Broadband Tech > Security > Security > sudden slow browsing - CPU flat out

reply to jvmorris

Re: sudden slow browsing - CPU flat out

Okay, your sndmon.exe file is the same as people who have NIS/NPF 2002 working, so that doesn't seem to be the problem (same situation in a different thread at Wilders, incidentally).

I'm sorry, I'm getting confused between what's posted in what thread, so I didn't give you sufficient instructions last time.

We are fairly certain that, whatever is causing the problem, it is some file not routinely found by NIS Settings. If you check you'll notice that all the files you listed are quite old and that's what other people who've now resolved the problem have also noted. So, it's located in some other obscure Norton or Symantec directory (of which you've probably got about half a dozen scattered around your C: drive). As a working hypothesis, the next thing is to find a file, probably SYM*.*, located somewhere on the drive that shows a Date Modified after 1 May 2004 (but presumably before 24 May 2004). The way to find these files is to use Start | File | Find ... or Start | Search | Files ... , depending on your OS, and then search for the wildcard filename SYM*.* . You should find a lot of files, some of which you've already displayed above and have date modified information well before the most recent LiveUpdates -- so you can ignore those. Specifically, we're probably looking for something with a 2004 date. If you find such files, we need to know • the FileName, • the FileSize (to the BYTE, not the number expressed in KB), • the FileCreated date, • the FileModified date, and • FileVersion information (off the second tab) for each such file. You get this by right-clicking on the file(s) listed in the search/find display and then selected Properties in the pop-up menu that then appears. You're going to have to write it down, because it doesn't copy and paste easily -- be careful, every digit is important.

We can then check what you find against what someone else has and possibly identify the source of the problem.

Unfortunately probably is the operative word here; it may turn out to be some other obscure Symantec/Norton file that does not begin with SYM; Symantec is not saying and we're still looking for the source of the problem.
--
Regards, Joseph V. Morris

JV Morris I do not hve NIS or NPF but I am having the same problem. Panda and Nav both show me virus free and I am sitting behind a Internet Sharing Box with NAT enabled.I am also running NSW 2003.Any idea's?
--

That one is beyond me. I would strongly recommend that you start a new thread for NSW 2003, identify the OS you're using, and detail the precise symptoms that you are experiencing.

However, are you sure that your problems are not related to the DDos Attacks currently ongoing against a number of HTML-based security forums?

I haven't even had a chance to check out »www.incidents.org so far today, so I have to admit I'm not uptodate on what may be happening out there in general.
--
Regards, Joseph V. Morris

Thanks jvmorris!

Do you have a link to the other forum that covers this problem? I'd like to read up on it too.

SymantecRootInstaller.exe
2.0.39.0
C:\Program Files\Symantec\LiveUpdate
197 KB (201,880 bytes)
Saturday, May 17, 2003, 10:27:23 PM
Friday, January 02, 2004, 3:20:24 PM

SymantecRootInstaller.log
C:\Program Files\Symantec\LiveUpdate
42 bytes (42 bytes)
Monday, January 19, 2004, 10:33:39 PM
Monday, January 19, 2004, 10:33:39 PM

symaveng.cat
C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub
7.94 KB (8,137 bytes)
Tuesday, April 13, 2004, 4:00:00 AM
Tuesday, April 13, 2004, 4:00:00 AM

symaveng.inf
C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub
899 bytes (899 bytes)
Tuesday, April 13, 2004, 4:00:00 AM
Tuesday, April 13, 2004, 4:00:00 AM

SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

symdns.sys
5.3.1.54
C:\WINDOWS\system32\drivers
10.7 KB (11,008 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Thursday, May 13, 2004, 9:25:08 PM

symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
50.3 KB (51,552 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Thursday, May 13, 2004, 9:25:12 PM

SymIDSCo.sys
5.3.1.54
C:\WINDOWS\system32\drivers
166 KB (170,208 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

symredrv.sys
5.3.1.54
C:\WINDOWS\system32\drivers
15.9 KB (16,288 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

symtdi.sys
5.3.1.54
C:\WINDOWS\system32\drivers
257 KB (263,744 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Thursday, May 13, 2004, 9:25:18 PM

SymRedir.dll
5.3.1.54
C:\WINDOWS\system32
113 KB (115,936 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Thursday, May 13, 2004, 9:25:20 PM

SymNeti.dll
5.3.1.54
C:\WINDOWS\system32
493 KB (505,056 bytes)
Thursday, May 13, 2004, 9:25:22 PM
Thursday, May 13, 2004, 9:25:22 PM

SymFW.sys
5.3.1.55
C:\WINDOWS\system32\drivers
162 KB (166,048 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Tuesday, May 18, 2004, 1:01:28 AM

SYMAVENG.CAT
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20040518.032
7.94 KB (8,137 bytes)
Tuesday, May 18, 2004, 6:03:22 PM
Tuesday, May 18, 2004, 4:00:00 AM

SYMAVENG.INF
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20040518.032
900 bytes (900 bytes)
Tuesday, May 18, 2004, 6:03:22 PM
Tuesday, May 18, 2004, 4:00:00 AM

SYMAVENG.CAT
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20040519.021
7.94 KB (8,137 bytes)
Sunday, May 23, 2004, 12:34:14 PM
Wednesday, May 19, 2004, 4:00:00 AM

SYMAVENG.INF
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20040519.021
900 bytes (900 bytes)
Sunday, May 23, 2004, 12:34:14 PM
Wednesday, May 19, 2004, 4:00:00 AM

symaveng.cat
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmpD0.tmp
7.94 KB (8,137 bytes)
Sunday, May 23, 2004, 12:34:12 PM
Wednesday, May 19, 2004, 4:00:00 AM

symaveng.inf
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmpD0.tmp
900 bytes (900 bytes)
Sunday, May 23, 2004, 12:34:12 PM
Wednesday, May 19, 2004, 4:00:00 AM

SYMAVENG.985
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmpCF.tmp
1.39 KB (1,425 bytes)
Sunday, May 23, 2004, 12:33:42 PM
Wednesday, May 19, 2004, 10:53:48 AM

SYMAVENG.984
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmpCF.tmp
104 bytes (104 bytes)
Sunday, May 23, 2004, 12:33:42 PM
Wednesday, May 19, 2004, 10:53:50 AM
--
The war is over??

reply to sonofjay
Okay, thanks, scratching down here.
Randy, I could use a bit of help regarding his NAV entries.

said by sonofjay:

---

...Do you have a link to the other forum that covers this problem? I'd like to read up on it too.

---

quote:

---

SymantecRootInstaller.exe 2.0.39.0 too old. . . .
SymantecRootInstaller.log LOG File ...
symaveng.cat NAV file ...
symaveng.inf Ditto ...

---

quote:

---

SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

symdns.sys
5.3.1.54
C:\WINDOWS\system32\drivers
10.7 KB (11,008 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Thursday, May 13, 2004, 9:25:08 PM

symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
50.3 KB (51,552 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Thursday, May 13, 2004, 9:25:12 PM

SymIDSCo.sys
5.3.1.54
C:\WINDOWS\system32\drivers
166 KB (170,208 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

symredrv.sys
5.3.1.54
C:\WINDOWS\system32\drivers
15.9 KB (16,288 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

symtdi.sys
5.3.1.54
C:\WINDOWS\system32\drivers
257 KB (263,744 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Thursday, May 13, 2004, 9:25:18 PM

SymRedir.dll
5.3.1.54
C:\WINDOWS\system32
113 KB (115,936 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Thursday, May 13, 2004, 9:25:20 PM

SymNeti.dll
5.3.1.54
C:\WINDOWS\system32
493 KB (505,056 bytes)
Thursday, May 13, 2004, 9:25:22 PM
Thursday, May 13, 2004, 9:25:22 PM

---

quote:

---

SymFW.sys
5.3.1.55
C:\WINDOWS\system32\drivers
162 KB (166,048 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Tuesday, May 18, 2004, 1:01:28 AM

---

quote:

---

SYMAVENG.CAT NAV File...
SYMAVENG.INF ditto...
SYMAVENG.CAT ditto...
SYMAVENG.INF ditto...
symaveng.cat ditto...
symaveng.inf ditto...
SYMAVENG.985 ditto...
SYMAVENG.984 ditto...

---

Thanks!

Also, I just went back and confirmed that the create date and modified date were indeed the same on the files that had the two dates as being identical
--
The war is over??

reply to sonofjay

said by sonofjay:

---

For what its worth. I am able to temporarily surf normally after I disabled the Proxy service.

---

reply to sonofjay
Okay, back to the compressed list of other sites:

At Wilders, check the "Other Firewalls" forum after 13 May at »www.wilderssecurity.com/forumdis···php?f=31 .

At Computer Cops, check the "Symantec General" forum at »www.computercops.biz/forum82.html .

At Gladiator Security Forum, see the thread at »forum.gladiator-antivirus.com/in···4759&hl= .

There are multiple threads at Wilders and Computer Cops, only one (I believe) at Gladiator.

I have a problem in referencing threads in the NNTP newsgroups. The one most relevant is at nntp://news.grc.com/grc.security (hope I typed that correctly) and starts with a thread title of "AtGuard Vulnerable?" That's the one that lists the specific threads in the various HTML-based forums, which I really should consolidate and bring back here, also.
--
Regards, Joseph V. Morris

reply to sonofjay
You might also want to start monitoring the thread at »computercops.biz/postx41991-0-0.html ,
especially the recent postings by Troy_McClure.

You guys show different results on SYMFW.SYS and I'm not sure why (but that may be about to change, based on his last post).
--
Regards, Joseph V. Morris

reply to jvmorris

said by jvmorris:

---

.. I could use a bit of help regarding his NAV entries.

---

reply to Randy Bell
Okay here's what I have done so far. But firstly I want to thank you guys for all your help! Without these types of forums I know I would be locked away somewhere because of the stress involved in managing these types of problems. Thanks so much!

Well, I finally gave up and decided to try XP system restore. I hesitated a using it firstly because I had never had to use it before and secondly because I felt there should have been a work around for this and we had just yet to find it. Well, it looks like our friend at Symantec are leaving us out in the cold on this one so I thought what the hey. Below the ordinal list of files I posted above with their BEFORE and AFTER Restore information. I don't know if this will help us figure out what the offending file was/is but here it is anyway

##BEFORE RESTORE
SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

##AFTER RESTORE
SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Friday, May 31, 2002, 4:36:28 PM

##BEFORE RESTORE
SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

##AFTER RESTORE
SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Friday, May 31, 2002, 4:36:28 PM

##BEFORE RESTORE
symdns.sys
5.3.1.54
C:\WINDOWS\system32\drivers
10.7 KB (11,008 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Thursday, May 13, 2004, 9:25:08 PM

##AFTER RESTORE
symdns.sys
4.5.2.1
C:\WINDOWS\system32\drivers
10.9 KB (11,176 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Friday, May 31, 2002, 4:39:52 PM

##BEFORE RESTORE
symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
50.3 KB (51,552 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Thursday, May 13, 2004, 9:25:12 PM

##AFTER RESTORE
symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
32.5 KB (33,320 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Friday, May 31, 2002, 4:40:02 PM

##BEFORE RESTORE
SymIDSCo.sys
5.3.1.54
C:\WINDOWS\system32\drivers
166 KB (170,208 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

##AFTER RESTORE
**DOES NOT EXISTS BUT THIS FILENAME IS CLOSE
SymIDS.sys (notice the name difference)
4.5.2.1
C:\WINDOWS\system32\drivers
11.9 KB (12,200 bytes)
Thursday, May 13, 2004, 9:25:14 PM
Friday, May 31, 2002, 4:40:22 PM

##BEFORE RESTORE
symredrv.sys
5.3.1.54
C:\WINDOWS\system32\drivers
15.9 KB (16,288 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

##AFTER RESTORE
symredrv.sys
4.5.2.1
C:\WINDOWS\system32\drivers
14.2 KB (14,640 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Friday, May 31, 2002, 4:40:12 PM

##BEFORE RESTORE
symtdi.sys
5.3.1.54
C:\WINDOWS\system32\drivers
257 KB (263,744 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Thursday, May 13, 2004, 9:25:18 PM

##AFTER RESTORE
symtdi.sys
4.5.2.1
C:\WINDOWS\system32\drivers
155 KB (158,728 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Friday, May 31, 2002, 4:40:16 PM

##BEFORE RESTORE
SymRedir.dll
5.3.1.54
C:\WINDOWS\system32
113 KB (115,936 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Thursday, May 13, 2004, 9:25:20 PM

##AFTER RESTORE
SymRedir.dll
4.5.2.1
C:\WINDOWS\system32
29.6 KB (30,360 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Friday, May 31, 2002, 4:40:06 PM

##BEFORE RESTORE
SymNeti.dll
5.3.1.54
C:\WINDOWS\system32
493 KB (505,056 bytes)
Thursday, May 13, 2004, 9:25:22 PM
Thursday, May 13, 2004, 9:25:22 PM

##AFTER RESTORE
DOES NOT EXIST

##BEFORE RESTORE
SymFW.sys
5.3.1.55
C:\WINDOWS\system32\drivers
162 KB (166,048 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Tuesday, May 18, 2004, 1:01:28 AM

##AFTER RESTORE
SymFW.sys
4.5.2.1
C:\WINDOWS\system32\drivers
69.1 KB (70,784 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Friday, May 31, 2002, 4:39:56 PM

Also Sndmon.exe is no longer present anywhere on my PC.

A few things I should note is that even when I run a LU now, it does not present me with any new downloads or updates. I can only assume this is because there is a catalog/file somewhere on my PC that tracked what LU I got and knows that I have already downloaded and installed it once (even though I backed out of the changes with an XP restore).

So far so good and my CPU is back to where it should be. Howver, I have yet to do any surfing other than here so I guess I'll have to go try it out some more.
--
The war is over??

reply to Randy Bell

First Clip from Search on Sym*.*

Second Clip from Search on Sym*.*

reply to jvmorris

said by jvmorris:

---

You might also want to start monitoring the thread at »computercops.biz/postx41991-0-0.html ,
especially the recent postings by Troy_McClure.

You guys show different results on SYMFW.SYS and I'm not sure why (but that may be about to change, based on his last post).

---

reply to Randy Bell
Randy,

Before I did the XP restore, I also noticed that there was a service that is now no longer showing up. It started with "S*" and was named something like "Symantec Network ...." or something thereabouts.

Now if I understand you correctly, you are saying that your son installed this update on his PC and it is working fine? If so can you check to see if there is a service similar to the one I described above? On my system it was set to "manual" startup. This could be related to the Sndmon.exe which is now no longer on my PC but I though it might be worth checking out.

Thanks!
--
The war is over??

Quick note on your query to Randy.

First, Randy's son is only running NAV 2002, as I recall. Based on what I've seen, NAV 2002 was never adversely affected by the 12 May LiveUpdate or anything that happened subsequently. So Randy's information is primarily just that -- informational, with a possible eye towards finding any obvious discrepancies.

Second, I believe Randy's son must be using a Win 9X/ME box, since I see *.vxd files in his listings. (Maybe it's subsequently been upgraded?) However, on a Win XP box, these would almost invariably be *.sys files and they would not necessarily have the same file sizes, dates, etc.

Just wanted to avoid any wild goose chases here. I insist that only I shall be allowed to conduct wild goose chases!
--
Regards, Joseph V. Morris

Thanks jvmorris. Based on this I guess Randy is the wrong person to ask.... Perhaps some else might be able to very this though.
--
The war is over??

I'm pretty sure that the service you saw running was Symantec Network Device (or Driver) Monitor, which just happens to be sndmon.exe. That's been noted before (possibly by Randy, but I know I have a private e-mail that noted this and associates that service with sndmon.exe).

I've just summarized all your work of yesterday in the forum over at Wilders (by specific references here) -- see »www.wilderssecurity.com/showthre···=1&pp=25 -- and asked those guys to see if they've got the same files you have (err, had) and, if not to let us (and everyone else) know. So, hang in there, 'welp is on the hay'

And what I wouldn't give for a decent version control system in LiveUpdate or at least something that provided legible information about just what was being changed, added, or deleted. Actually, once upon a time, they had a feature like that -- it was called Live Advisor, but that got dropped several years ago.
--
Regards,
Joseph V. Morris