Avira Support Forum

Good afternoon, This is my first msg on forum. Not vy PC literate. I purchased premium about 3 months ago. Since then my PC has slowed down drastically. Unfortunately i live in Azerbaijan (Am British) and 99% of software is illegal. I have Busniess Vista (legal) and everything else on PC is legal but no one to help as all they want to do is take this stuff off and put on "piretical"!!

I did disable webguard and mailgaurd as they seemed to be active all the time. Is this normal. I would be quite happy for someone to look at my PC

Best regards,

Jake

Please post a HijackThis Logfile (http://www.trendsecure.com/portal/de/_do…/HiJackThis.exe).

Good morning Luk,

Many thanks for your quick respoonse.

I cant see anywhere that i can attach a file so have cut and pasted. I hope this is acceptable.

Best regards,

John

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:24 AM, on 6/14/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avcenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\John\Desktop\HiJackThis.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\msfeedssync.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {78875F5C-A685-4405-8DC5-D48DC65452B0} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{474DD78F-388B-40FA-A091-30B619C74F3F}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{951CA443-4C83-427B-8109-495AD18BC087}: NameServer = 192.168.22.2 192.168.22.22
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 6107 bytes

Please install SP2: http://www.microsoft.com/downloads/detai…ff-03f6aefac6f8 Does this help? If not, make a Search for Rootkits with AntiVir and post the Report. Maybe Windows Desktop Search slows down your PC. If you do not use it, deactivate it. Please let us know more about your PC (CPU, RAM).

Good afternoon luK,

Thanks for reply. The download is very big so i will have to do it tomorrow at work.

How do I find if Windows desktop search is activated? Also where do i go for the antivir rootkit tool?

Tks

John

Hi,

Quoted

Also where do i go for the antivir rootkit tool?

In Avira's GUI go to Local Protection, Scanner, Rootkit Search.

Quoted

Avira Premium seems to slow down my PC

Please go to Task Manager and look for what process is consuming much resources.

Good morning Alexander,

Where is luK-he was dong a good job!

1. I tried downloading the the file that luk suggested but it said"thie version of this file is not compatible with the version of windows you are running etc"
2. You have given me information on rootkit which i will follow now.
3. Good news i finally found out on the internet how to disable Windows search and did this. The computer seems to be working faster-buit still a bit slow)i think) Also it appears to get slow after about 30 minutes?

Will come back with results about rootkit. Am very impressed with service up to now.

Regards,

Jake

Good morning again Alexander,

I did a root kit scan and got the following result: Objects searched 474,614 warnings 134 all the rest were zeros. The report seems to go on forever so have not included it.

The task manager does not show anything unusual.

PC acting sort of 'normalish' now. Will it slow it down if i now activate webguard and mailguard again?

Thanks,

John

Hi,

Quoted

Will it slow it down if i now activate webguard and mailguard again?

I don't think that it will. Please try it and post here the results.

It probably was windows search slowing down your system, every so often when the PC is idle or practically idle windows search will start indexing relevant things to speed up searches if you turn off windows search it only indexes items in the start search

So you shouldn't get any more problems, here's a paragraph from wikipedia:

Upon installation, Windows Search (and Windows Desktop Search) builds an index of the files on a user's hard drive. The initial creation of this index can take up to several hours, but this is a one-time event. Once the indexing is complete, Windows Search is able to use this index to search results more rapidly than it would take to search through all the files on the computer in real time although it cannot perform searches on non indexed locations.

You may also want to try autoruns which can be found here this allows you to stop programs on startup: autoruns

Good morning Criag and Alexander if you are still there,

Unfortunately back to the drawing board! Yesterday after disabling windows search the system seemed to work much faster. I have still not enabled the webguard and mailguard.

This morning it has started to go slow again. I have checked that the windows search has not re-installed itself again by mistake and it is still disabled.

When i switch off and start up again it works fine for a while and then really slows down. It can take up to 3-4 minutes to open an e-mail eventually.

Should my next move be to try and run SP2? I got an error message yesterday.

Criag your autorun thing looks a bit too technical for me!

Kind regards,

John

H,
When the computer is slow again please go to Task Manager and tell me what process is consuming much CPU or memory.

Quoted

Should my next move be to try and run SP2? I got an error message yesterday.

If you want to install SP2 for Vista, then you must take in consideration to install Avira 9. What error message did you received?

Good morning Alexandru,

Where do i find avira 9 to install?

Have just been on task manager, although PC is in good better mood just now!

Process
The 4 largest ones are:

dwm.exe desktop 19,972k
sidebar.exe 8304 k
skype 4764 k
outlook exe 7572k
Processes 50 cpu 21% but moving about a lot and physical memory 54%

Many thanks,

Jake

Hmm,

Windows Defender could also slow down your PC. You should stop and disable this program because there is no need to use it peramently together with Avir Premium. You should also deinstall all toolbars.

Please tell us a little bit about your PC (size of RAM and the built in processor).


Michael

Hi,

Quoted

Where do i find avira 9 to install?

You can find it here.

Quoted from "Michael_Mann"

Hmm,

Windows Defender could also slow down your PC. You should stop and disable this program because there is no need to use it peramently together with Avir Premium. You should also deinstall all toolbars.

Please tell us a little bit about your PC (size of RAM and the built in processor).


Michael

Good morning Michael,

PC is slowing getting better. How do i disable defender and all toolbars. I am not very literate with PC's.


PC details:
Vista ultimate RAM 8 GB 32 bit. intel r core tm duo CP T5450 @ 1.67 Ghz. (whatever that means!)

I should not be let near computers! I started to lose things this afternoon after trying to disable defender. Somehow went into safe mode and couldnt get out and then did system restore for yesterday and have now lost avira?

Q1. Again how do i get my avira back?

Hi,
If Avira isn't present at all, then reinstall it.

Alexandru,

I am really sorry to be a pain. The pc seems to be working much faster now but i cannot install avira. When i go to the place you say i try to install premium 9 and it goes through all the procedures and then a the end it says it cannot find avira. Will have to switch off for tonight as interenet very slow and will try again at work tomorrow morning.

Have a nice evening

Jakr

Good morning Alexandru,

Funny situation. PC never worked so fast! My pc shows that avira is a programme and is running, but i cannot see it on my desktop like before and cannot get your normal screen up. Am tempted to leave everything as it is, but just a bit worried i am not protected?

Regards,

John