andylewer

PC Info

Intel Pentium 4, 1GB RAM, 80GB HDD
Windows XP Professional SP3
(All updates applied as of 16th August 2009, including optional updates)
ATI Radeon 9800PRO Graphics Card, Updated Driver as of 16th of August 2009)
Samsung 22" Monitor, running at 1360x768 @ 60hz.





Description of Problem/s:

OK, well ive got some serious problems with my pc atm, it started with Flash player videos (like youtube) playing VERY slowly, so on a good friends (and pc tech) advice i installed SUPERAntiSpyware and Malwarebytes to scan and find the problems etc. After doing this i rectified the Flash player problem, but still get random "page load errors" when browsing the web. Its like something you would get when youre not connected to the net, that type of message.
Anyway im using Google Chrome, and have been for a while. At first i had to install flash for chrome, that was all fine. As soon as i go to use IE i get a flash player error, and once i download / install the flash player it still comes up with an error. Although flash objects through chrome are fine.
Generally the pc is running much slower than before and has trouble doing 2-3 things at once (like the net, google earth and copying a file from one source to another or playing music) it never had any problems with this before. I have found i am prompted to install DirectX and flash player all the time, and sometimes flash has errors when installing and wont finish the installation, yet other times it installs fine and i dont have any problems for a few hours.
Also, at random times the net will act strange, like when i go to click on a bookmark it will pop up a "download to" window, but if i close my browser down and restart, it works fine. Other times it opens up blank pages (on the net) by itself while your browsing etc.


After rescanning with yet another spyware program....spybot, i get these items, this is a report from spybot:

16.08.2009 21:36:56 - ##### check started #####
16.08.2009 21:36:56 - ### Version: 1.6.2
16.08.2009 21:36:56 - ### Date: 16/08/2009 9:36:56 PM
16.08.2009 21:37:02 - ##### checking bots #####
16.08.2009 21:37:33 - found: Need2Find Browser helper object
16.08.2009 21:37:33 - found: Need2Find Program directory
16.08.2009 21:37:33 - found: Need2Find Program directory
16.08.2009 21:37:33 - found: Need2Find Program directory
16.08.2009 21:37:33 - found: Need2Find Program directory
16.08.2009 21:41:15 - found: BPSSpywareRemover Type library
16.08.2009 21:42:18 - found: Fraud.XPAntivirus User settings
16.08.2009 21:45:43 - found: FunWebProducts User settings
16.08.2009 21:45:44 - found: FunWebProducts Class ID
16.08.2009 21:45:44 - found: FunWebProducts Settings
16.08.2009 21:45:44 - found: FunWebProducts Settings
16.08.2009 21:45:48 - found: MyWay.MyBar Class ID
16.08.2009 21:45:48 - found: MyWay.MyWebSearch Autorun settings (MyWebSearch Email Plugin)
16.08.2009 21:45:49 - found: MyWay.MyWebSearch Settings
16.08.2009 21:45:49 - found: MyWay.MyWebSearch Settings
16.08.2009 21:45:49 - found: MyWay.MyWebSearch Browser helper object
16.08.2009 21:45:49 - found: MyWay.MyWebSearch IE toolbar
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Settings
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Program directory
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Program directory
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Program directory
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Program directory
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Interface
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Type library
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Settings
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Settings
16.08.2009 21:46:35 - found: MyWay.MyWebSearch Class ID
16.08.2009 21:46:50 - found: Microsoft.Windows.Explorer User settings
16.08.2009 21:46:52 - found: Microsoft.Windows.Security.InternetExplorer Settings
16.08.2009 21:46:52 - found: Microsoft.WindowsSecurityCenter.AntiVirusOverride Settings
16.08.2009 21:46:52 - found: Microsoft.WindowsSecurityCenter_disabled Settings
16.08.2009 21:46:59 - found: Altnet Interface
16.08.2009 21:46:59 - found: Altnet Type library
16.08.2009 21:46:59 - found: Altnet Interface
16.08.2009 21:46:59 - found: Altnet Type library
16.08.2009 21:46:59 - found: Altnet Interface
16.08.2009 21:46:59 - found: Altnet Interface
16.08.2009 21:46:59 - found: Altnet Class ID
16.08.2009 21:46:59 - found: Altnet Type library
16.08.2009 21:48:22 - found: Kuasio.Ka Type library
16.08.2009 21:48:24 - found: MyWebSearch Interface
16.08.2009 21:48:24 - found: MyWebSearch Interface
16.08.2009 21:48:24 - found: Nebuler.BHO Settings
16.08.2009 22:05:33 - found: DoubleClick Tracking cookie (Chrome: Chrome)
16.08.2009 22:05:36 - ##### check finished #####



I try to delete them, but spybot says it cannot delete them as they are "in use (in memory)". I am asked to run spybot on the next startup and do so, without luck. I have even tried to scan using spybot while in Windows Safe Mode with the modem turned off etc. Still cant get rid of them as they show up in the next scan i do.

Heres the DDS.txt Log:

DDS (Ver_09-07-30.01) - NTFSx86
Run by COMPUTER at 16:38:58.23 on Mon 17/08/2009
Internet Explorer: 8.0.6001.18702
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============


============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uWindow Title = Microsoft Internet Explorer
uStart Page = hxxp://www.bigpond.com
uSearch Page =
uSearch Bar =
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant =
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll
BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Search Assistant: {f0626a63-410b-45e2-99a1-3f2475b2d695} - c:\program files\sgpsa\BHO.dll
TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {FE063DB9-4EC0-403E-8DD8-394C54984B2C} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [Google Update] "c:\documents and settings\computer\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [PRONoMgr.exe] c:\program files\intel\ncs\proset\PRONoMgr.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\computer\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoThumbnailCache = 1 (0x1)
uPolicies-explorer: link = 00000000
uPolicies-explorer: RestrictRun = 0 (0x0)
uPolicies-system: NoSecCPL = 0 (0x0)
uPolicies-system: NoDispAppearancePage = 0 (0x0)
uPolicies-system: NoDispSettingsPage = 0 (0x0)
uPolicies-system: NoDevMgrPage = 0 (0x0)
uPolicies-system: NoConfigPage = 0 (0x0)
uPolicies-system: NoVirtMemPage = 0 (0x0)
uPolicies-system: NoFileSysPage = 0 (0x0)
uPolicies-system: NoNetSetup = 0 (0x0)
uPolicies-system: NoNetSetupIDPage = 0 (0x0)
uPolicies-system: NoNetSetupSecurityPage = 0 (0x0)
uPolicies-system: NoWorkgroupContents = 0 (0x0)
uPolicies-system: NoEntireNetwork = 0 (0x0)
uPolicies-system: NoFileSharingControl = 0 (0x0)
mPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-explorer: NoFolderOptions = 00000000
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\ivt corporation\bluesoleil\transsend\ie\tsinfo.htm
IE: Send via &Message... - c:\program files\ivt corporation\bluesoleil\transsend\ie\tssms.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207978427714
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {C6E9F0B8-AFEA-46F3-831B-612E97381ABA} - hxxp://www.imvu.com/activex/imvustreamer.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\windows\system32\skype4com.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-08-17 15:55 1,846,632 a------- c:\windows\system32\D3DCompiler_41.dll
2009-08-17 15:55 453,456 a------- c:\windows\system32\d3dx10_41.dll
2009-08-17 15:55 4,178,264 a------- c:\windows\system32\D3DX9_41.dll
2009-08-17 15:53 1,493,528 a------- c:\windows\system32\D3DCompiler_39.dll
2009-08-17 15:53 467,984 a------- c:\windows\system32\d3dx10_39.dll
2009-08-17 15:53 3,851,784 a------- c:\windows\system32\D3DX9_39.dll
2009-08-17 15:53 507,400 a------- c:\windows\system32\XAudio2_1.dll
2009-08-17 15:53 65,032 a------- c:\windows\system32\XAPOFX1_0.dll
2009-08-17 15:53 238,088 a------- c:\windows\system32\xactengine3_1.dll
2009-08-17 15:53 25,608 a------- c:\windows\system32\X3DAudio1_4.dll
2009-08-17 15:53 1,491,992 a------- c:\windows\system32\D3DCompiler_38.dll
2009-08-17 15:53 467,984 a------- c:\windows\system32\d3dx10_38.dll
2009-08-17 15:52 3,850,760 a------- c:\windows\system32\D3DX9_38.dll
2009-08-17 15:49 <DIR> --d----- c:\windows\Logs
2009-08-17 12:36 216,064 a------- c:\windows\PEV.exe
2009-08-17 12:36 161,792 a------- c:\windows\SWREG.exe
2009-08-17 12:36 98,816 a------- c:\windows\sed.exe
2009-08-17 12:36 <DIR> --ds---- C:\fixya
2009-08-17 12:36 389,120 a------- c:\windows\system32\CF14172.exe
2009-08-17 09:50 <DIR> --d----- c:\program files\Trend Micro
2009-08-16 21:25 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-08-16 21:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-08-14 19:23 <DIR> --d----- c:\docume~1\computer\applic~1\Malwarebytes
2009-08-14 19:23 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-14 19:22 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-14 19:22 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-14 19:22 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-13 22:23 <DIR> --d----- c:\program files\Ascentive
2009-08-13 21:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Hagel Technologies
2009-08-12 14:26 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-08-12 14:25 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-08-10 22:06 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-08-10 22:06 <DIR> --d----- c:\docume~1\computer\applic~1\SUPERAntiSpyware.com
2009-08-10 22:05 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-08-10 19:22 47 a------- c:\windows\system32\_WDYSZYG.sys
2009-08-10 15:46 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-08-10 15:46 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-08-10 15:35 <DIR> -cd-h--- c:\windows\ie8
2009-08-10 13:44 <DIR> --d----- c:\program files\Microsoft Office Outlook Connector
2009-08-10 12:08 <DIR> --d----- c:\program files\Microsoft
2009-08-10 12:07 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-08-10 11:48 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-08-10 11:43 <DIR> --d----- c:\program files\common files\Windows Live
2009-08-10 10:46 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-08-09 21:52 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-09 21:52 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys
2009-08-09 21:52 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-08-09 21:52 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-09 21:51 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-08-09 21:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-08-09 16:34 664 a------- c:\windows\system32\d3d9caps.dat
2009-08-09 15:16 <DIR> --d----- C:\ProgramData
2009-08-09 15:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Electronic Arts
2009-08-08 21:42 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-05 19:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll
2009-08-03 13:30 245,760 a------- c:\program files\Uninstall Ask Toolbar.dll
2009-07-27 19:34 <DIR> --d----- c:\program files\AVG
2009-07-26 12:33 <DIR> --d----- c:\docume~1\computer\applic~1\uniblue
2009-07-26 12:29 <DIR> --d----- c:\program files\Uniblue
2009-07-25 21:48 42 a------- c:\windows\system32\RegistryEasy.lie
2009-07-25 21:13 <DIR> --d----- c:\program files\RegistryFix7
2009-07-24 14:29 <DIR> --d----- c:\program files\iTunes
2009-07-20 13:06 <DIR> --d----- c:\program files\DivX

==================== Find3M ====================

2009-08-05 19:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-18 05:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-09 12:16 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-07-09 12:16 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
2009-07-04 03:09 915,456 a------- c:\windows\system32\wininet.dll
2009-06-30 18:09 0 a---h--- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-06-30 18:09 0 a---h--- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-06-30 18:08 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-06-30 18:07 0 a---h--- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-06-30 16:15 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2009-06-30 16:15 0 a---h--- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-06-17 00:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-17 00:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-13 13:08 24,192 a------- c:\documents and settings\computer\usbsermptxp.sys
2009-06-13 13:08 22,768 a------- c:\documents and settings\computer\usbsermpt.sys
2009-06-12 22:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 22:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-11 00:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 16:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-04 05:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-02-27 18:31 4,970 a------- c:\docume~1\computer\applic~1\wklnhst.dat
2008-11-24 08:01 58,672 a------- c:\docume~1\computer\applic~1\GDIPFONTCACHEV1.DAT
2008-06-09 19:48 87,608 a------- c:\docume~1\computer\applic~1\inst.exe
2008-06-09 19:48 47,360 a------- c:\docume~1\computer\applic~1\pcouffin.sys
2009-02-14 21:24 80 ---shr-- c:\windows\system32\CD2EF4E7AA.dll
2009-02-02 00:06 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009020220090203\index.dat
2009-04-30 11:14 16,384 a--sh--- c:\windows\temp\cookies\index.dat
2009-04-30 11:14 16,384 a--sh--- c:\windows\temp\history\history.ie5\index.dat
2009-04-30 11:14 32,768 a--sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 16:39:41.60 ===============


Please also find attached the other two logs / reports as required.


Thanks, Andrew.

Attached Files

Attach.zip (8.3 KB, 0 views)

andylewer

I dont mean to be rude but can anyone help me?

andylewer

EDIT: Dont worry about it guys, fixed it myself (re-installed Windows) couldnt wait any longer, it has been 5 days.

Before i get flamed for being sarcastic or anything im not, i do understand any help given is from volunteers and you guys are probably very busy.