Q: Programs get sluggish? 12

[dcloud]

I've noticed when I run Photoshop on my computer that opening other programs take a little longer and the whole system becomes sluggish. I have Winodws XP Home running on a 2.4GHz Pentium 4 with 1022MB of Kingston dual channel PC3200 RAM. I would have thought having more RAM would help this issue, but obviously not. Recently I got a new SATA hardrive (SeaGate Barracuda 250GB) and I was thinking maybe I need to get a second one to act as a Photoshop scratch disc.

 

[ski]

Update your AV program and check for viruses, run Ad-aware and Spybot to remove any spyware, and shut down all unnecessary programs running in the background.
If those do not help, then check the amount of unused physical RAM available. If it's near or at zero, and the virtual memory is activated, then your system needs more RAM.
If there's a lot of unused RAM available, then check the CPU usage. If it's at 100%, then make sure all of the drives are configured for DMA(direct memory access).
If they are, then the CPU is the bottleneck.

 

[cupid11213]

well getting another hard disk really wouldn't help you since, running photoshop is really just cpu and ram intensive, i would think that your 2.4 intel is taking longer running those photoshop and any other program you might try to open, it would also depend oon the program your trying to open while running photoshop. And i believe there is a settings in photoshop that allows you to lower the ram allowed for it to use, since i believe that it is ussually set to use 1/2 of the ram installed. I also use photoshop cs2 and my computer is a little sluggish running other programs also, but i only have a 2200+ duron, hehehe. But it runs well lon it's own. That's why i'm changing soon to a dual core amd 3800+

hope this helps


luis

Some people make things happen, some people watch things happen, while others wonder what happened.

 

[dcloud]

Spyware, adware, viruses - I check for those every day. Those aren't the problem. As far as unused RAM I am guessing you mean check that in the Task Manager (under Performance tab)? If that's the case it's fine, and the only time the CPU usuage spikes at 100 is when I first open a program.

 

[BadFrog]

Have you checked the event log to make sure nothing funky is going on?

By todays standards 1 Gig of RAM is not a lot....

"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy"
Albert Einstein

 

[dcloud]

I see a lot of Errors for Service Control Manager. When I click the error I get the following explanation - The Laa1erps service failed to start due to the following error: The system cannot find the path specified. I see some other warnings, like one for Tcpip: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. Some them seem to be services I have turned off.

A gig of RAM was all I could afford. It should be more than sufficient to run Photoshop and other programs. I'm just wondering why it slows things down every so often. Especially if I try to run File Browser, then things really get bogged down.

 

[BadFrog]

You are correct it should be sufficient to run Photoshop, generally speaking, but depending on what your doing you can still find limits.

I would suggest researching the error you discoverd. It sounds as if that service may be trying to connect to something that has moved or no longer exists and that could very well make your PC sluggish.

"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy"
Albert Einstein

 

[dcloud]

Well, I tried to research the error, but I don't find anything in the Services for Service Control Manager. I did find one for Security Center, but I don't think that's the same. So I have no idea what this is let alone what it cannot find.

 

[LawnBoy]

The Service Control Manager is a "shell" that manages the services running in Win32. In the example you give, the SCM is merely reporting to you that the service Laa1erps has failed. The problem is not with SCM, it is with Laa1erps. Basically it means that there is an entry either in the Registry or in the Startup menu that is trying to load the files needed by Laa1erps but it cannot find them.

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts

Wow, that's a biggie. This means that your pc is running bucketloads of network connections and is trying to run more. This is just wrong, your home pc should not be making that many network connections. This stinks of some form of Trojan, regardless of what your scanners may tell you.

Remember:
Scanners can be fooled, tricked into not loading updates, etc.
You could be the victim of a "zero-day" vulnerability.
You could have a specific backdoor loaded that is not classified as a virus.

 

[Freestone]

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts"

I would look harder at this error message. Are you running any P2P software or other sharing type program? This message is a symptom of something in your PC trying to go out to the Internet. Is there any program you are running that requires more than 10 TCP connections per second?

 

[dcloud]

Uh-oh, now that sounds scary. Thanks for info on that service. I appreciate it. I have no P2P software on my machine. What do you suggest I do as far as scanning for something of this nature? How would I go about finding out about a backdoor vulnerability?

 

[dcloud]

Oh yeah, the Laa1erps service is set to Manual.

 

[Freestone]

For a start, go here

http://www.merijn.org/

and download HijackThis. Create a log and post it here.

 

[LawnBoy]

I also recommend a good personal firewall such as ZoneAlarm. These programs will alert you when anything tries to establish a connection to your pc, either incoming or outgoing. ZoneAlarm will even tell you the name of the .exe making an outbound request, which has helped me troubleshoot problems many times.

I personally stay away from the firewalls bundled with Windows and anti-virus software as they tend to create more problems than they help.

 

[dcloud]

Freestone thanks for the link. I downloaded the program and here is the log file it generated:

Logfile of HijackThis v1.99.1
Scan saved at 3:47:32 PM, on 5/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=54729

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=39204

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

 

[Freestone]

The log looks pretty clean to me. Perhaps someone else can see something.

How often does the TCPIP message appear in your log and can you relate their timestamps to anything you were doing at the time?

 

[dcloud]

It happens on a daily basis it seems. For instance just to give you some idea of times, the Event Viewer always shows two instances together, like on 5/29/2006 at 1:35:13 PM there are two errors of it happening. It's that way on all of them. Sometimes it only occurs once during the day, but other times it's happening more than once a day. And the time is always different.

 

[Freestone]

Well, it's not a constant thing, which would certainly slow things down. It sounds more like something trying to update itself, like AVG, Microsoft's Defender, or Microsoft's Updates, or ???. But this is speculation. And that many TCP connections (more than 10 per secod) still doesn't sound right for any update. Lawnboy's suggestion of ZoneAlarm would help isolate the problem.

 

[dcloud]

Ok, so if my hijack this file is relatively clean, then I'm right back to my original question: what could be slowing my system down?

 

[BadFrog]

Laa1erps" This still bugs me. A google on this turns up nothing which concerns me. If it is a lgitimate service then google should show something on it. Are you sure you copied it verbatim form the event log? I would look hard throughout your registry and C drive for any resemblences to that.

Your HJT log does look clean however as Lawnboy pointed out that doesn't mean you aren't infected, just less likely.

"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy"
Albert Einstein