# Laptop issues



## beorning (Apr 14, 2006)

Playing around with my wife's laptop...

It's doing everything extremely slowly. I cleaned all of the spyware that the three spyware removal programs recommended here found, did a virus scan with Avast! Nada.

When the computer is booted up and windows starts, there is an error message:

Smartbridge alerts: MotiveSB.exe- entry point not found

X - The procedure entry point GetProcessImageFileNameW could not be located in the dynamic link library PSAPI.DLL


This message has come up consistently for about a month, according to my wife.

I ran Hijack this. Here's the log file:

Logfile of HijackThis v1.99.1
Scan saved at 11:20:57 AM, on 2/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\DOCUME~1\ANNEBA~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
C:\Documents and Settings\Anne Bachhuber\Desktop\HijackThis.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE


----------



## beorning (Apr 14, 2006)

The rest of the log file. It was too long for one post:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165514058000
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE


Any help would be greatly appreciated.


----------



## Karen (Apr 17, 2002)

Wow, no wonder your slow; you've got a lot of stuff running! First, disable your Messenger PMing service. Use it only when you need it. It's a memory hog when just left running with all your other programs.

Secondly, consider getting rid of the Yahoo toolbar. It installs a lot of programs, which have to run all at the same time, also a big memory hog.

Thirdly, disable Excel so it isn't running all the time. This one is a HUGE memory hog!

You also want to get disable:
igfixtray.exe
hkcmd.exe
igfxpers.exe
wltray.exe
updreg.exe
issch.exe
qttask.exe
ybrwicon.exe
motiveSB.exe
realsched.exe
reader_sl.exe

Most of these are updaters, reminders to register a product, etc. They remain memory resident and just eat up memory. All that I've mentioned so far won't be deleted, they are still there if you need them; they will instead, just be hanging out on your harddrive but not taking up any memory to slow you down. None of these are needed for your computer programs to run.

The disabling can all be done through your start-up menu. Click "start"; "run"; and type in: msconfig 
Then go to the "startup" tab and uncheck each of items listed above.

In "Hijack This" put a checkmark next to 011 - Options group: [INTERNATIONAL] International*. These are extra IE groups and just use resources and also can be scripting hijackers.

Do all of this and see if things speed up. I would also do a scan and defrag. After you do all that, be sure and clear your internet cache, cookies, and history. If your still running slow, let us know and we can tweak some more if there's been no improvement; but I suspect this will do the trick.


----------



## Nevada (Sep 9, 2004)

I'm wondering if the reason the laptop is running slowly could be more fundamental problem, such as a resource shortage problem. Before getting carried away with analyzing your log file, I would check memory usage.

Go to the Task Manager by doing a Ctrl-Alt-Del. Select the performance tab. Your current memory usage is in the PF Usage box. Report that number here.

If you don't know how much memory you have installed in the laptop, right-click on the My Computer icon and select properties. On the General tab near the bottom under "Computer:" it will say how much memory (RAM) is installed in that machine. Report that number here also.


----------



## beorning (Apr 14, 2006)

> Go to the Task Manager by doing a Ctrl-Alt-Del. Select the performance tab. Your current memory usage is in the PF Usage box. Report that number here.


286 Mb - after doing most of the things that Karen suggested.



> how much memory (RAM) is installed in that machine. Report that number here also.


.99 GB RAM

And now for some stupid questions. 

I can't for the life of me figure out how to disable Excel. Any pointers?

Ditto for the Messenger PMing.

At&T yahoo has an online protection program that I can't get to stop running. I prefer to run Avast and spyware removal software on my own. ( and frankly, the yahoo program never finds anything when I have used it) How would I go about removing it?

The laptop is running better now, Thanks very very much for the help


----------



## Kung (Jan 19, 2004)

FYI, in the future, one can go to www.hijackthis.de and simply copy/paste their log there, and it'll analyze it for you.


----------



## Gary in ohio (May 11, 2002)

A classic example of why people have slow machines, Look at all that junk, helper programs. Do you have an ipod? If not then turn off the helper and server. Itune likes to turn them on regardless. get rid of anything you dont need to run. Most "helper" files can be removed with no issues.


----------



## Teresa S. (Mar 2, 2006)

> .99 GB RAM


Gigs or Megs?


----------



## Nevada (Sep 9, 2004)

Teresa S. said:


> Gigs or Megs?


I'm sure he has 1 gig. He seems to have plenty of memory installed.

I suspect there is something going on in the background that's tying-up the processor. I would to a Ctrl-Alt-Del again, click on the Performance tab, and just monitor the CPU activity for a while. If the CPU usage is high, click on the Processes tab to see which process is using the CPU resources.

I think you'll have a lot better luck finding the culprit in the Task Manager than you will guessing which process in the "HijackThis" log might be doing it. The Task Manager will show you exactly which processes are using which resources. Anything else is just a shot in the dark.


----------



## Karen (Apr 17, 2002)

Not disagreeing, but he needed to clean up all that stuff anyway, regardless of what else is found. They are just sitting there do nothing but hogging resources. Hijack This doesn't show the amount of resources being used, but it does give a much broader view (and just as accurate) as the task manager. 

Kung, those Hijack This analyers will only help if you have spyware, virus, etc. It won't tell you which processes to end or whether or not you need them for your machine. 

Hijack This is always helpful in determining information for a slow computer and, IMHO, one of the very first steps to take. You quickly can spot a trojan, hijacker, etc. immediately. But you have to know how to read a Hijack This log, what the numbers mean, and have BHO list.


----------



## beorning (Apr 14, 2006)

Yep. It's one gig.

Thanks again for all the help, everyone.


----------



## Nevada (Sep 9, 2004)

Karen said:


> Not disagreeing, but he needed to clean up all that stuff anyway, regardless of what else is found. They are just sitting there do nothing but hogging resources.


That's true, and I'm not against someone doing a little housekeeping from time to time. But my intent is to solve his immediate problem.

With 1 gig of memory he has sufficient RAM to get away with a little deadwood running in the background, but I suspect that something is tying-up the CPU. He hasn't confirmed that by checking the Task Manager yet. Hopefully when we see the memory and CPU usage statistics we'll have a better idea of what's making the system run slow.


----------



## beorning (Apr 14, 2006)

Nevada,

What, exactly am I looking for in the Task Manager. I've spent a good amount of time since yesterday watching the performance screen and there hasn't been much of any fluctuation in the usage history. It seems like the processes using the most resources are necessary ones. ( iexplore.exe, explorer.exe, svchost.exe, ashserv.exe)

Is there some way to look back at the history from yesterday A.m. when the computer was bogging down?

I'd be more than happy to post whatever information is needed to help solve the issue, but I'm unsure as to what that information is and where to find it.


----------



## Nevada (Sep 9, 2004)

beorning said:


> What, exactly am I looking for in the Task Manager. I've spent a good amount of time since yesterday watching the performance screen and there hasn't been much of any fluctuation in the usage history. It seems like the processes using the most resources are necessary ones. ( iexplore.exe, explorer.exe, svchost.exe, ashserv.exe)


The Performance tab has a graph for both CPU usage and memory usage that displays a trend log. I don't know how long the history is in the trend log, but it should be a minute or two.

What I would do is open the Task Manager, then minimize it (minus sign in the upper-right corner). Just use the machine. When you notice a severe slowdown, take a look at the CPU & memory usage and see if you notice anything.

What we're looking for is the CPU or memory getting maxed-out, more likely it will be the CPU because you have so much memory. Put the computer through its paces and try to get an idea of what's happening to your resources when the slowdown occurs.

All of the executables you mentioned above are native Windows applications except for ashserve.exe, which is your Avast antivirus. Nothing nasty about any of them. Avast shouldn't take over your CPU though, although there can be problems with that. I recall that when XP SP2 first came out there was a bug that made AVG scan the service pack for up to an hour during installation.


----------

