
2009-04-16 13:02 . 2008-05-03 11:55	2560	------w	c:\windows\system32\xpsp4res.dll
2009-04-16 13:02 . 2008-04-21 12:08	215552	-c----w	c:\windows\system32\dllcache\wordpad.exe
2009-04-14 19:34 . 2009-04-27 19:55	--------	d-----w	c:\documents and settings\administrator.NCMA\Local Settings\Application Data\Google
2009-04-14 19:34 . 2009-04-14 19:34	--------	d-----w	c:\documents and settings\administrator.NCMA\Local Settings\Application Data\Symantec
2009-04-01 19:06 . 2009-04-01 19:07	--------	d-----w	C:\OLD COMPUTER
2009-04-01 18:20 . 2009-04-01 18:20	--------	d-----w	c:\program files\Hewlett-Packard
2009-04-01 17:51 . 2009-04-01 17:51	--------	d-----w	c:\windows\system32\NtmsData
2009-04-01 15:57 . 2009-04-01 15:57	--------	d-----w	c:\documents and settings\sam.smith\Application Data\HP
2009-04-01 15:56 . 2009-04-01 15:56	--------	d-----w	c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-04-01 15:31 . 2009-04-01 18:20	--------	d-----w	c:\program files\HP
2009-04-01 15:29 . 2009-04-01 18:25	94123	----a-w	c:\windows\hppins05.dat
2009-04-01 15:29 . 2006-06-01 13:25	896	------w	c:\windows\hppmdl05.dat
2009-04-01 15:27 . 2009-04-01 15:27	--------	d-----w	c:\program files\Common Files\SWF Studio
2009-04-01 14:33 . 2002-07-01 21:30	1687625	----a-w	c:\windows\system32\InetClnt.dll
2009-04-01 14:32 . 2009-04-01 14:32	--------	d-----w	c:\program files\Common Files\WexTech Shared
2009-04-01 14:32 . 1998-08-04 15:22	111616	----a-w	c:\windows\system32\LTIH30TB.DLL
2009-04-01 14:32 . 2000-05-02 14:03	225280	----a-w	c:\windows\system32\AWRTL30.DLL
2009-04-01 14:32 . 2009-04-01 14:32	--------	d-----w	c:\program files\Common Files\LHSPF
2009-04-01 14:32 . 2009-04-01 14:33	--------	d-----w	c:\program files\Common Files\Intuit
2009-04-01 14:31 . 2002-09-20 12:45	339968	----a-w	c:\windows\system32\cdintf.dll
2009-04-01 14:31 . 2009-04-01 14:31	--------	d-----w	c:\program files\Intuit
2009-04-01 14:31 . 2000-10-20 05:05	25088	----a-w	c:\windows\system32\msxml3a.dll
2009-04-01 14:31 . 1999-05-10 04:00	1694992	----a-w	c:\windows\system32\vba6.dll
2009-04-01 14:04 . 2009-04-01 14:04	--------	d-----w	c:\windows\Intuit
2009-04-01 13:48 . 2009-04-01 13:48	--------	d-----w	c:\documents and settings\sam.smith\Local Settings\Application Data\FRx Software
2009-04-01 13:42 . 2002-09-04 19:19	90112	----a-w	c:\windows\system32\FRxUtl32.dll
2009-04-01 13:42 . 2009-04-01 13:42	--------	d-----w	c:\program files\FRx Software
2009-04-01 13:34 . 2007-11-05 12:06	374064	----a-w	c:\windows\system32\FRxTIFF32.DLL
2009-04-01 13:34 . 2007-10-18 21:31	165168	----a-w	c:\windows\system32\FRxJPEG32.DLL
2009-04-01 13:34 . 2007-10-18 21:41	60216	----a-w	c:\windows\system32\FRxBuEResNT.dll
2009-04-01 13:34 . 2007-10-18 21:41	238912	----a-w	c:\windows\system32\FRxBuEMonNT.dll
2009-04-01 13:34 . 2007-10-18 21:31	230712	----a-w	c:\windows\system32\BiImgUser.dll
2009-04-01 13:32 . 2009-04-01 13:51	--------	d-----w	c:\program files\Common Files\FRx Software
2009-04-01 13:32 . 2005-03-31 13:32	69632	----a-w	c:\windows\system32\dzstactx.dll
2009-04-01 13:32 . 2005-08-29 07:27	311296	----a-w	c:\windows\system32\dzactx.dll
2009-04-01 13:32 . 2005-08-29 07:27	278528	----a-w	c:\windows\system32\duzactx.dll
2009-04-01 13:32 . 2003-01-30 17:56	131072	----a-w	c:\windows\system32\QPRO32.DLL
2009-04-01 13:32 . 2009-04-01 15:56	--------	d-----w	c:\documents and settings\sam.smith\Local Settings\Application Data\ApplicationHistory
2009-04-01 13:26 . 2007-01-11 19:28	23104	----a-w	c:\windows\system32\frxmdimon.dll
2009-04-01 13:23 . 2009-04-01 13:23	--------	d-----w	c:\windows\system32\URTTEMP
2009-04-01 13:22 . 2009-04-01 13:22	--------	d-----w	c:\documents and settings\sam.smith\Local Settings\Application Data\Apple Computer
2009-04-01 13:10 . 2009-04-01 13:10	--------	d-----w	c:\documents and settings\sam.smith\Application Data\Microsoft Business Solutions
2009-04-01 12:58 . 2009-04-01 12:58	--------	d-----w	c:\program files\Common Files\Microsoft Dynamics GP
2009-04-01 12:58 . 2009-04-01 12:58	--------	d-----w	c:\windows\Downloaded Installations
2009-04-01 12:57 . 2009-04-01 12:57	--------	d-----w	c:\program files\Microsoft Dynamics
2009-03-31 16:03 . 2009-04-01 19:10	87488	----a-w	c:\documents and settings\sam.smith\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-31 14:09 . 2009-03-31 14:09	--------	d-----w	c:\program files\Microsoft SQL Server
2009-03-31 13:00 . 2009-03-31 13:00	--------	d-----w	c:\program files\CONEXANT
2009-03-30 17:59 . 2009-03-31 14:11	--------	d-----w	c:\documents and settings\sam.smith\Local Settings\Application Data\Adobe
2009-03-30 17:53 . 2009-03-30 17:53	--------	d-----w	c:\documents and settings\sam.smith\Personal
2009-03-30 15:01 . 2009-04-01 13:26	--------	d-----w	c:\documents and settings\sam.smith\Local Settings\Application Data\Google
2009-03-30 15:01 . 2009-03-30 15:01	--------	d-----w	c:\documents and settings\sam.smith\Local Settings\Application Data\Symantec
2009-03-30 14:56 . 2009-03-30 14:56	--------	d-----w	c:\documents and settings\wyatt.miedema\Local Settings\Application Data\Google
2009-03-30 14:10 . 2009-03-30 14:10	--------	d-----w	c:\documents and settings\wyatt.miedema\Application Data\Yahoo!
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-27 20:28 . 2008-02-19 22:03	--------	d-----w	c:\program files\Symantec AntiVirus
2009-04-01 14:31 . 2008-02-19 20:57	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-04-01 13:43 . 2009-04-01 13:43	132	----a-w	c:\documents and settings\sam.smith\Local Settings\Application Data\fusioncache.dat
2009-03-30 14:56 . 2008-03-17 19:21	--------	d-----w	c:\program files\Google
2009-03-30 14:48 . 2008-10-01 14:01	--------	d-----w	c:\program files\Yahoo!
2009-03-06 14:22 . 2004-08-04 10:00	284160	----a-w	c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-03-04 03:33	826368	----a-w	c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 10:00	78336	----a-w	c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-08-04 10:00	729088	----a-w	c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 10:00	714752	----a-w	c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 10:00	617472	----a-w	c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 10:00	401408	----a-w	c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 10:00	1846784	----a-w	c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2005-03-30 01:01	2066048	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2004-08-04 10:00	110592	----a-w	c:\windows\system32\services.exe
2009-02-06 11:08 . 2005-03-30 01:23	2189056	----a-w	c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-04 10:00	35328	----a-w	c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-08-04 10:00	56832	----a-w	c:\windows\system32\secur32.dll
2009-01-28 21:25 . 2008-07-01 12:51	--------	d-----w	c:\windows\Fonts\ParaWin
2008-12-18 14:58 . 2008-06-25 16:58	27976	----a-w	c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-12-18 14:58 . 2008-06-25 16:58	126360	----a-w	c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-09-04 16:58 . 2008-06-25 16:59	46408	----a-w	c:\program files\mozilla firefox\plugins\atmccli.dll
2008-06-25 16:59 . 2008-06-25 16:59	98712	----a-w	c:\program files\mozilla firefox\plugins\ieatgpc.dll
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-31 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-31 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-31 138008]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-05 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"Dell Photo AIO Printer 922"="c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe" [2005-04-22 290816]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2004-11-09 69632]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\qsb.exe" [2009-03-30 68592]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-12-24 618496]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-4-1 651264]
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Messenger\\msmsgs.exe"=
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
 
R2 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-06-15 115952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-30 101936]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-04-06 38496]
 
.
Contents of the 'Scheduled Tasks' folder
 
2009-04-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
 
2009-04-24 c:\windows\Tasks\Norton Security Scan for michael.sturm.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 08:18]
.
.
------- Supplementary Scan -------
.
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_9993303B90FE6C1D.dll
.
 
**************************************************************************
 
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-28 08:11
Windows 5.1.2600 Service Pack 3 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'lsass.exe'(824)
c:\program files\Bonjour\mdnsNSP.dll
.
Completion time: 2009-04-28  8:15
ComboFix-quarantined-files.txt  2009-04-28 12:14
 
Pre-Run: 40,405,659,648 bytes free
Post-Run: 40,642,154,496 bytes free
 
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
 
196	--- E O F ---	2009-04-17 07:05

Open in new window

log.txt
Avatar of warturtle
warturtle
Flag of United Kingdom of Great Britain and Northern Ireland image

Did you run MalwareBytes after ComboFix?? or before?? Runing MBAM after ComboFix is generally more effective.
Avatar of SD_Bolts

ASKER

I ran MBAM before but I will go and run it again and post the results.
OK, I re-ran the Malware bits in safemode again, and nothing, it took roughly an hour and a half, which its normal running time is usally 45 minutes.

The problem seems to bounce back and fourth, everything will function as normal, and then for about an hour or two the computer will just bog down and get very slow.  It is not consistent.

As another note the user is very work related with their computer and it is not often for it to be used outside of work purposes.
Avatar of hardatit
hardatit

Have you tried a registry cleaner? Try Glary its a free utility and it should help speed things up. Alsor run defrag and see if that helps. Fakeavalert doesn't slow a system like that it just creates n annoying popup that boots you out of a program every ten minutes or so you have to close it's window to return back to what you are doing. After you clean and defrag check what proccesses are still chewing up your cpu and we can go from there.
You mentioned that the system is running Symantec Corp ED.  Could the system be performing a background scan when you notice the slowdown ??  The reason I ask this I had the same problem when running Norton Internet Security.  Every time the system started a background scan or update the computer bogged right down. Ultimately I removed it and installed Sophos.
I will check both of these  report back tomorrow, sorry but I am out of the office for the day, thanks for all the good information and help.

To my knowledge the scan is not running in the back ground as I usally set them to run at specific times weekly, but I will double check to be sure.
I've seen something else that is quite interesting, the port 3389 which is allocated to Terminal Services  application is actually allowed access through the firewall - is this PC accessed remotely by someone else in your office? That could be why it slows down sometimes, because someone else is accessing it when its being used.

You might want to see the logs for the Terminal Services to find more information on the same. More info is here:

http://support.microsoft.com/kb/327508

Hope it helps.
OK, this is where I am at, I checked the TSS and did not see anything during the periods of lagging.  I checked the Anti-virus again and sure enough the anti-virus is running an auto-protect in the background.  It is not running constatly though but the couputer has a pretty slow processor as it is.  I checked the task manager and I saw that the System Idle Process and the RTvscan.exe where hogging the entire CPU, the RTvscan would run for a while and then it would stop.  I compaired this against my machine and the auto-protect runs in the same manner but I also have a larger processor, almost twice the size and more memory as well.

The user did state that his system overall seems to be running better but still catches a lag here and there.

Still here is the problem, this was not an issue before, but the user has only had the computer for roughly a month now.

I ran the Glary tool as well, and it cleaned and corrected.
ASKER CERTIFIED SOLUTION
Avatar of warturtle
warturtle
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Again I will try all these suggestions and then post back, thanks everyone.
Thanks Everyone, the computer still lags, but the suggestions above helped a bit.  Basically it comes down to what the user is using the computer for, he taxes it a lot and the end result is, he does not have enough machine to keep up with what he is doing.  Thanks for being so quick to respond to everything as well.