|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-13-2007, 10:04 AM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
New IE windows hang for 3-10 minutes then work great
Hello,
About 4 days ago I noticed that my AVG Anti-virus hadn't successfully updated last time it tried so I manually updated it and ended up having to reboot my system. After that, I noticed that several of my task tray icons had disappeared (specifically my AVG Spyware and AVG Anti-virus icons) and now whenever I open an Internet Explorer window it takes anywhere from 3-10+ minutes for the connection to be made. It always connects, eventually, and works great after that initial delay/hang (until I click on something that opens a new window - which then does the same delay). I run an AMD Athlon XP 2200+ w/1GB of ram, have always had antivirus on the machine (Symantec for about 5 years, moved to AVG about 6 months ago). I have been running AVG's Spyware 7.5 and Anti-Virus 7.5 free editions (not the rootkit though) and I run Ad-Aware every once in a while. Until this incident I've never been infected or had any problems. My OS is XP Home Svc Pk 2 and its as up to date as it can be. I primarily run PaperPort 11, Quicken, Outlook and MS Office 2000. My peripherals are a Canon FX80 multifunction machine, a Visioneer Strobe XP22 and a Logitech Quickcam. To try and solve the problem I got the latest updates to IE 6 but that didn't do any good. I then downloaded and installed IE 7 (been avoiding it) - it displayed the same delays upon opening new windows. I then uninstalled all my spyware and antivirus programs, downloaded fresh copies and re-intalled them (AVG Antivirus, Spyware and rootkit and Ad-Aware). I ran each of them in SAFE mode - Ad-Aware came up with tracking cookies but nothing else. Everything else reported that I was clean. I then downloaded Mozilla's Firefox and installed it and it does NOT display the delay problem when new windows or tabs are opened. (Which would be fine, but I NEED IE to access an application for work that doesn't work on other browsers.) As you can see, from the dss log I ran HJT and tried to fix two things myself (I know - it won't happen again - but at least they are reported in the dss.txt) It was then that I decided to go get some help because I'm at my wits end. I did the 5 Steps, my computer didn't have any of the malicious entries, the Panda Scan file is attached as requested (I even ran it from inside IE like the instructions said - and THAT program pops up a lot of new windows that I had to wait through!). I did NOT install the spyware program because I am running AVG's and I did NOT install the one that wanted to put all those sites on my restricted list - once I read what it did I realized it would stop me from being able to connect to software I need so I didn't install it. I thank you for any help you can give me - sorry I can't give you any more info....I've attached the extra.txt from the dss and the log that resulted from the Panda Security scan. Here is the dss log: Deckard's System Scanner v20070905.67 Run by CJ on 2007-10-13 08:07:31 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 74: 2007-10-13 15:07:36 UTC - RP1072 - Deckard's System Scanner Restore Point 73: 2007-10-12 18:49:26 UTC - RP1071 - Software Distribution Service 3.0 72: 2007-10-12 02:45:36 UTC - RP1070 - Installed Ad-Aware 2007 71: 2007-10-12 02:43:10 UTC - RP1069 - Installed AVG 7.5 70: 2007-10-11 19:57:40 UTC - RP1068 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2007-08-11 00:46:44 UTC - RP999 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-10-13 08:09:12 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16544) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\fxredir.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\V-Stream\TV88X\C8XRCtl.exe D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Canon\MultiPASS4\mpservic.exe C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\bak\fxredir.exe C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe C:\WINDOWS\system32\ctfmon.exe D:\downloaded pgms\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {64634180-B0EA-48B6-82B7-9620D33362C1} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll O4 - HKEY_LOCAL_MACHINE\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKEY_LOCAL_MACHINE\..\Run: [fxredir] C:\WINDOWS\system32\fxredir.exe O4 - HKEY_LOCAL_MACHINE\..\Run: [Agent] d:\Program Files\CyberLink\PowerVCRII\Agent.exe O4 - HKEY_LOCAL_MACHINE\..\Run: [Remote_Agent] d:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe O4 - HKEY_LOCAL_MACHINE\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKEY_LOCAL_MACHINE\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKEY_LOCAL_MACHINE\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKEY_LOCAL_MACHINE\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKEY_LOCAL_MACHINE\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKEY_LOCAL_MACHINE\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKEY_LOCAL_MACHINE\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKEY_LOCAL_MACHINE\..\Run: [PaperPort PTD] "C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" O4 - HKEY_LOCAL_MACHINE\..\Run: [IndexSearch] "C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" O4 - HKEY_LOCAL_MACHINE\..\Run: [InstantAccess] d:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE /h O4 - HKEY_LOCAL_MACHINE\..\Run: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKEY_LOCAL_MACHINE\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKEY_LOCAL_MACHINE\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKEY_LOCAL_MACHINE\..\RunServices: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: reminder-ScanSoft Product Registration.lnk = D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech Music Anywhere Settings.lnk = C:\Program Files\Logitech\Music Anywhere\LMASysTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: TV Remote Control.lnk = C:\Program Files\V-Stream\TV88X\C8XRCtl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra 'Tools' menuitem: (no name) - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra 'Tools' menuitem: (no name) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: Diagnose Connection Problems... - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: https://advancedmd.com (HKCU) O15 - Trusted Zone: http://advancedmd.com (HKCU) O15 - Trusted Zone: *.doginhispen.com (HKCU) O15 - Trusted Zone: *.whataboutadog.com (HKCU) O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} (Panasonic Network Camera) - http://24.105.203.109:5001/SysCamInst.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab O16 - DPF: {5EF06782-55B2-4DF3-A57A-3FE8F1D2A181} (PPMDForms.Forms) - https://app.advancedmd.com/practicem.../ppmdforms.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094685722291 O16 - DPF: {6A6E7E91-B6EB-46B5-A545-12B8EDDD261E} (AMDSControls50.XGroupCategory) - https://app.advancedmd.com/practicem...controls50.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1184552540251 O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://bmlcam.homeip.net/plugin/client.cab O16 - DPF: {9602B3CE-BC91-417D-B4FD-F6538C2ABB3B} (AMDSWSCheck.WSCheck) - https://app.advancedmd.com/practicem...mdswscheck.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://bmlcam.homeip.net/plugin/h263ctrl.cab O16 - DPF: {B15C3921-CCFA-4403-9E6F-4470839E835E} (Leadtools.XLead) - https://app.advancedmd.com/practicem.../leadtools.cab O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://app.advancedmd.com/practicem...ivexviewer.cab O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} (Java Plug-in 1.4.2_06) - http://java.sun.com/update/1.4.2/jin...ndows-i586.cab O16 - DPF: {CC99A86F-EA5D-414A-8231-7C3F1B10A644} (AMDSAudio.XAudio) - https://app.advancedmd.com/practicem.../amdsaudio.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://149.43.156.107/activex/AMC.cab O16 - DPF: {EE8CEFA4-1F91-11D4-B31E-00C04F1D37E6} (PPMDVBDownload.XShowReady) - https://app.advancedmd.com/practicem...vbdownload.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\mpservic.exe O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - "C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe" O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - "C:\Program Files\Viewpoint\Common\ViewpointService.exe" -- HijackThis Fixed Entries (C:\Documents and Settings\CJ\Desktop\backups\) ---- backup-20071012-152842-977 O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe backup-20071012-153747-162 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 CX23880 (Conexant TV88X Video Capture) - c:\windows\system32\drivers\cx88vid.sys <Not Verified; Conexant Systems, Inc.; cx88vid.sys> R2 CX88XBAR (Conexant TV88X Crossbar) - c:\windows\system32\drivers\cx88xbar.sys <Not Verified; Conexant Systems, Inc.; cx88xbar.sys> R2 CXTUNE (Conexant TV88X Tuner) - c:\windows\system32\drivers\cx88tune.sys <Not Verified; Conexant Systems, Inc.; cx88tune.sys> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S3 PalmUSBD - c:\windows\system32\drivers\palmusbd.sys (file missing) S3 S3SAV2K - c:\windows\system32\drivers\s3sav2km.sys <Not Verified; S3 Incorporated; S3 Miniport Driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 MpService - c:\program files\canon\multipass4\mpservic.exe <Not Verified; Canon Inc.; Canon MultiPASS> R2 OneTouch 4.0 Monitor - "c:\program files\visioneer\onetouch 4.0\otservice.exe" <Not Verified; Visioneer Inc.; OneTouch 4.0 Component> R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2007-10-13 08  00 366 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job-- Files created between 2007-09-13 and 2007-10-13 ----------------------------- 2007-10-12 16:29:20 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-10-12 16:29:19 0 d-------- C:\WINDOWS\LastGood 2007-10-11 21:36:45 0 d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft 2007-10-11 19:52:11 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2007-10-11 19:51:01 0 d--h----- C:\Documents and Settings\Administrator\Templates 2007-10-11 19:51:01 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2007-10-11 19:51:01 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2007-10-11 19:51:01 0 d--h----- C:\Documents and Settings\Administrator\Recent 2007-10-11 19:51:01 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2007-10-11 19:51:01 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2007-10-11 19:51:01 0 d-------- C:\Documents and Settings\Administrator\My Documents 2007-10-11 19:51:01 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2007-10-11 19:51:01 0 d-------- C:\Documents and Settings\Administrator\Favorites 2007-10-11 19:51:01 0 d-------- C:\Documents and Settings\Administrator\Desktop 2007-10-11 19:51:01 0 d--hs---- C:\Documents and Settings\Administrator\Cookies 2007-10-11 19:51:01 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2007-10-11 19:51:01 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2007-10-11 19:51:00 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2007-10-11 19:47:54 0 d-------- C:\Documents and Settings\CJ\Application Data\Grisoft 2007-10-11 19:45:37 0 d-------- C:\Program Files\Lavasoft 2007-10-11 19:45:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-10-11 19:45:07 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-10-11 19:43:37 0 d-------- C:\Documents and Settings\CJ\Application Data\AVG7 2007-10-11 19:43:31 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-10-11 13:45:42 0 d-------- C:\Documents and Settings\CJ\Application Data\Talkback 2007-10-11 13:45:11 0 --a------ C:\WINDOWS\nsreg.dat 2007-10-11 12:53:17 0 d-------- C:\WINDOWS\network diagnostic 2007-10-11 12:46:08 0 dr-h----- C:\Documents and Settings\CJ\Recent 2007-10-11 11:59:31 0 d-------- C:\Program Files\Windows Media Connect 2 2007-10-11 11:58:09 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-10-11 07:45:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-10-08 16:03:40 0 d-------- C:\WINDOWS\system32\bak 2007-10-03 13:42:52 0 d-------- C:\Documents and Settings\CJ\Application Data\Move Networks 2007-10-02 09:24:42 0 d-------- C:\Program Files\SupportSoft -- Find3M Report --------------------------------------------------------------- 2007-10-12 18:21:25 0 d-------- C:\Program Files\Webshots 2007-10-12 18:09:29 0 d-------- C:\Program Files\Google 2007-10-12 16:51:52 16 --a------ C:\WINDOWS\popcinfo.dat 2007-10-11 19:45:07 0 d-------- C:\Program Files\Common Files 2007-10-11 13:45:09 0 d-------- C:\Documents and Settings\CJ\Application Data\Mozilla 2007-10-09 09:04:48 0 d-------- C:\Program Files\Citrix 2007-10-09 09:03:36 0 d-------- C:\Documents and Settings\CJ\Application Data\Lavasoft 2007-10-08 16:11:06 0 d-------- C:\Program Files\QuickTime 2007-10-08 16:11:06 0 d-------- C:\Program Files\Microsoft ActiveSync 2007-10-08 16:11:06 0 d-------- C:\Program Files\iTunes 2007-10-08 16:08:42 28172 --a------ C:\WINDOWS\system32\fxredir.exe 2007-10-03 14:07:19 0 d-------- C:\Program Files\Quicken 2007-09-03 15:26:35 0 d-------- C:\Program Files\Touch Screen Setup 2007-08-23 21:19:21 0 d-------- C:\Program Files\PopCap Games 2007-07-17 20 39 774144 --a------ C:\Program Files\RngInterstitial.dll <Not Verified; RealNetworks, Inc.; RealNetworks, Inc. RngInterstitial>2007-07-15 16:07:46 2508 --a------ C:\Documents and Settings\CJ\Application Data\$_hpcst$.hpc -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "fxredir"="C:\WINDOWS\system32\fxredir.exe" [10/08/2007 04:08 PM] "Agent"="d:\Program Files\CyberLink\PowerVCRII\Agent.exe" [10/08/2007 04:08 PM] "Remote_Agent"="d:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe" [10/08/2007 04:08 PM] "zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [10/08/2007 04:08 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [10/08/2007 04:08 PM] "LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [10/08/2007 04:08 PM] "LogitechGalleryRepair"="C:\Program Files\Logitech\ImageStudio\ISStart.exe" [10/08/2007 04:08 PM] "LogitechImageStudioTray"="C:\Program Files\Logitech\ImageStudio\LogiTray.exe" [10/08/2007 04:08 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/08/2007 04:08 PM] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [10/08/2007 04:08 PM] "PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [10/08/2007 04:08 PM] "IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [10/08/2007 04:08 PM] "InstantAccess"="d:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.exe" [10/08/2007 04:08 PM] "RegisterDropHandler"="d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE" [10/08/2007 04:08 PM] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 02:25 AM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [10/11/2007 07:43 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [10/08/2007 04:08 PM] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [10/08/2007 04:08 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "RegisterDropHandler"=d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE C:\Documents and Settings\CJ\Start Menu\Programs\Accessories\Startup\ reminder-ScanSoft Product Registration.lnk - D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe [3/23/2007 4:13:52 PM] Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [9/14/2004 10:47:44 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [9/9/2004 10:00:15 PM] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 11:05:26 PM] Logitech Music Anywhere Settings.lnk - C:\Program Files\Logitech\Music Anywhere\LMASysTray.exe [2/6/2007 5:47:12 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM] TV Remote Control.lnk - C:\Program Files\V-Stream\TV88X\C8XRCtl.exe [10/12/2004 4:03:05 AM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "DisableTaskMgr"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2007-10-13 08:11:02 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-17-2007, 11:30 AM
|
#3 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Hello hookj. Welcome to TSF, and thank you for your patience.
This is going to take a couple of rounds to clean up, so please stay with me. We'll begin with this tool: Download Combofix and save it to your desktop. **Note: It is important that it is saved directly to your desktop** -------------------------------------------------------------------- 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Double click on combofix.exe & follow the prompts.
Note: Do not mouseclick combofix's window while it's running. That may cause it to stall |
|
|
|
|
10-17-2007, 10:17 PM
|
#4 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Thank you for helping me out Ried. Your efforts here are REALLY appreciated.
I ran Combofix - the resulting log is attached and the HiJackThis log (not DSS but HJT) is pasted below. NOTE: When I ran Combofix - "sed.cfexe" came up with an error and had to close - after the reboot Combofix tried to run "sed.cfexe" again and it errored out again. ComboFix 07-10-17.8 - CJ 2007-10-17 16:50:27.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.583 [GMT -7:00] Running from: C:\Documents and Settings\CJ\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\WinBudget C:\Program Files\WinBudget\bin\crap.1192490181.old C:\Program Files\WinBudget\bin\matrix.dat C:\Program Files\WinBudget\bin\matrix.dll C:\WINDOWS\Fonts\acrsecI.fon . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\nm ((((((((((((((((((((((((( Files Created from 2007-09-17 to 2007-10-17 ))))))))))))))))))))))))))))))) . 2007-10-17 16:49 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-14 08:38 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\Talkback 2007-10-14 08:37 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\AVG7 2007-10-13 08:07 <DIR> d-------- C:\Deckard 2007-10-12 16:29 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-11 21:36 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft 2007-10-11 19:52 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2007-10-11 19:47 <DIR> d-------- C:\Documents and Settings\CJ\Application Data\Grisoft 2007-10-11 19:45 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-11 19:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-10-11 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-10-11 19:44 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys 2007-10-11 19:43 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-10-11 19:43 <DIR> d-------- C:\Documents and Settings\CJ\Application Data\AVG7 2007-10-11 19:41 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-10-11 13:45 <DIR> d-------- C:\Documents and Settings\CJ\Application Data\Talkback 2007-10-11 13:45 0 --a------ C:\WINDOWS\nsreg.dat 2007-10-11 12:52 6,058,496 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-10-11 12:52 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-10-11 12:52 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-10-11 12:52 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-10-11 12:52 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-10-11 12:52 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2007-10-11 12:52 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-10-11 12:52 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-10-11 11:59 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2007-10-11 11:58 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2007-10-11 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-10-09 19:10 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-08 16:03 <DIR> d-------- C:\WINDOWS\system32\bak 2007-10-03 13:42 <DIR> d-------- C:\Documents and Settings\CJ\Application Data\Move Networks 2007-10-02 09:24 <DIR> d-------- C:\Program Files\SupportSoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-16 19:44 --------- d-----w C:\Program Files\Quicken 2007-10-15 01:34 --------- d-----w C:\Program Files\PosterPrint 2.0 2007-10-13 01:21 --------- d-----w C:\Program Files\Webshots 2007-10-13 01:09 --------- d-----w C:\Program Files\Google 2007-10-12 02:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-09 16:04 --------- d-----w C:\Program Files\Citrix 2007-10-09 16:03 --------- d-----w C:\Documents and Settings\CJ\Application Data\Lavasoft 2007-10-08 23:11 --------- d-----w C:\Program Files\QuickTime 2007-10-08 23:11 --------- d-----w C:\Program Files\Microsoft ActiveSync 2007-10-08 23:11 --------- d-----w C:\Program Files\iTunes 2007-09-03 22:26 --------- d-----w C:\Program Files\Touch Screen Setup 2007-08-24 04:19 --------- d-----w C:\Program Files\PopCap Games 2007-07-18 03:06 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-09-25 17:00 56,912 ----a-w C:\Documents and Settings\CJ\g2mdlhlpx.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "fxredir"="C:\WINDOWS\system32\fxredir.exe" [2007-10-08 16:08] "Agent"="d:\Program Files\CyberLink\PowerVCRII\Agent.exe" [2007-10-08 16:08] "Remote_Agent"="d:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe" [2007-10-08 16:08] "zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2007-10-08 16:08] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-10-08 16:08] "LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2007-10-08 16:08] "LogitechGalleryRepair"="C:\Program Files\Logitech\ImageStudio\ISStart.exe" [2007-10-08 16:08] "LogitechImageStudioTray"="C:\Program Files\Logitech\ImageStudio\LogiTray.exe" [2007-10-08 16:08] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-10-08 16:08] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2007-10-08 16:08] "PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [2007-10-08 16:08] "IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [2007-10-08 16:08] "InstantAccess"="d:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.exe" [2007-10-08 16:08] "RegisterDropHandler"="d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE" [2007-10-08 16:08] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-11 19:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-08 16:08] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2007-10-08 16:08] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "RegisterDropHandler"=d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE C:\Documents and Settings\CJ\Start Menu\Programs\Accessories\Startup\ reminder-ScanSoft Product Registration.lnk - D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe [2007-03-23 16:13:52] Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2004-09-14 10:47:44] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-09-09 22:00:15] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] Logitech Music Anywhere Settings.lnk - C:\Program Files\Logitech\Music Anywhere\LMASysTray.exe [2007-02-06 17:47:12] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04] TV Remote Control.lnk - C:\Program Files\V-Stream\TV88X\C8XRCtl.exe [2004-10-12 04:03:05] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) R2 CX23880;Conexant TV88X Video Capture;C:\WINDOWS\system32\drivers\cx88vid.sys R2 CX88XBAR;Conexant TV88X Crossbar;C:\WINDOWS\system32\drivers\CX88XBAR.sys R2 CXTUNE;Conexant TV88X Tuner;C:\WINDOWS\system32\drivers\CX88TUNE.sys R2 OneTouch 4.0 Monitor;OneTouch 4.0 Monitor;"C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe" S3 S3SAV2K;S3SAV2K;C:\WINDOWS\system32\DRIVERS\s3sav2km.sys . Contents of the 'Scheduled Tasks' folder "2007-10-17 23:56:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-17 16:55:01 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-17 16:56:31 - machine was rebooted . --- E O F --- Here's the HJT log: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 5:00:02 PM, on 10/17/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe D:\Program Files\CyberLink\PowerVCRII\Agent.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Logitech\Music Anywhere\LMASysTray.exe C:\Program Files\V-Stream\TV88X\C8XRCtl.exe D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe C:\PROGRA~1\Webshots\webshots.scr C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\notepad.exe D:\Program Files\CyberLink\PowerVCRII\bak\Agent.exe c:\program files\internet explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\CJ\Desktop\HiJackThis_v2.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {64634180-B0EA-48B6-82B7-9620D33362C1} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [fxredir] C:\WINDOWS\system32\fxredir.exe O4 - HKLM\..\Run: [Agent] d:\Program Files\CyberLink\PowerVCRII\Agent.exe O4 - HKLM\..\Run: [Remote_Agent] d:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [InstantAccess] d:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\RunServices: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: reminder-ScanSoft Product Registration.lnk = D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech Music Anywhere Settings.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: TV Remote Control.lnk = C:\Program Files\V-Stream\TV88X\C8XRCtl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.advancedmd.com O15 - Trusted Zone: *.doginhispen.com O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} (Panasonic Network Camera) - http://24.105.203.109:5001/SysCamInst.cab O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab O16 - DPF: {5EF06782-55B2-4DF3-A57A-3FE8F1D2A181} (PPMDForms.Forms) - https://app.advancedmd.com/practicem.../ppmdforms.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094685722291 O16 - DPF: {6A6E7E91-B6EB-46B5-A545-12B8EDDD261E} (AMDSControls50.XGroupCategory) - https://app.advancedmd.com/practicem...controls50.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1184552540251 O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://bmlcam.homeip.net/plugin/client.cab O16 - DPF: {9602B3CE-BC91-417D-B4FD-F6538C2ABB3B} (AMDSWSCheck.WSCheck) - https://app.advancedmd.com/practicem...mdswscheck.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://bmlcam.homeip.net/plugin/h263ctrl.cab O16 - DPF: {B15C3921-CCFA-4403-9E6F-4470839E835E} (Leadtools.XLead) - https://app.advancedmd.com/practicem.../leadtools.cab O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://app.advancedmd.com/practicem...ivexviewer.cab O16 - DPF: {CC99A86F-EA5D-414A-8231-7C3F1B10A644} (AMDSAudio.XAudio) - https://app.advancedmd.com/practicem.../amdsaudio.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://149.43.156.107/activex/AMC.cab O16 - DPF: {EE8CEFA4-1F91-11D4-B31E-00C04F1D37E6} (PPMDVBDownload.XShowReady) - https://app.advancedmd.com/practicem...vbdownload.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O24 - Desktop Component 0: (no name) - http://bmlcam.homeip.net/pic/banner.gif -- End of file - 11186 bytes Last edited by Ried; 10-17-2007 at 10:39 PM. |
|
|
|
|
10-17-2007, 10:46 PM
|
#5 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
You're welcome.
 I'm not seeing what I expected in the ComboFix.txt. Please download FindAWF to your Desktop.
|
|
|
|
|
10-18-2007, 08:29 AM
|
#6 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Attached is the result of running FindAWF.exe...
Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Thu 10/18/2007 The current time is: 7:26:14.01 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 02/08/2006 03:03 PM 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\MI3AA1~1\BAK 06/20/2006 10:36 PM 1,207,080 wcescomm.exe 1 File(s) 1,207,080 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 04/27/2007 09:41 AM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 11/09/2002 10:31 AM 77,824 fxredir.exe 1 File(s) 77,824 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK 06/09/2007 11:05 AM 68,856 GoogleToolbarNotifier.exe 1 File(s) 68,856 bytes Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK 09/14/2007 06:38 AM 421,888 avgcc.exe 1 File(s) 421,888 bytes Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK 06/11/2007 02:25 AM 6,731,312 avgas.exe 1 File(s) 6,731,312 bytes Directory of C:\PROGRA~1\LOGITECH\IMAGES~1\BAK 12/10/2002 07:32 PM 155,648 ISStart.exe 12/10/2002 07:31 PM 61,440 LogiTray.exe 2 File(s) 217,088 bytes Directory of C:\PROGRA~1\LOGITECH\ITOUCH\BAK 03/18/2004 10:33 AM 892,928 iTouch.exe 1 File(s) 892,928 bytes Directory of C:\PROGRA~1\SCANSOFT\PAPERP~1\BAK 05/05/2006 01:19 PM 40,960 IndexSearch.exe 05/05/2006 01:18 PM 36,864 pptd40nt.exe 2 File(s) 77,824 bytes Directory of C:\PROGRA~1\COMMON~1\LOGITECH\QCDRIV~2\BAK 12/10/2002 06:54 PM 127,022 LVCOMS.EXE 1 File(s) 127,022 bytes Directory of C:\PROGRA~1\COMMON~1\SCANSO~1\SSBKGD~1\BAK 09/30/2003 01:14 AM 155,648 SSBkgdupdate.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 03/14/2007 03:43 AM 83,608 jusched.exe 1 File(s) 83,608 bytes Directory of D:\PROGRA~1\CYBERL~1\POWERV~1\BAK 10/01/2002 03:57 PM 94,208 Agent.exe 10/07/2002 10:35 AM 32,768 RemoteAgent.exe 2 File(s) 126,976 bytes Directory of D:\PROGRA~1\TEXTBR~1\BIN\BAK 06/19/2000 08:51 AM 31,744 INSTAN~1.EXE 06/19/2000 08:56 AM 22,528 REGIST~1.EXE 2 File(s) 54,272 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 28172 Oct 8 2007 "C:\Program Files\iTunes\iTunesHelper.exe" 278528 Feb 8 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 28172 Oct 8 2007 "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" 1207080 Jun 20 2006 "C:\Program Files\Microsoft ActiveSync\bak\wcescomm.exe" 28172 Oct 8 2007 "C:\Program Files\QuickTime\qttask.exe" 282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\qttask.exe" 28172 Oct 8 2007 "C:\WINDOWS\system32\fxredir.exe" 77824 Nov 9 2002 "C:\WINDOWS\system32\bak\fxredir.exe" 52272 Jan 27 2007 "C:\Program Files\Google\googletoolbar4user.exe" 28172 Oct 8 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 4997120 Sep 21 2006 "C:\Program Files\Google\Google Video Player\GoogleVideoPlayer.exe" 3379200 Jul 17 2007 "C:\Program Files\Real\RealArcade\GoogleInstApp.exe" 138168 Jan 27 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 68856 Jun 9 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe" 472256 Sep 9 2004 "D:\downloaded pgms\Google ToolBar\GoogleToolbarInstaller.exe" 69632 Jan 31 2007 "D:\Program Files\google\googleearth.exe" 421888 Oct 11 2007 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 421888 Sep 14 2007 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe" 6731312 Jun 11 2007 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" 6731312 Jun 11 2007 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe" 28172 Oct 8 2007 "C:\Program Files\Logitech\ImageStudio\ISStart.exe" 155648 Dec 10 2002 "C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe" 28172 Oct 8 2007 "C:\Program Files\Logitech\ImageStudio\LogiTray.exe" 61440 Dec 10 2002 "C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe" 28172 Oct 8 2007 "C:\Program Files\Logitech\iTouch\iTouch.exe" 892928 Mar 18 2004 "C:\Program Files\Logitech\iTouch\bak\iTouch.exe" 28172 Oct 8 2007 "C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" 40960 May 5 2006 "C:\Program Files\Scansoft\PaperPort\bak\IndexSearch.exe" 28172 Oct 8 2007 "C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" 36864 May 5 2006 "C:\Program Files\Scansoft\PaperPort\bak\pptd40nt.exe" 102400 Jun 10 2002 "C:\WINDOWS\system32\LVComS.exe" 102400 Jun 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe" 90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe" 28172 Oct 8 2007 "C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" 127022 Dec 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver3\bak\LVCOMS.EXE" 28172 Oct 8 2007 "C:\Program Files\Common Files\scansoft shared\SSBkgdUpdate\SSBkgdupdate.exe" 155648 Sep 30 2003 "C:\Program Files\Common Files\scansoft shared\SSBkgdUpdate\bak\SSBkgdupdate.exe" 32881 Sep 28 2004 "C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe" 36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" 49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" 36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" 75520 Dec 15 2006 "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" 36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" 28172 Oct 8 2007 "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" 83608 Mar 14 2007 "C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe" 372736 Oct 16 2003 "C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe" 28172 Oct 8 2007 "D:\Program Files\CyberLink\PowerVCRII\Agent.exe" 94208 Oct 1 2002 "D:\Program Files\CyberLink\PowerVCRII\bak\Agent.exe" 194072 Jul 26 2007 "C:\Program Files\Common Files\Remote Control Software Shared\RemoteCore.exe" 8081161 Feb 6 2003 "D:\Drivers\ATI drivers\installed\remote-1-1-instmsi.exe" 28172 Oct 8 2007 "D:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe" 32768 Oct 7 2002 "D:\Program Files\CyberLink\PowerVCRII\bak\RemoteAgent.exe" 28172 Oct 8 2007 "D:\Program Files\Textbridge\Bin\InstantAccess.exe" 31744 Jun 19 2000 "D:\Program Files\Textbridge\Bin\bak\INSTAN~1.EXE" 430080 Nov 4 2005 "C:\Program Files\Adams Business Forms\Tax Forms Helper 2005\Registration.exe" 28172 Oct 8 2007 "D:\Program Files\Textbridge\Bin\RegisterDropHandler.exe" 22528 Jun 19 2000 "D:\Program Files\Textbridge\Bin\bak\REGIST~1.EXE" end of report |
|
|
|
|
10-18-2007, 09:00 AM
|
#7 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Thank you. Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
Also be sure to carry out the instructions in the sequence listed below. *************************************************** Download: ResetProtocolDefaults.reg and save it to your desktop. -------------------------------------------------------------------- Please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. -------------------------------------------------------------------- Double-click FindAWF.exe to start the tool.
Double-click FindAWF.exe to start the tool once again.
------------------------------------------------------------------------------------- Locate "ResetProtocolDefaults.reg" on your desktop. Right-click and select Merge (Ok the prompt) ------------------------------------------------------------------------------------- Reboot back into Normal Mode. ------------------------------------------------------------------------------------- Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Perform an online scan with Internet Explorer with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan -------------------------------------------------------------------- Run a new scan with HijackThis and save the log. -------------------------------------------------------------------- Please include the following in your next reply: awf.txt Panda results New HijackThis log |
|
|
|
|
10-18-2007, 11:56 AM
|
#8 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Okay! In order to run the Panda Scan I had to use IE and not Firefox so I clicked it while crossing my fingers and it came right up without the delay!
As some character in the latest version of "Freaky Friday" said..."Dude, you rock!!" Here is the AWF log after running it with Option 2 (I attached the Panda and the HJT logs): Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Thu 10/18/2007 The current time is: 8:55:38.36 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 02/08/2006 03:03 PM 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\MI3AA1~1\BAK 06/20/2006 10:36 PM 1,207,080 wcescomm.exe 1 File(s) 1,207,080 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 04/27/2007 09:41 AM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 11/09/2002 10:31 AM 77,824 fxredir.exe 1 File(s) 77,824 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK 06/09/2007 11:05 AM 68,856 GoogleToolbarNotifier.exe 1 File(s) 68,856 bytes Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK 09/14/2007 06:38 AM 421,888 avgcc.exe 1 File(s) 421,888 bytes Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK 06/11/2007 02:25 AM 6,731,312 avgas.exe 1 File(s) 6,731,312 bytes Directory of C:\PROGRA~1\LOGITECH\IMAGES~1\BAK 12/10/2002 07:32 PM 155,648 ISStart.exe 12/10/2002 07:31 PM 61,440 LogiTray.exe 2 File(s) 217,088 bytes Directory of C:\PROGRA~1\LOGITECH\ITOUCH\BAK 03/18/2004 10:33 AM 892,928 iTouch.exe 1 File(s) 892,928 bytes Directory of C:\PROGRA~1\SCANSOFT\PAPERP~1\BAK 05/05/2006 01:19 PM 40,960 IndexSearch.exe 05/05/2006 01:18 PM 36,864 pptd40nt.exe 2 File(s) 77,824 bytes Directory of C:\PROGRA~1\COMMON~1\LOGITECH\QCDRIV~2\BAK 12/10/2002 06:54 PM 127,022 LVCOMS.EXE 1 File(s) 127,022 bytes Directory of C:\PROGRA~1\COMMON~1\SCANSO~1\SSBKGD~1\BAK 09/30/2003 01:14 AM 155,648 SSBkgdupdate.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 03/14/2007 03:43 AM 83,608 jusched.exe 1 File(s) 83,608 bytes Directory of D:\PROGRA~1\CYBERL~1\POWERV~1\BAK 10/01/2002 03:57 PM 94,208 Agent.exe 10/07/2002 10:35 AM 32,768 RemoteAgent.exe 2 File(s) 126,976 bytes Directory of D:\PROGRA~1\TEXTBR~1\BIN\BAK 06/19/2000 08:51 AM 31,744 INSTAN~1.EXE 06/19/2000 08:56 AM 22,528 REGIST~1.EXE 2 File(s) 54,272 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 278528 Feb 8 2006 "C:\Program Files\iTunes\iTunesHelper.exe" 278528 Feb 8 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 1207080 Jun 20 2006 "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" 1207080 Jun 20 2006 "C:\Program Files\Microsoft ActiveSync\bak\wcescomm.exe" 282624 Apr 27 2007 "C:\Program Files\QuickTime\qttask.exe" 282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\qttask.exe" 77824 Nov 9 2002 "C:\WINDOWS\system32\fxredir.exe" 77824 Nov 9 2002 "C:\WINDOWS\system32\bak\fxredir.exe" 52272 Jan 27 2007 "C:\Program Files\Google\googletoolbar4user.exe" 68856 Jun 9 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 4997120 Sep 21 2006 "C:\Program Files\Google\Google Video Player\GoogleVideoPlayer.exe" 3379200 Jul 17 2007 "C:\Program Files\Real\RealArcade\GoogleInstApp.exe" 138168 Jan 27 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 68856 Jun 9 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe" 472256 Sep 9 2004 "D:\downloaded pgms\Google ToolBar\GoogleToolbarInstaller.exe" 69632 Jan 31 2007 "D:\Program Files\google\googleearth.exe" 421888 Oct 11 2007 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 421888 Sep 14 2007 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe" 6731312 Jun 11 2007 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" 6731312 Jun 11 2007 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe" 155648 Dec 10 2002 "C:\Program Files\Logitech\ImageStudio\ISStart.exe" 155648 Dec 10 2002 "C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe" 61440 Dec 10 2002 "C:\Program Files\Logitech\ImageStudio\LogiTray.exe" 61440 Dec 10 2002 "C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe" 892928 Mar 18 2004 "C:\Program Files\Logitech\iTouch\iTouch.exe" 892928 Mar 18 2004 "C:\Program Files\Logitech\iTouch\bak\iTouch.exe" 40960 May 5 2006 "C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" 40960 May 5 2006 "C:\Program Files\Scansoft\PaperPort\bak\IndexSearch.exe" 36864 May 5 2006 "C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" 36864 May 5 2006 "C:\Program Files\Scansoft\PaperPort\bak\pptd40nt.exe" 102400 Jun 10 2002 "C:\WINDOWS\system32\LVComS.exe" 102400 Jun 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe" 90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe" 127022 Dec 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" 127022 Dec 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver3\bak\LVCOMS.EXE" 155648 Sep 30 2003 "C:\Program Files\Common Files\scansoft shared\SSBkgdUpdate\SSBkgdupdate.exe" 155648 Sep 30 2003 "C:\Program Files\Common Files\scansoft shared\SSBkgdUpdate\bak\SSBkgdupdate.exe" 32881 Sep 28 2004 "C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe" 36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" 49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" 36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" 75520 Dec 15 2006 "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" 36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" 28172 Oct 8 2007 "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" 83608 Mar 14 2007 "C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe" 372736 Oct 16 2003 "C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe" 94208 Oct 1 2002 "D:\Program Files\CyberLink\PowerVCRII\Agent.exe" 94208 Oct 1 2002 "D:\Program Files\CyberLink\PowerVCRII\bak\Agent.exe" 194072 Jul 26 2007 "C:\Program Files\Common Files\Remote Control Software Shared\RemoteCore.exe" 8081161 Feb 6 2003 "D:\Drivers\ATI drivers\installed\remote-1-1-instmsi.exe" 32768 Oct 7 2002 "D:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe" 32768 Oct 7 2002 "D:\Program Files\CyberLink\PowerVCRII\bak\RemoteAgent.exe" 31744 Jun 19 2000 "D:\Program Files\Textbridge\Bin\InstantAccess.exe" 31744 Jun 19 2000 "D:\Program Files\Textbridge\Bin\bak\INSTAN~1.EXE" 430080 Nov 4 2005 "C:\Program Files\Adams Business Forms\Tax Forms Helper 2005\Registration.exe" 22528 Jun 19 2000 "D:\Program Files\Textbridge\Bin\RegisterDropHandler.exe" 22528 Jun 19 2000 "D:\Program Files\Textbridge\Bin\bak\REGIST~1.EXE" end of report Incident Status Location Potentially unwanted tool:application/altnet Not disinfected c:\windows\smdat32a.sys Potentially unwanted tool:application/bestoffer Not disinfected c:\windows\smdat32m.sys Adware:adware/keenvalue Not disinfected c:\program files\common files\SearchUpgrader Adware:adware/savenow Not disinfected Windows Registry Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[.xiti.com/] Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\cookies.txt[.adultfriendfinder.com/] Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\CJ\Cookies\cj@xiti[1].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\CJ\Desktop\ComboFix.exe[nircmd.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\CJ\Desktop\ComboFix.exe[nircmd.cfexe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\CJ\Local Settings\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\Cache\7ED6F4AAd01[nircmd.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\CJ\Local Settings\Application Data\Mozilla\Firefox\Profiles\xrmegb9m.default\Cache\7ED6F4AAd01[nircmd.cfexe] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Kelly\Cookies\kelly@ath.belnk[1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Kelly\Cookies\kelly@atwola[2].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Kelly\Cookies\kelly@belnk[2].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Kelly\Cookies\kelly@dist.belnk[1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Kelly\Cookies\kelly@go[2].txt Dialer:Dialer.Gen Not disinfected C:\PaperPort11\Other\PagisConverter\English\data1.cab[convproc.exe] Spyware:Spyware/BetterInet Not disinfected C:\Program Files\Common Files\SearchUpgrader\system.cfg Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 10:50:04 AM, on 10/18/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\fxredir.exe D:\Program Files\CyberLink\PowerVCRII\Agent.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE C:\Program Files\Logitech\ImageStudio\LogiTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe C:\Program Files\iPod\bin\iPodService.exe D:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\V-Stream\TV88X\C8XRCtl.exe D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe C:\PROGRA~1\Webshots\webshots.scr C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Logitech\ImageStudio\LowLight.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\CJ\Desktop\HiJackThis_v2.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {64634180-B0EA-48B6-82B7-9620D33362C1} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [fxredir] C:\WINDOWS\system32\fxredir.exe O4 - HKLM\..\Run: [Agent] d:\Program Files\CyberLink\PowerVCRII\Agent.exe O4 - HKLM\..\Run: [Remote_Agent] d:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [InstantAccess] d:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\RunServices: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: reminder-ScanSoft Product Registration.lnk = D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech Music Anywhere Settings.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: TV Remote Control.lnk = C:\Program Files\V-Stream\TV88X\C8XRCtl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.whataboutadog.com O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} (Panasonic Network Camera) - http://24.105.203.109:5001/SysCamInst.cab O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab O16 - DPF: {5EF06782-55B2-4DF3-A57A-3FE8F1D2A181} (PPMDForms.Forms) - https://app.advancedmd.com/practicem.../ppmdforms.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094685722291 O16 - DPF: {6A6E7E91-B6EB-46B5-A545-12B8EDDD261E} (AMDSControls50.XGroupCategory) - https://app.advancedmd.com/practicem...controls50.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1184552540251 O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://bmlcam.homeip.net/plugin/client.cab O16 - DPF: {9602B3CE-BC91-417D-B4FD-F6538C2ABB3B} (AMDSWSCheck.WSCheck) - https://app.advancedmd.com/practicem...mdswscheck.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://bmlcam.homeip.net/plugin/h263ctrl.cab O16 - DPF: {B15C3921-CCFA-4403-9E6F-4470839E835E} (Leadtools.XLead) - https://app.advancedmd.com/practicem.../leadtools.cab O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://app.advancedmd.com/practicem...ivexviewer.cab O16 - DPF: {CC99A86F-EA5D-414A-8231-7C3F1B10A644} (AMDSAudio.XAudio) - https://app.advancedmd.com/practicem.../amdsaudio.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://149.43.156.107/activex/AMC.cab O16 - DPF: {EE8CEFA4-1F91-11D4-B31E-00C04F1D37E6} (PPMDVBDownload.XShowReady) - https://app.advancedmd.com/practicem...vbdownload.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O24 - Desktop Component 0: (no name) - http://bmlcam.homeip.net/pic/banner.gif -- End of file - 11425 bytes Last edited by Ried; 10-18-2007 at 09:57 PM. |
|
|
|
|
10-18-2007, 10:10 PM
|
#9 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Just a bit more to take care of.
 From Normal Mode: Run a scan with HijackThis and 'check' the following entries: O2 - BHO: (no name) - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - (no file) O3 - Toolbar: (no name) - {64634180-B0EA-48B6-82B7-9620D33362C1} - (no file) O15 - Trusted Zone: *.whataboutadog.com Click 'Fix Checked' and close HijackThis. -------------------------------------------------------------- Using 'My Computer', navigate to and delete the following files and folder: c:\windows\ smdat32a.sys c:\windows\ smdat32m.sys c:\program files\common files\ SearchUpgrader -------------------------------------------------------------- Run AVG Anti-Spyware with it's updated definitions:(...it's important that all windows must be closed)
----------------------------------------------------------------------- Double-click FindAWF.exe to start the tool.
----------------------------------------------------------------------- Run a new scan with HijackThis and save the log. ----------------------------------------------------------------------- Please include the following in your next reply: AVG A-S results awf.txt New HijackThis log |
|
|
|
|
10-19-2007, 10:06 AM
|
#10 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Okay- ran AVG Anti Spyware overnight last night. Report from that run is attached as is the AWF log and the newest HiJackThis log is below:
Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 9:04:08 AM, on 10/19/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\fxredir.exe D:\Program Files\CyberLink\PowerVCRII\Agent.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe C:\Program Files\iPod\bin\iPodService.exe D:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\V-Stream\TV88X\C8XRCtl.exe D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Logitech\ImageStudio\LowLight.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\CJ\Desktop\fix it logs\HiJackThis_v2.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [fxredir] C:\WINDOWS\system32\fxredir.exe O4 - HKLM\..\Run: [Agent] d:\Program Files\CyberLink\PowerVCRII\Agent.exe O4 - HKLM\..\Run: [Remote_Agent] d:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [InstantAccess] d:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\RunServices: [RegisterDropHandler] d:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: reminder-ScanSoft Product Registration.lnk = D:\Program Files\Textbridge\Bin\Ereg\Remind32.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech Music Anywhere Settings.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: TV Remote Control.lnk = C:\Program Files\V-Stream\TV88X\C8XRCtl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} (Panasonic Network Camera) - http://24.105.203.109:5001/SysCamInst.cab O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab O16 - DPF: {5EF06782-55B2-4DF3-A57A-3FE8F1D2A181} (PPMDForms.Forms) - https://app.advancedmd.com/practicem.../ppmdforms.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094685722291 O16 - DPF: {6A6E7E91-B6EB-46B5-A545-12B8EDDD261E} (AMDSControls50.XGroupCategory) - https://app.advancedmd.com/practicem...controls50.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1184552540251 O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://bmlcam.homeip.net/plugin/client.cab O16 - DPF: {9602B3CE-BC91-417D-B4FD-F6538C2ABB3B} (AMDSWSCheck.WSCheck) - https://app.advancedmd.com/practicem...mdswscheck.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://bmlcam.homeip.net/plugin/h263ctrl.cab O16 - DPF: {B15C3921-CCFA-4403-9E6F-4470839E835E} (Leadtools.XLead) - https://app.advancedmd.com/practicem.../leadtools.cab O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://app.advancedmd.com/practicem...ivexviewer.cab O16 - DPF: {CC99A86F-EA5D-414A-8231-7C3F1B10A644} (AMDSAudio.XAudio) - https://app.advancedmd.com/practicem.../amdsaudio.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://149.43.156.107/activex/AMC.cab O16 - DPF: {EE8CEFA4-1F91-11D4-B31E-00C04F1D37E6} (PPMDVBDownload.XShowReady) - https://app.advancedmd.com/practicem...vbdownload.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O24 - Desktop Component 0: (no name) - http://bmlcam.homeip.net/pic/banner.gif -- End of file - 11276 bytes |
|
|
|
|
10-19-2007, 10:29 AM
|
#11 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Ack--I missed one. My apologies.
We need to repeat a few steps. Reboot into Safe Mode. Double-click FindAWF.exe to start the tool.
Double-click FindAWF.exe to start the tool.
-------------------------------------------------------------- Locate "ResetProtocolDefaults.reg" Right-click and select: Merge (Ok the prompt) -------------------------------------------------------------- Reboot into Normal Mode and please return with the awf.txt |
|
|
|
|
10-19-2007, 11:34 AM
|
#12 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Almost forgot to re-merge the ResetProtocolDefaults...all done. Here is the resulting log from AWF...
Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Fri 10/19/2007 The current time is: 10:12:17.11 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK 09/14/2007 06:38 AM 421,888 avgcc.exe 1 File(s) 421,888 bytes Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK 06/11/2007 02:25 AM 6,731,312 avgas.exe 1 File(s) 6,731,312 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 03/14/2007 03:43 AM 83,608 jusched.exe 1 File(s) 83,608 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 421888 Oct 11 2007 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 421888 Sep 14 2007 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe" 6731312 Jun 11 2007 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" 6731312 Jun 11 2007 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe" 32881 Sep 28 2004 "C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe" 36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" 49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" 36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" 75520 Dec 15 2006 "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" 36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" 83608 Mar 14 2007 "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" 83608 Mar 14 2007 "C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe" end of report |
|
|
|
|
10-19-2007, 09:09 PM
|
#13 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Looks good.
 Double-click FindAWF.exe to start the tool.
How is the system behaving now? Does AVG Anti Virus update and run properly for you? |
|
|
|
|
10-20-2007, 12:57 PM
|
#14 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Here's the last AWF report. Clean.
Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Sat 10/20/2007 The current time is: 11:51:55.82 bak folders found ~~~~~~~~~~~ Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ end of report AVG is working great and the updates are going through with no problems. The only thing that seems to be "off" is that when I click on a hyperlink in an e-mail or something - IE opens up and then opens up a window entitled "Locate Link Browser". What's up with that? |
|
|
|
|
10-20-2007, 06:36 PM
|
#15 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Launch Internet Explorer>Tools>Internet Options
Click on the Advanced Tab and click 'Restore Advanced Settings'. Click OK. Restart IE. If the problem persists, is it only happening with Outlook Mail? What is your default web browser? |
|
|
|
|
10-21-2007, 12:23 PM
|
#16 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
Hi Ried,
I restored the advanced settings in IE and then rebooted it but any link in Outlook still brought up that "Locate Link Browser" window. Any link inside MS Word brought up an IE window that never connected AND a Firefox window that connected right away. I made Firefox the default and everything worked fine. I made IE the default and everything worked fine (including Outlook). Alls good now - not too sure why, but alls good. Any last tidbits before we close out this thread? |
|
|
|
|
10-21-2007, 05:57 PM
|
#17 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,908
OS: WinXP and Vista
|
Re: New IE windows hang for 3-10 minutes then work great
Glad to hear that worked out, and of course I have some tidbits for you.
You can go ahead and delete FindAwf.exe. Your logs are clean. The following procedure will clear out the tools we've used as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically.
|
|
|
|
|
10-21-2007, 10:10 PM
|
#18 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 10
OS: xp svc pk 2
|
Re: New IE windows hang for 3-10 minutes then work great
SiteAdvisor and SpywareBlaster are in and VERY appreciated (especially SiteAdvisor - I love having that extra information!).
Again, your help has been really appreciated. Thank you SO much. Don't take this wrong, but, I hope I don't ever have to be back here looking for your help again. 
|
|
|
|
| Thread Tools | |
|
|
located at the bottom of the page.
then click 
