July 13 auto updates

After the updates applied yesterday, I get the system32 folder at boot-up and
the computer runs about 80% slower. I ran SpySweeper, Symantec Virus, Spy
Bot, and Ad-Aware with no search problems found. I did a system restore to
Wednesday (07/12/2006) which caused problems with Symantec's Virus program
which I had to delete and reload, apparently it stops functioning if you
restore and the problem went away (no system32 folder at boot-up). Upon the
auto updates downloading and applied, when re-booted, the folder reappears..
I have followed all the suggestions in Microsoft's Q170086 and there is
nothing similar to what they say to look for in regedit except this under:
HKEY_LOCALMACHINE\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run:
NAME: ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
and:
NAME: SpySweeper = "C:\Program Files\Webroot\Spy
Sweeper\SpySweeperUI.exe"/startintray
Also here is a hijack this file log:
Logfile of HijackThis v1.99.1
Scan saved at 8:01:35 AM, on 7/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec AntiVirus\vpc32.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\Dell Wayne Gailey\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.comcast.net/home.html
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
- C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy
Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] -quiet
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program
Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program
Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program
Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program
Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
- C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/microsof...?1144961298205
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1144961267596
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec
Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec
AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program
Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) -
Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Any suggestions or help would be appreciated.

almost the same thing happens to me, only wheni was down loading the updates,
Spy Sweeper just popped up out of nowhere. i tried closing it by right
cliking the taskbar (the window won't show), going through the taskbar and
ending it, and finally just ending its process. All of which failed. i opened
up Norton, and it would take a while (2GB RAM, that shouldn't happen) and
when i tried to reboot my system from the start menu, it didn't work either.
i had to hold the power button on the CPU (YIKES!!) and restart it manually.
well i wake up this morning, and sure enough the update finished and spy
sweeper was open again. i try opening the Add/Remove programs, with no
success until after i rebooted. then i just removed both of the updates that
were installed yesterday. but i'll still need a fix if it happens again

"Wando" wrote:

> After the updates applied yesterday, I get the system32 folder at boot-up and
> the computer runs about 80% slower. I ran SpySweeper, Symantec Virus, Spy
> Bot, and Ad-Aware with no search problems found. I did a system restore to
> Wednesday (07/12/2006) which caused problems with Symantec's Virus program
> which I had to delete and reload, apparently it stops functioning if you
> restore and the problem went away (no system32 folder at boot-up). Upon the
> auto updates downloading and applied, when re-booted, the folder reappears..
> I have followed all the suggestions in Microsoft's Q170086 and there is
> nothing similar to what they say to look for in regedit except this under:
> HKEY_LOCALMACHINE\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run:
> NAME: ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
> and:
> NAME: SpySweeper = "C:\Program Files\Webroot\Spy
> Sweeper\SpySweeperUI.exe"/startintray
> Also here is a hijack this file log:
> Logfile of HijackThis v1.99.1
> Scan saved at 8:01:35 AM, on 7/14/2006
> Platform: Windows XP SP2 (WinNT 5.01.2600)
> MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
>
> Running processes:
> C:\WINDOWS\System32\smss.exe
> C:\WINDOWS\system32\winlogon.exe
> C:\WINDOWS\system32\services.exe
> C:\WINDOWS\system32\lsass.exe
> C:\WINDOWS\system32\svchost.exe
> C:\WINDOWS\System32\svchost.exe
> C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> C:\WINDOWS\system32\spoolsv.exe
> C:\Program Files\Symantec AntiVirus\DefWatch.exe
> C:\WINDOWS\Explorer.EXE
> C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
> C:\Program Files\Symantec AntiVirus\SavRoam.exe
> C:\WINDOWS\System32\svchost.exe
> C:\Program Files\Symantec AntiVirus\Rtvscan.exe
> C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
> C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
> C:\Program Files\Common Files\Symantec Shared\ccApp.exe
> C:\PROGRA~1\SYMANT~1\VPTray.exe
> C:\WINDOWS\system32\ctfmon.exe
> C:\Program Files\Symantec AntiVirus\vpc32.exe
> C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
> C:\Documents and Settings\Dell Wayne Gailey\Desktop\HijackThis.exe
>
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.comcast.net/home.html
> O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
> C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
> Files\Spybot - Search & Destroy\SDHelper.dll
> O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
> - C:\Program Files\Yahoo!\Common\yiesrvc.dll
> O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
> O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy
> Sweeper\SpySweeperUI.exe" /startintray
> O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
> Shared\ccApp.exe"
> O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
> O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
> O4 - HKCU\..\Run: [Yahoo! Pager] -quiet
> O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program
> Files\Yahoo!\Common/ycsrch.htm
> O8 - Extra context menu item: E&xport to Microsoft Excel -
> res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
> O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program
> Files\Yahoo!\Common/ycdict.htm
> O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program
> Files\Yahoo!\Common/ycmap.htm
> O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program
> Files\Yahoo!\Common/ycsms.htm
> O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
> - C:\Program Files\Yahoo!\Common\yiesrvc.dll
> O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
> C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
> O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
> C:\Program Files\Messenger\msmsgs.exe
> O9 - Extra 'Tools' menuitem: Windows Messenger -
> {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
> O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
> C:\Program Files\Yahoo!\Common\yinsthelper.dll
> O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) -
> https://support.microsoft.com/OAS/ActiveX/odc.cab
> O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
> http://update.microsoft.com/microsof...?1144961298205
> O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
> http://update.microsoft.com/microsof...?1144961267596
> O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
> O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
> O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
> O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
> Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
> O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
> C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec
> Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
> O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec
> AntiVirus\SavRoam.exe
> O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
> Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
> O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
> C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program
> Files\Symantec AntiVirus\Rtvscan.exe
> O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) -
> Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
>
> Any suggestions or help would be appreciated.

omiks3 <> wrote:

> almost the same thing happens to me, only wheni was down loading the
> updates, Spy Sweeper just popped up out of nowhere. i tried closing
> it by right cliking the taskbar (the window won't show), going
> through the taskbar and ending it, and finally just ending its
> process. All of which failed.

You really must disable SpySweeper and Norton before you are try to run
Windows Updates.

--
Robin Walker [MVP Networking]

The problem is Yahoo Messenger version 7.5 with voice. If you have it
disabled to start at boot it writes this :
Path
S-1-5-21-117609710-926492609-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run :[Yahoo Pager]
Type: value
Value: -quiet
Reason for conflict: Useless Key. Specified File Not Found

Iturned Messenger on at boot and the conflict vanishes. I'm hoping for a
fix as I do not wish to have Messenger load at boot.

And as far as disabling Norton and Spysweeper, what the crap good is auto
updating if this is required. Microsoft auto downloads and certainly does
not give one an option to turn anything off before it proceeds.

"Robin Walker [MVP]" wrote:

> omiks3 <> wrote:
>
> > almost the same thing happens to me, only wheni was down loading the
> > updates, Spy Sweeper just popped up out of nowhere. i tried closing
> > it by right cliking the taskbar (the window won't show), going
> > through the taskbar and ending it, and finally just ending its
> > process. All of which failed.
>
> You really must disable SpySweeper and Norton before you are try to run
> Windows Updates.
>
> --
> Robin Walker [MVP Networking]
>
>
>
>

Wando <> wrote:

> updating if this is required. Microsoft auto downloads and certainly
> does not give one an option to turn anything off before it proceeds.

There is precisely the option you need:

- open control panel "Automatic Updates".
- check "Download updates for me, but let me choose when to install them"

--
Robin Walker [MVP Networking]