What are these Isass processes?

[Gerry]

Terry

You have SP2 installed. Is your Windows XP CD also SP2? If yes select
Start, Run and type "sfc /scannow" without quotes and click on OK. Let's
see if it replaces the sens.dll. Remember you will be prompted for your
Windows XP CD after System Files Checker starts. If your Windows XP CD
is not SP2 we will need to think again.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Terry Pinnell]

Terry

You have SP2 installed. Is your Windows XP CD also SP2? If yes select
Start, Run and type "sfc /scannow" without quotes and click on OK. Let's
see if it replaces the sens.dll. Remember you will be prompted for your
Windows XP CD after System Files Checker starts. If your Windows XP CD
is not SP2 we will need to think again.

Hi Gerry,

Sorry I've taken a couple of days before getting back to you on this.
It's partly because I've been pursuing a side-issue about sfc \scannow
(see post 'Cannot run sfc /scannow fro HD'). But also because I need
to understand whether we're discussing one or possibly several
*separate* problems.

The original query remains my main concern. Namely, why is my PC
persistently suddenly slowing down. Which I *think* (but haven't yet
seen any hard evidence or expert opinion in support) is connected with
all these Lsass.exe processes I described.

Do you think that is connected with the fact that System Event
Notification is not in my Services list? Even if it's not, I still
want to isolate *that* too!

Another thing I've been doing is to check whether the Services list
changes when I'm in 'slow mode'. It doesn't.

For reference, here's the current status of my Services list. This is
after running sfc \scannow
http://i154.photobucket.com/albums/s247/terrypin999/Services-DirectlyAfterScanNowReboot.jpg

 

[Terry Pinnell]

Hi Gerry,

Sorry I've taken a couple of days before getting back to you on this.
It's partly because I've been pursuing a side-issue about sfc \scannow
(see post 'Cannot run sfc /scannow fro HD'). But also because I need
to understand whether we're discussing one or possibly several
*separate* problems.

The original query remains my main concern. Namely, why is my PC
persistently suddenly slowing down. Which I *think* (but haven't yet
seen any hard evidence or expert opinion in support) is connected with
all these Lsass.exe processes I described.

Do you think that is connected with the fact that System Event
Notification is not in my Services list? Even if it's not, I still
want to isolate *that* too!

Another thing I've been doing is to check whether the Services list
changes when I'm in 'slow mode'. It doesn't.

For reference, here's the current status of my Services list. This is
after running sfc \scannow
http://i154.photobucket.com/albums/s247/terrypin999/Services-DirectlyAfterScanNowReboot.jpg

Gerry,

Re my Event Viewer error message #4356 that always appears (with
#4353) after reboot, I also found this potentially relevant note:

"Adrian Grigorof (Last update 4/30/2009):
The 41E90F3E-56C1-4633-81C3-6E8BAC8BDD70 part of the GUID mentioned in
the event is the COM EventSystem itself (COMSVCS.DLL) it is not that
useful in narrowing down the problem. The second GUID, if exists, may
point to the application causing this.

Various GUIDs encountered for this event:
- 6295DF2D-35EE-11d1-8707-00C04FD93327 = Mobsync

- D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E = SENS Subscriber for
EventSystem EventObjectChange events. A support forum thread indicated
that an instance of this problem was fixed by uninstalling and
reinstalling MS Office and .NET Framework.

- 42EB8D03-5548-4667-A2A4-73395F61 BDC8 = Microsoft Message Queuing -
See M331697

- 58FC39EB-9DBD-4EA7-B7­B4-9404CC6ACFAB = Dr. Watson (debugger)

There may be different error codes reported in the event description
as well. These codes, like the GUIDs may help identifying the problem:
- Error code 8000401A - This may be recorded when the computer is
started by there is no connection to the domain controller (for
example when starting a laptop at home). See also the suggestions for
event id 4100.
- Error code 80070424 - A service is not installed properly.
- Error code 80070422 - Service disabled."

To remind you, my details are:

Event Type: Warning
Event Source: EventSystem
Event Category: (52)
Event ID: 4356
Date: 07/05/2009
Time: 11:22:19
User: N/A
Computer: TERRY-INTEL
Description:
The COM+ Event System failed to create an instance of the subscriber
partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}.
CoGetObject returned HRESULT 80070424.

There are two 'hits':
1) "MS Office and .NET Framework"
2) "A service is not installed properly."

As for the first, I'm reluctant to re-install Office 2000 Pro unless
I'm sure, and I have various versions of .NET Framework installed so
wouldn't know which to re-install. And the second might be referring
to any service I suppose!

 

[Gerry]

Terry

With this and your later post we have still a number of potential leads
to explore.

Did you get System File Checker to complete? Did it make any difference?

Your query concerning what you consider to be an excessive number of I/O
Reads associated with the lsass process is difficult to answer. It does
seem high compared to my own computer but trying to pin down why this
might be is not easy to determine. Whether it is linked to slow
performance I cannot judge. It is indicating disk activity. You can use
Process Monitor to examine activity involving any process but you get so
much information it is impossible to see which is normally activity and
which represents a problem. With the lsass process the problem is
exacerbated because numbers get so large. I suspect approaching your
slow performance from this direction is impractical.
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
http://technet.microsoft.com/en-us/library/cc958260.aspx

My approach to troubleshooting includes eliminating known errors
appearing in Event Viewer. The one persistent error reported on your
machine is that the
System Event Notification service is not functioning and we know it
should be. We shall only know whether it is the cause of slow
performance when the error is eliminated. However, there may be more
than one factor contributimg to slow performance and I have some further
thoughts which I will make later on this possibility.

I have had a good look at the Services list. I think there is still
mileage in looking at your settings.

Security Accounts Manager. I still think this should be set to Automatic
not Manual. What firewall are you using? What are your Windows Update
settings?

Select Start, Control Panel, Administrative Tools, Services and right
click on TCP/IP NetBIOS Helper Service and select Properties. The
StartUp type should be Automatic.

I still have reservations as to why some other services have not started
but will leave them for now.

The list of services was very helpful but could you post a copy that
includes the StartUp type?


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerry]

Terry

The note about Event ID: 4356 was one I read when you first posted the
Error Report. A second look brought out some points I had not picked up
on earlier.

The second GUID is D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E, which is the
System Events Notification (SENS) service. Error code 80070424 - A
service is not installed properly. This is of course exactly what we
have been trying to determine.

A support forum thread indicated that an instance of this problem was
fixed by uninstalling and reinstalling MS Office and .NET Framework. A
Google search does not reveal the source of this comment. Without any
supporting references I would be reluctant to encourage reinstalling.
How long has Event ID: 4356 been occuring? When did you install the
operating system and when did the error first occur? If Office 2000 and
all updates were installed before the error started that would seemingly
rule out a fauly Office 2000 installation. It is a long time since I
have seen an Office 2000 update here. Net Framework relies on each
"version" being available. It is not updated as is usual with most
software. Don't forget you have a history of installed updates if you
select Windows Update so you can compare to the date when the Error
started.

Select Start, Run, type "msconfig" without quotes and click on OK.
Select the Services tab. Does the System Events Notification (SENS)
service apear in the list of Services? Is the box before checked?

Do you have flashget.exe on your computer? If yes what version?

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Terry Pinnell]

Terry

I am not sure what the ipconfig result means. It gives the same address
as appear in the DHCP Event Viewer Report.

How many computers are connected to your router? Are you using an
Ethernet Hub or an Ethernet Switch?

Just this one now. (As mentioned, I finally despatched the other to my
shed/workshop, some 15 months after installing this new PC!)

I am using AVG 8.5 Free. I do not think AVG is causing your problem.

Agreed! As you saw, it made no difference here. (But having
uninstalled it I'm now trying the alternative Avira Antivir.)

The SENS service on your computer is not right. The Registry entries are
wrong but I have not yet figured out how to correct them. Event ID 4356
is occuring because the the service is not starting. The Registry
entries telling the computer to load SENS when booting are damaged but I
have not yet figured out how to correct them.

OK Gerry, all understood and agreed.

My feeling that your slow
performance is related to network and security issues and SENS is part
of the problem.

This is the issue I'm not yet sure about, although I have no
conclusive evidence either way. I was hoping the System Restores I did
(going way back to 10th February at the earliest) would provide some
evidence. But that too is inconclusive because the earliest date in
Event Viewer is 28th Feb. So I don't know whether 4356 and 4343
appeared after the PC boot on 10th Feb (when the slow mode still
occurred). I'm reluctant to do any more SRs, as it was excruciatingly
slow. (BTW, has SR always been like that, i.e. always restoring
\Program Files to the state at the time?)

---------

One aspect that is a bit unsatisfactory is exactly how I'm *measuring*
'performance', to decide whether I am in 'slow' or 'fast' mode. This
has in practice been a mixture of factors, including the subjective
'feel' when things slow down a bit. And that had seemed to me to be
associated with all that Lsass.exe activity of the SECURITY/Policy
type (whatever that is!). But the most important factor, because it
seems to me to be objective and easily applied, is the time it takes
to run my macro. Under 1 second = fast mode, 6 secs = slow mode. To
remind you, the macro (which was written in a program called Macro
Express) is applied to any folder in List view, and changes it to
Detail view, altering column sizes if necessary so that they can be
seen properly and retaining its screen location. It takes a while
because the method I use to identify and drag column separators is
'pixel colour identification, involving moving the mouse cursor
progressively across the folder. Here's a rough movie clip of the slow
version (untrimmed, so it's a tad longer than the macro):
http://s154.photobucket.com/albums/s247/terrypin999/?action=view&current=MacroTest.flv

However ... a minute ago I just tried ProcMon again and it was
displaying a *different* mix, not dominated by Lsass. Yet when I then
immediately ran my macro on an arbitrary folder, it was *still* slow.
So bang goes that working hypothesis!

I'd also thought that slow mode was associated with disk activity.
Because at times, when I wasn't actively doing anything much in any
application, my HD would be running for ages. And I'm pretty sure it
was neither Diskeeper doing its automatic 'smart schedule'
defragmenting, nor SecondCopy doing backups (which sometimes happens
if it didn't do them overnight). However ... that theory also bites
the dust. Because I've just found another neat SysInternals utility,
Disk Monitor, and set it so that it's a tray icon: red for writing,
green for reading, grey for no activity. And as I compose this it's
been grey - yet my macro test still reports 'slow'.

Some of your screenshots have helped. I cannot, however, get much from
those showing I/O bytes etc.

Not surprised, they are a bit heavy on detail!


I'm sure this will turn out to be something obvious - once we find it!

 

[Terry Pinnell]

I'd also thought that slow mode was associated with disk activity.
Because at times, when I wasn't actively doing anything much in any
application, my HD would be running for ages. And I'm pretty sure it
was neither Diskeeper doing its automatic 'smart schedule'
defragmenting, nor SecondCopy doing backups (which sometimes happens
if it didn't do them overnight). However ... that theory also bites
the dust. Because I've just found another neat SysInternals utility,
Disk Monitor, and set it so that it's a tray icon: red for writing,
green for reading, grey for no activity. And as I compose this it's
been grey - yet my macro test still reports 'slow'.

Gerry,

Please ignore that last point. There seems to be either a bug in
DiskMon or I'm not using it correctly. I got suspicious at seeing only
a grey icon for so long. Turned out have stopped working ;-(
I restarted DiskMon and icon is working again, but I haven't found the
cause of the failure.

So until I discover evidence to the contrary I'm returning to my
tentative assumption that my PC slowness may be associated with HD
activity.

 

[Gerry]

Terry

Your SENS service problem goes back long before February 2009.
http://www.pcreview.co.uk/forums/thread-3655278.php

What is the router make and model?

What version of Macro Express are you using?

What is the CPU and how much RAM does the computer have? Right click on
the My Computer icon on ther Desktop and select Properties to get this
information.

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

http://bertk.mvps.org/html/description.html
http://bertk.mvps.org/html/filesfolders.html

You could send me a HijackThis report by email
([email protected]) if you feel it might help.
HijackThis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Terry Pinnell]

Meanwhile, before I do any scans, here are the pastes you requested
from the Info & Health tabs respectively. One initial query that's not
directly related to my post is why my two HDs are not running under
UDMA Mode 7. Whatever that is, I assume it's faster?

Any thoughts on that UDMA Mode point please Gerry?

 

[Gerry]

Terry

Supported mode : UDMA Mode 7 (Ultra ATA/512)
Current mode : UDMA Mode 6 (Ultra ATA/133)

As far as I am aware it is quite common not to achieve the supported
mode. None of my drives do.

Here are two examples.

SATA 2
Supported mode : UDMA Mode 6 (Ultra ATA/133)
Current mode : UDMA Mode 5 (Ultra ATA/100)


SATA 1
Supported mode : UDMA Mode 6 (Ultra ATA/133)
Current mode : UDMA Mode 5 (Ultra ATA/100)

http://en.wikipedia.org/wiki/AT_Attachment
http://www.wisegeek.com/what-is-ultra-ata.htm

I am not sure what causes the difference. The motherboard / BIOS will
cause limitations as will the drive and cabling.

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Terry Pinnell]

Terry

Your SENS service problem goes back long before February 2009.
http://www.pcreview.co.uk/forums/thread-3655278.php

What is the router make and model?

What version of Macro Express are you using?

What is the CPU and how much RAM does the computer have? Right click on
the My Computer icon on ther Desktop and select Properties to get this
information.

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

http://bertk.mvps.org/html/description.html
http://bertk.mvps.org/html/filesfolders.html

You could send me a HijackThis report by email
([email protected]) if you feel it might help.
HijackThis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Gerry,

Very good news on SENS! I asked last night over in the SysInternals
forum and its moderator 'molotov' this afternoon suggested a registry
import, which happily worked fine. Here's a paste of it for your
records.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS]
"DependOnService"=hex(7):45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,\
65,00,6d,00,00,00,00,00
"Description"="Tracks system events such as Windows logon, network,
and power events. Notifies COM+ Event System subscribers of these
events."
"DisplayName"="System Event Notification"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Group"="Network"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,65,00,6e,00,73,00,2e,00,64,00,6c,00,6c,00,00,00

And on re-booting I no longer get that cluster of 4356 & 4353 event
errors. So hopefully that's one complex issue out of the way. Of
course, as we still don't know what *caused* its loss, it could
reoccur ... but I'm going to be optimistic on that front ;-)

Unfortunately however it hasn't fixed the 'performance' problem that
prompted this thread. Strictly I should now call that 'my macro
performance' problem. Because as explained in my earlier post, I still
can't be sure this is a widespread performance drop. Any suggestions
on a more global benchmark? Ideally one we could both reproduce
easily. BTW, after the SENS registry update I rebooted and the macro
then ran at full speed. But after a subsequent reboot it's now back to
slow again ;-(

-------------

From My Computer > Properties:

Computer:
Intel(R) Core(TM)2 Quad CPU
Q9450 @ 2.66GHz
2.67 GHz, 3.25 GB of RAM
Physical Address Extension

(I have 4 GB installed; gather this is limited because I chose XP not
Vista.)

Router is Prestige 600 Series ('ZyXEL' on front), connected by cable
to my PC. My son installed it for me a few years ago when I got
broadband on my old PC. As mentioned, it used to have another cable
connection to my old PC, removed recently.

I'm using Macro Express 4.0.3.1 (the latest release, out for a few
days). Why, do you have it too? That would be excellent... I also have
version 3 still installed.

Commit Charge (K)
Total 580032
Limit 7418276
Peak 583636

Let me know if you still think a HijackThis report would help.

 

[Gerry]

Terry

That's good news on SENS. I had thought of suggesting an edit of the
Registry but my understanding of the mechanics is limited. Also I was
not sure where to get the import from. Can you post a link to the thread
where you got the advice from Molotov. Can you also post a pic of your
current list of services.

You did not give the RAM figure?

A HijackThis report could be helpful. Perhaps two -one when in slow mode
and one in fast mode?

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Terry

Your SENS service problem goes back long before February 2009.
http://www.pcreview.co.uk/forums/thread-3655278.php

What is the router make and model?

What version of Macro Express are you using?

What is the CPU and how much RAM does the computer have? Right click
on the My Computer icon on ther Desktop and select Properties to get
this information.

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

http://bertk.mvps.org/html/description.html
http://bertk.mvps.org/html/filesfolders.html

You could send me a HijackThis report by email
([email protected]) if you feel it might help.
HijackThis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Gerry,

Very good news on SENS! I asked last night over in the SysInternals
forum and its moderator 'molotov' this afternoon suggested a registry
import, which happily worked fine. Here's a paste of it for your
records.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS]
"DependOnService"=hex(7):45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,\
65,00,6d,00,00,00,00,00
"Description"="Tracks system events such as Windows logon, network,
and power events. Notifies COM+ Event System subscribers of these
events."
"DisplayName"="System Event Notification"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Group"="Network"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,65,00,6e,00,73,00,2e,00,64,00,6c,00,6c,00,00,00

And on re-booting I no longer get that cluster of 4356 & 4353 event
errors. So hopefully that's one complex issue out of the way. Of
course, as we still don't know what *caused* its loss, it could
reoccur ... but I'm going to be optimistic on that front ;-)

Unfortunately however it hasn't fixed the 'performance' problem that
prompted this thread. Strictly I should now call that 'my macro
performance' problem. Because as explained in my earlier post, I still
can't be sure this is a widespread performance drop. Any suggestions
on a more global benchmark? Ideally one we could both reproduce
easily. BTW, after the SENS registry update I rebooted and the macro
then ran at full speed. But after a subsequent reboot it's now back to
slow again ;-(

-------------

From My Computer > Properties:

Computer:
Intel(R) Core(TM)2 Quad CPU
Q9450 @ 2.66GHz
2.67 GHz, 3.25 GB of RAM
Physical Address Extension

(I have 4 GB installed; gather this is limited because I chose XP not
Vista.)

Router is Prestige 600 Series ('ZyXEL' on front), connected by cable
to my PC. My son installed it for me a few years ago when I got
broadband on my old PC. As mentioned, it used to have another cable
connection to my old PC, removed recently.

I'm using Macro Express 4.0.3.1 (the latest release, out for a few
days). Why, do you have it too? That would be excellent... I also have
version 3 still installed.

Commit Charge (K)
Total 580032
Limit 7418276
Peak 583636

Let me know if you still think a HijackThis report would help.

---------

Another suggestion I had from molotov was to try my macro test in
another User Account. I had to create one and have now done that. The
macro still ran in its 6-second 'slow mode'.

 

[Terry Pinnell]

Terry

That's good news on SENS. I had thought of suggesting an edit of the
Registry but my understanding of the mechanics is limited. Also I was
not sure where to get the import from. Can you post a link to the thread
where you got the advice from Molotov. Can you also post a pic of your
current list of services.

You did not give the RAM figure?

A HijackThis report could be helpful. Perhaps two -one when in slow mode
and one in fast mode?

OK Gerry, I'll get on the Hijack case tomorrow. I expect I'll have to
swot up on it a bit first ;-)

Your eyes must be as tired as mine! Quote from my last post:

"Computer:
Intel(R) Core(TM)2 Quad CPU
Q9450 @ 2.66GHz
2.67 GHz, 3.25 GB of RAM <----
Physical Address Extension

(I have 4 GB installed; gather this is limited because I chose XP not
Vista.)"

 

[Gerry]

Sorry Terry I missed that.

What is the computer make and model? Was the computer one of those built
with Vista in mind? If yes did you encounter any problems getting XP
drivers for


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Terry Pinnell]

Sorry Terry I missed that.

What is the computer make and model? Was the computer one of those built
with Vista in mind? If yes did you encounter any problems getting XP
drivers for

Gerry,

It's a MESH 'GTS XTREME'. XP was an option instead of Vista. Don't
have any info about drivers.

 

[Terry Pinnell]

Can you post a link to the thread where you got the advice from Molotov.

Gerry, Forgot this in my reply last night
http://forum.sysinternals.com/forum_posts.asp?TID=18939

Can you also post a pic of your current list of services.

http://i154.photobucket.com/albums/s247/terrypin999/Services13May09-SlowMode.jpg

I'm in slow mode at present - which is unhappily the 'norm'. It seems
to take a reboot to stand a chance of getting fast mode (and then
that's typically lasted only briefly), although sometimes it has
switched suddenly. So far all totally unpredictable. So while I've
labelled the list 'SLOW' I still don't think the Services change when
I'm in fast mode. If I ever succeed in catching it quickly enough
again before it reverts to slow, I'll take another comparative
screenshot.

See also my last post in that SysInternals thread. I'll let you know
of my progress on that new macro test.

I'll postpone work on the Hijack front for a while. But I will run
Spybot, Adaware and my new AV program Antivir during today.

 

[Terry Pinnell]

... So while I've
labelled the list 'SLOW' I still don't think the Services change when
I'm in fast mode. If I ever succeed in catching it quickly enough
again before it reverts to slow, I'll take another comparative
screenshot.

Graham,

Macro test switched to fast mode. Here's the promised Services List.
http://i154.photobucket.com/albums/s247/terrypin999/Services13May09-FastMode.jpg

At first glance they seem identical. (On reflection I shouldn't have
manually adjusted the columns, so I could then have just compared
their respective byte sizes.)

 

[Terry Pinnell]

Graham,

Macro test switched to fast mode. Here's the promised Services List.
http://i154.photobucket.com/albums/s247/terrypin999/Services13May09-FastMode.jpg

At first glance they seem identical. (On reflection I shouldn't have
manually adjusted the columns, so I could then have just compared
their respective byte sizes.)

Graham,

OK, I've now run the other two AV programs.

Like Spybot, Ad-Aware also found no threats, but interestingly Antivir
(my replacement for AVG 8.5 free) claims to have found 6, during a
scan of my two 750 GB drives.

Only one was on my main HD, the other 5 all in the Program Files I
copied across from my 4 year old PC about 16 months ago. FWIW I've
listed them below. I haven't had time to do thorough research but I
suspect at least RockXP might be a false positive? I allowed all 6 to
be quarantined.

The file 'C:\System Volume
Information\_restore{6A899347-92D4-4F8C-8F42-2A660740BF9B}\RP440\A0193706.exe'
contained a virus or unwanted program 'DR/PSW.RAS.A.6' [dropper]

The file 'I:\Athlon Program Files\Moyea\FLV
Downloader\FLVFilePlayer.exe'
contained a virus or unwanted program 'ADSPY/Admoke.agg.2' [adware]

The file 'I:\Athlon Program Files\MiscTools\RockXP3.exe'
contained a virus or unwanted program 'DR/PSW.RAS.A.6' [dropper]

The file 'I:\Athlon Program Files\Multimedia
Builder497\Player\ecard.bin'
contained a virus or unwanted program 'TR/Killwin.IG' [trojan]

The file 'I:\Athlon Program Files\Oxford\OED\OEDMACR8.DOC'
contained a virus or unwanted program 'W97M/MVBA.D' [virus]

The file 'I:\Athlon Program Files\NewsRover\Projects\117\Files\winrar
320 and keygen.rar'
contained a virus or unwanted program 'TR/Small.24064.C' [trojan]

Anything of interest to you there?

BTW, what does this say about Spybot & Ad-Aware?

 

[Gerry]

Terry

Macro Express has a history of memory leaks. From what there is in
Google the problems are supposed to be fixed in the version you have but
this link may suggest the contrary.
http://pgmacros.invisionzone.com/index.php?showtopic=3860

Somewhere you commented that to revert to fast mode you needed to
reboot. This is a symptom of a memory leak but with so much RAM I am
surprised to see a noceable slowdown. Most computers, even those with
plenty of RAM, make use of the page file. It would be interested what
the pagefile usage is before and after starting Macro Express. You could
monitor pagefile usage with this utility.

Use page file monitor to observe what is the peak usage. Start it to run
immediately after start-up and look at the log. Pagefilemon takes
snapshots. You need to run it at the beginning of the session at then
run it again at intervals throughout the sessions. The log is Pagefile
log.txt. If you right click on the file in Windows Explorer and select
Send to, Desktop (Create Shortcut). The same applies
toXP_PageFileMon.exe.

A small utility to monitor pagefile usage:
http://www.dougknox.com/xp/utils/xp_pagefilemon.htm

Note that programs using undo features, particularly those associated
with graphics and photo editing, require large amounts of memory so if
you use this type of programme check these first observing how the page
usage increases when they start and whether the usage decreases when you
close the programme.

You can get clues as to what is generating peak memory demands but this
is not a precise science, more a matter of judgement.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Terry Pinnell]

Terry

Macro Express has a history of memory leaks. From what there is in
Google the problems are supposed to be fixed in the version you have but
this link may suggest the contrary.
http://pgmacros.invisionzone.com/index.php?showtopic=3860

Somewhere you commented that to revert to fast mode you needed to
reboot. This is a symptom of a memory leak but with so much RAM I am
surprised to see a noceable slowdown. Most computers, even those with
plenty of RAM, make use of the page file. It would be interested what
the pagefile usage is before and after starting Macro Express. You could
monitor pagefile usage with this utility.

Use page file monitor to observe what is the peak usage. Start it to run
immediately after start-up and look at the log. Pagefilemon takes
snapshots. You need to run it at the beginning of the session at then
run it again at intervals throughout the sessions. The log is Pagefile
log.txt. If you right click on the file in Windows Explorer and select
Send to, Desktop (Create Shortcut). The same applies
toXP_PageFileMon.exe.

A small utility to monitor pagefile usage:
http://www.dougknox.com/xp/utils/xp_pagefilemon.htm

Note that programs using undo features, particularly those associated
with graphics and photo editing, require large amounts of memory so if
you use this type of programme check these first observing how the page
usage increases when they start and whether the usage decreases when you
close the programme.

You can get clues as to what is generating peak memory demands but this
is not a precise science, more a matter of judgement.

OK, thanks Gerry, I'll try that. But, as you may have seen from my
post in the SysInternals thread, I'm cautiously optimistic!

I assume you saw my AV reports etc? I'll forget about Hijack for time
being at least.