Balloon messages are appearing from the system tray claiming that the computer is infected with the “XP Security Center” virus. The message instructs me to click on the balloon to fix the problem. A web page appeared recommending that I buy the cure. On inspection of the payment form I saw that payment was in roubles, the company was Russian, and there were spelling mistakes in the instructions. Needless to say, I backed off instantly and did not purchase the item. The constant balloon message interruptions continued, so I purchased Spyware Doctor in an attempt to fix the problem. This cleaned up my system and removed the malware, including the Trojan Spy.Zbot. However, the system slowed almost to a halt, such that it was virtually unusable. I discovered this slowness was only when the so-called Spyware Doctor “intelliguard protection” was running. Upon disabling this feature the system immediately returned to normal speed. Is there any way to avoid this slowdown? The computer is also running McAfee VirusScan.

You have discovered a problem with many antivirus and antispyware packages, where the real-time scanner slows down computer performance significantly. The reason this occurs is because the real-time scanners, such as intelliguard protection, scan every file on-demand when they are accessed. This means whenever you open a program on your computer that program, and all files associated with that program, are scanned. Since they need to go through this additional step before being allowed to open there is a bottleneck in the opening process. Additionally, McAfee VirusScan also has a real-time scanner. As such, when you open a program or files on the computer they are having to pass through two real-time scanners upon opening, thus significantly affecting computer performance. McAfee is quite a well-known and time tested program and has a relatively refined real-time scanner, which is probably why you have not noticed a performance hit when just using the McAfee VirusScan and having files pass through that real-time scanner. However, now that you are using a second utility which also has a real-time scanner the performance bottlenecks are becoming evident.

My first suggestion is to ensure that you are running the latest versions of both McAfee VirusScan and Spyware Doctor. The reasoning behind this suggestion is that certain efficiency improvements may have been made in newer versions of the software which may help computer performance. Both McAfee and Spyware Doctor should automatically check for updates, but you may wish to check the websites for both products since automatic updates generally only check for updates within the same version tree as you have installed (for example, if you are running McAfee VirusScan 2008 it will only provide updates for this version, rather than alert you that McAfee VirusScan 2009 is available – the same may also be applicable for the way the Spyware Doctor upgrades operate). Be aware, if you need to upgrade to the latest version of the security software it may be a paid upgrade so the risk is even though you may pay money to update to the latest version this may not actually fix the problem. That said, it may be worthwhile to keep both your products up-to-date and also as a step towards troubleshooting the problems.

Assuming that your products are up-to-date but the problem continues there is not that much which can be done to resolve the issue. In this situation my recommendation would be to leave the Spyware Doctor intelliguard protection disabled and conduct regular scans using the utility. Most threats should be detected by your McAfee VirusScan real-time scanner, as looking at the feature list for VirusScan Plus 2009 this includes spyware protection. However, having a dedicated antispyware utility is good practice so I would still recommend that you keep Spyware Doctor. A good approach in this situation would be to schedule Spyware Doctor to run at a specific time each week. For example, if you know that you are not using the computer at 9:00pm each Thursday then schedule Spyware Doctor to automatically run at this time each week (just make sure you leave the computer on so the scheduled task can run). From my research on the internet you should be able to configure scheduled tasks from within Spyware Doctor itself, although you may need to consult the user guide for the exact steps to undertake for this procedure (since I do not use this particular piece of software and cannot provide exact guidance).

However, one concern regarding the previous spyware infections on your computer is the possibility that remnants of those infections still exist. As a general rule of thumb, once your computer has been infected with a serious piece of malware, such as those which cause balloon pop-ups in the Windows system tray, then even though you have removed the threat from the computer you can never fully trust that computer again, since there could be components of the infection remaining on the computer. In such situations where I deal with infections I generally do not attempt to repair the infection but instead backup all important data and then do a reformat and reinstallation of Windows. This is definitely a long-winded and inconvenient process, as you need to backup all data you wish to keep, reinstall Windows, and then copy that data back onto the new installation of Windows. However, this is the only way to guarantee that your computer is free of infection. Additionally, once Windows reinstalls I immediately install antivirus software and also run Windows Update to install all required updates to the operating system.

At this point you may be questioning the point of antivirus and antispyware software, since should your computer become infected then you will just reinstall Windows rather than attempt to clean the infection. I treat antivirus and antispyware applications as preventative measures. Should I receive an email with a virus infected attachment then my antivirus scanner detects the threat and prevents me from opening that attachment (or at least provides me with a rather obvious warning that the attachment is virus infected). Therefore, I can completely prevent the infection. However, should something slip past the guard and infect the computer, at that point I will consider a reinstallation of Windows.