Broadband Tech > Security > Security > sudden slow browsing - CPU flat out

reply to jvmorris

Re: sudden slow browsing - CPU flat out

reply to sonofjay
Okay, thanks, scratching down here.
Randy, I could use a bit of help regarding his NAV entries.

said by sonofjay:

---

...Do you have a link to the other forum that covers this problem? I'd like to read up on it too.

---

quote:

---

SymantecRootInstaller.exe 2.0.39.0 too old. . . .
SymantecRootInstaller.log LOG File ...
symaveng.cat NAV file ...
symaveng.inf Ditto ...

---

quote:

---

SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

symdns.sys
5.3.1.54
C:\WINDOWS\system32\drivers
10.7 KB (11,008 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Thursday, May 13, 2004, 9:25:08 PM

symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
50.3 KB (51,552 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Thursday, May 13, 2004, 9:25:12 PM

SymIDSCo.sys
5.3.1.54
C:\WINDOWS\system32\drivers
166 KB (170,208 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

symredrv.sys
5.3.1.54
C:\WINDOWS\system32\drivers
15.9 KB (16,288 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

symtdi.sys
5.3.1.54
C:\WINDOWS\system32\drivers
257 KB (263,744 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Thursday, May 13, 2004, 9:25:18 PM

SymRedir.dll
5.3.1.54
C:\WINDOWS\system32
113 KB (115,936 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Thursday, May 13, 2004, 9:25:20 PM

SymNeti.dll
5.3.1.54
C:\WINDOWS\system32
493 KB (505,056 bytes)
Thursday, May 13, 2004, 9:25:22 PM
Thursday, May 13, 2004, 9:25:22 PM

---

quote:

---

SymFW.sys
5.3.1.55
C:\WINDOWS\system32\drivers
162 KB (166,048 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Tuesday, May 18, 2004, 1:01:28 AM

---

quote:

---

SYMAVENG.CAT NAV File...
SYMAVENG.INF ditto...
SYMAVENG.CAT ditto...
SYMAVENG.INF ditto...
symaveng.cat ditto...
symaveng.inf ditto...
SYMAVENG.985 ditto...
SYMAVENG.984 ditto...

---

Thanks!

Also, I just went back and confirmed that the create date and modified date were indeed the same on the files that had the two dates as being identical
--
The war is over??

reply to sonofjay

said by sonofjay:

---

For what its worth. I am able to temporarily surf normally after I disabled the Proxy service.

---

reply to sonofjay
Okay, back to the compressed list of other sites:

At Wilders, check the "Other Firewalls" forum after 13 May at »www.wilderssecurity.com/forumdis···php?f=31 .

At Computer Cops, check the "Symantec General" forum at »www.computercops.biz/forum82.html .

At Gladiator Security Forum, see the thread at »forum.gladiator-antivirus.com/in···4759&hl= .

There are multiple threads at Wilders and Computer Cops, only one (I believe) at Gladiator.

I have a problem in referencing threads in the NNTP newsgroups. The one most relevant is at nntp://news.grc.com/grc.security (hope I typed that correctly) and starts with a thread title of "AtGuard Vulnerable?" That's the one that lists the specific threads in the various HTML-based forums, which I really should consolidate and bring back here, also.
--
Regards, Joseph V. Morris

reply to sonofjay
You might also want to start monitoring the thread at »computercops.biz/postx41991-0-0.html ,
especially the recent postings by Troy_McClure.

You guys show different results on SYMFW.SYS and I'm not sure why (but that may be about to change, based on his last post).
--
Regards, Joseph V. Morris

reply to jvmorris

said by jvmorris:

---

.. I could use a bit of help regarding his NAV entries.

---

reply to Randy Bell
Okay here's what I have done so far. But firstly I want to thank you guys for all your help! Without these types of forums I know I would be locked away somewhere because of the stress involved in managing these types of problems. Thanks so much!

Well, I finally gave up and decided to try XP system restore. I hesitated a using it firstly because I had never had to use it before and secondly because I felt there should have been a work around for this and we had just yet to find it. Well, it looks like our friend at Symantec are leaving us out in the cold on this one so I thought what the hey. Below the ordinal list of files I posted above with their BEFORE and AFTER Restore information. I don't know if this will help us figure out what the offending file was/is but here it is anyway

##BEFORE RESTORE
SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

##AFTER RESTORE
SymRedir.cat
C:\WINDOWS\system32\drivers
20 bytes (20 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Friday, May 31, 2002, 4:36:28 PM

##BEFORE RESTORE
SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Thursday, May 13, 2004, 9:14:24 PM

##AFTER RESTORE
SymRedir.inf
C:\WINDOWS\system32\drivers
1.10 KB (1,133 bytes)
Thursday, May 13, 2004, 9:14:24 PM
Friday, May 31, 2002, 4:36:28 PM

##BEFORE RESTORE
symdns.sys
5.3.1.54
C:\WINDOWS\system32\drivers
10.7 KB (11,008 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Thursday, May 13, 2004, 9:25:08 PM

##AFTER RESTORE
symdns.sys
4.5.2.1
C:\WINDOWS\system32\drivers
10.9 KB (11,176 bytes)
Thursday, May 13, 2004, 9:25:08 PM
Friday, May 31, 2002, 4:39:52 PM

##BEFORE RESTORE
symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
50.3 KB (51,552 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Thursday, May 13, 2004, 9:25:12 PM

##AFTER RESTORE
symndis.sys
5.3.1.54
C:\WINDOWS\system32\drivers
32.5 KB (33,320 bytes)
Thursday, May 13, 2004, 9:25:12 PM
Friday, May 31, 2002, 4:40:02 PM

##BEFORE RESTORE
SymIDSCo.sys
5.3.1.54
C:\WINDOWS\system32\drivers
166 KB (170,208 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

##AFTER RESTORE
**DOES NOT EXISTS BUT THIS FILENAME IS CLOSE
SymIDS.sys (notice the name difference)
4.5.2.1
C:\WINDOWS\system32\drivers
11.9 KB (12,200 bytes)
Thursday, May 13, 2004, 9:25:14 PM
Friday, May 31, 2002, 4:40:22 PM

##BEFORE RESTORE
symredrv.sys
5.3.1.54
C:\WINDOWS\system32\drivers
15.9 KB (16,288 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Thursday, May 13, 2004, 9:25:16 PM

##AFTER RESTORE
symredrv.sys
4.5.2.1
C:\WINDOWS\system32\drivers
14.2 KB (14,640 bytes)
Thursday, May 13, 2004, 9:25:16 PM
Friday, May 31, 2002, 4:40:12 PM

##BEFORE RESTORE
symtdi.sys
5.3.1.54
C:\WINDOWS\system32\drivers
257 KB (263,744 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Thursday, May 13, 2004, 9:25:18 PM

##AFTER RESTORE
symtdi.sys
4.5.2.1
C:\WINDOWS\system32\drivers
155 KB (158,728 bytes)
Thursday, May 13, 2004, 9:25:18 PM
Friday, May 31, 2002, 4:40:16 PM

##BEFORE RESTORE
SymRedir.dll
5.3.1.54
C:\WINDOWS\system32
113 KB (115,936 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Thursday, May 13, 2004, 9:25:20 PM

##AFTER RESTORE
SymRedir.dll
4.5.2.1
C:\WINDOWS\system32
29.6 KB (30,360 bytes)
Thursday, May 13, 2004, 9:25:20 PM
Friday, May 31, 2002, 4:40:06 PM

##BEFORE RESTORE
SymNeti.dll
5.3.1.54
C:\WINDOWS\system32
493 KB (505,056 bytes)
Thursday, May 13, 2004, 9:25:22 PM
Thursday, May 13, 2004, 9:25:22 PM

##AFTER RESTORE
DOES NOT EXIST

##BEFORE RESTORE
SymFW.sys
5.3.1.55
C:\WINDOWS\system32\drivers
162 KB (166,048 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Tuesday, May 18, 2004, 1:01:28 AM

##AFTER RESTORE
SymFW.sys
4.5.2.1
C:\WINDOWS\system32\drivers
69.1 KB (70,784 bytes)
Sunday, May 23, 2004, 2:23:10 PM
Friday, May 31, 2002, 4:39:56 PM

Also Sndmon.exe is no longer present anywhere on my PC.

A few things I should note is that even when I run a LU now, it does not present me with any new downloads or updates. I can only assume this is because there is a catalog/file somewhere on my PC that tracked what LU I got and knows that I have already downloaded and installed it once (even though I backed out of the changes with an XP restore).

So far so good and my CPU is back to where it should be. Howver, I have yet to do any surfing other than here so I guess I'll have to go try it out some more.
--
The war is over??

reply to Randy Bell

First Clip from Search on Sym*.*

Second Clip from Search on Sym*.*

reply to jvmorris

said by jvmorris:

---

You might also want to start monitoring the thread at »computercops.biz/postx41991-0-0.html ,
especially the recent postings by Troy_McClure.

You guys show different results on SYMFW.SYS and I'm not sure why (but that may be about to change, based on his last post).

---

reply to Randy Bell
Randy,

Before I did the XP restore, I also noticed that there was a service that is now no longer showing up. It started with "S*" and was named something like "Symantec Network ...." or something thereabouts.

Now if I understand you correctly, you are saying that your son installed this update on his PC and it is working fine? If so can you check to see if there is a service similar to the one I described above? On my system it was set to "manual" startup. This could be related to the Sndmon.exe which is now no longer on my PC but I though it might be worth checking out.

Thanks!
--
The war is over??

Quick note on your query to Randy.

First, Randy's son is only running NAV 2002, as I recall. Based on what I've seen, NAV 2002 was never adversely affected by the 12 May LiveUpdate or anything that happened subsequently. So Randy's information is primarily just that -- informational, with a possible eye towards finding any obvious discrepancies.

Second, I believe Randy's son must be using a Win 9X/ME box, since I see *.vxd files in his listings. (Maybe it's subsequently been upgraded?) However, on a Win XP box, these would almost invariably be *.sys files and they would not necessarily have the same file sizes, dates, etc.

Just wanted to avoid any wild goose chases here. I insist that only I shall be allowed to conduct wild goose chases!
--
Regards, Joseph V. Morris

Thanks jvmorris. Based on this I guess Randy is the wrong person to ask.... Perhaps some else might be able to very this though.
--
The war is over??

I'm pretty sure that the service you saw running was Symantec Network Device (or Driver) Monitor, which just happens to be sndmon.exe. That's been noted before (possibly by Randy, but I know I have a private e-mail that noted this and associates that service with sndmon.exe).

I've just summarized all your work of yesterday in the forum over at Wilders (by specific references here) -- see »www.wilderssecurity.com/showthre···=1&pp=25 -- and asked those guys to see if they've got the same files you have (err, had) and, if not to let us (and everyone else) know. So, hang in there, 'welp is on the hay'

And what I wouldn't give for a decent version control system in LiveUpdate or at least something that provided legible information about just what was being changed, added, or deleted. Actually, once upon a time, they had a feature like that -- it was called Live Advisor, but that got dropped several years ago.
--
Regards,
Joseph V. Morris

reply to sonofjay

said by sonofjay:

---

Before I did the XP restore, I also noticed that there was a service that is now no longer showing up. It started with "S*" and was named something like "Symantec Network ...." or something thereabouts.

---

said by sonofjay:

---

Now if I understand you correctly, you are saying that your son installed this update on his PC and it is working fine? If so can you check to see if there is a service similar to the one I described above? On my system it was set to "manual" startup. This could be related to the Sndmon.exe which is now no longer on my PC but I though it might be worth checking out.

---

reply to sonofjay
Down near the end of »Stick with ZA or switch to Norton? , theskulptor has just returned and says he found a new LiveUpdate for the Symantec Redirector that solved his problem. He's been offline since 23 May and you indicated that you had been unable to find a LiveUpdate on 25 May. Maybe you should take a look and see if there's something new up there?
--
Regards, Joseph V. Morris

said by jvmorris:

---

.. theskulptor has just returned and says he found a new LiveUpdate for the Symantec Redirector that solved his problem .. Maybe you should take a look and see if there's something new up there?

---

Yeah, Randy, we got that one. Indeed, sonofjay obviously has it installed, but was still having problems until he did a System Restore. As a matter of fact, he checked on 25 May and didn't find anything new.

On the other hand, theskulptor also checked for the LiveUpdate on 23 May and that didn't apparently do him any good (let's wait until he can get home and get the details, however). Apparently, what he found showed up sometime between his post on 23 May and his post today (26 May). Actually, I just got an IM and he said he found it last night (late 25 May).

Also, it's beginning to look like there's something else going on here, because some people have slightly different file version/build information. I am beginning to wonder if some people haven't gotten fouled up because of the Akamai problems (which is where many people actually obtain their Liveupdates from). And then there's the possibility that these differences are simply country/language differences. It really would help if we could get some definitive information on what constitutes the latest updates for this issue. The last thing I saw was antdude's comment that the late 22 May LiveUpdate was expressly designed to address the complication that at least some NIS/NPF 2002 users were experiencing -- and some of them are now seeing additional LiveUpdates available -- but they're very skittish (at this date) to download them without some further authoritative information.
--
Regards, Joseph V. Morris