|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-29-2008, 06:03 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Massive Slowdown
Please Note: This is a continuation of this thread.
Recently, I've experienced a massive slowdown of programs running on my computer. Everything has begun taking a ridiculous amount of time to load, to the point that it's even locked up my computer a few times -- like the first time I was typing this thread, for example. On the advice of another forum member (see previous thread), I went through the five steps, ran Pandascan and am reposting here for help. What Pandascan returned, however, was a latent trojan and AVG cleaned out my system last night. This morning, on every reboot (since there have been three so far), AVG is catching a virus it calls Win32/Heur. There are others as well, sometimes, but that one appears to be pretty common. In all, it leads me to believe that these things are respawning when I boot up. Any help would be much appreciated. I've posted my HijackThis log below. Any other logs will be posted upon request. Thanks!  ............................................................. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:38:49 AM, on 7/29/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\svchost.exe C:\Program Files\CursorXP\CursorXP.exe C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\SYSTEM32\astsrv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINNT\System32\HPZipm12.exe C:\WINNT\System32\svchost.exe C:\WINNT\wanmpsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner\Desktop\*\Stuff\HijackThis.exe C:\WINNT\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe O4 - HKCU\..\Run: [Uniblue ProcessQuickLink 2] "C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" /autostart O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Gmail Notifier.lnk = C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O20 - Winlogon Notify: winctrl32 - C:\WINNT\SYSTEM32\WinCtrl32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINNT\SYSTEM32\astsrv.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe O24 - Desktop Component 0: Privacy Protection - (no file) O24 - Desktop Component 1: Facebook | Welcome to Facebook! - http://www.facebook.com/ -- End of file - 5110 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-06-2008, 10:16 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. I need to see fresh logs. Please do the following: Run dss.exe again, but use these instructions(this assumes dss.exe is on your desktop):
|
|
|
|
|
08-06-2008, 10:40 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
Hello, Chemist, and thanks for the reply. Your help is much appreciated.
Fresh logs are as follows from dss, and please find attached extra.txt. Thanks much for your help. ................... Deckard's System Scanner v20071014.68 Run by Owner on 2008-08-06 11:22:57 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2008-08-06 16:23:07 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis (run as Owner.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:27:20 AM, on 8/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\CursorXP\CursorXP.exe C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINNT\SYSTEM32\astsrv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINNT\System32\HPZipm12.exe C:\WINNT\System32\svchost.exe C:\WINNT\wanmpsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Owner\desktop\dss.exe C:\DOCUME~1\Owner\Desktop\0A00~1\Stuff\Owner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe O4 - HKCU\..\Run: [Uniblue ProcessQuickLink 2] "C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" /autostart O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Gmail Notifier.lnk = C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O20 - Winlogon Notify: winctrl32 - C:\WINNT\SYSTEM32\WinCtrl32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINNT\SYSTEM32\astsrv.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe O24 - Desktop Component 0: Privacy Protection - (no file) O24 - Desktop Component 1: Facebook | Welcome to Facebook! - http://www.facebook.com/ -- End of file - 5110 bytes -- File Associations ----------------------------------------------------------- .bat - batfile - DefaultIcon - C:\WINNT\System32\shell32.dll,71 .hlp - hlpfile - DefaultIcon - C:\WINNT\System32\shell32.dll,23 .inf - inffile - DefaultIcon - C:\WINNT\System32\shell32.dll,69 .ini - inifile - DefaultIcon - C:\WINNT\System32\shell32.dll,69 .js - unable to read key .js - unable to read key .txt - txtfile - DefaultIcon - C:\WINNT\System32\shell32.dll,70 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Winpb18 - c:\winnt\system32\drivers\winpb18.sys R2 BCMNTIO - c:\program files\checkit\diagnostics\bcmntio.sys R2 MAPMEM - c:\program files\checkit\diagnostics\mapmem.sys R3 TVICHW32 - c:\winnt\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> S0 PxHelp20 - c:\winnt\system32\drivers\pxhelp20.sys (file missing) S0 Winba02 - c:\winnt\system32\drivers\winba02.sys (file missing) S0 Winch51 - c:\winnt\system32\drivers\winch51.sys (file missing) S0 Wincq54 - c:\winnt\system32\drivers\wincq54.sys (file missing) S0 Wincs63 - c:\winnt\system32\drivers\wincs63.sys (file missing) S0 Wincv74 - c:\winnt\system32\drivers\wincv74.sys (file missing) S0 Wincw67 - c:\winnt\system32\drivers\wincw67.sys (file missing) S0 Winfg60 - c:\winnt\system32\drivers\winfg60.sys (file missing) S0 Winfx34 - c:\winnt\system32\drivers\winfx34.sys (file missing) S0 wingf08 - c:\winnt\system32\drivers\wingf08.sys (file missing) S0 Wingk66 - c:\winnt\system32\drivers\wingk66.sys (file missing) S0 Wingv10 - c:\winnt\system32\drivers\wingv10.sys (file missing) S0 Winhh18 - c:\winnt\system32\drivers\winhh18.sys (file missing) S0 Winib65 - c:\winnt\system32\drivers\winib65.sys (file missing) S0 Winie66 - c:\winnt\system32\drivers\winie66.sys (file missing) S0 Winig38 - c:\winnt\system32\drivers\winig38.sys (file missing) S0 Winil75 - c:\winnt\system32\drivers\winil75.sys (file missing) S0 Winin35 - c:\winnt\system32\drivers\winin35.sys (file missing) S0 Winiy06 - c:\winnt\system32\drivers\winiy06.sys (file missing) S0 Winlo18 - c:\winnt\system32\drivers\winlo18.sys (file missing) S0 Winlv24 - c:\winnt\system32\drivers\winlv24.sys (file missing) S0 winmd23 - c:\winnt\system32\drivers\winmd23.sys (file missing) S0 Winme11 - c:\winnt\system32\drivers\winme11.sys (file missing) S0 Winmt78 - c:\winnt\system32\drivers\winmt78.sys (file missing) S0 Winoo74 - c:\winnt\system32\drivers\winoo74.sys (file missing) S0 Winpd32 - c:\winnt\system32\drivers\winpd32.sys (file missing) S0 Winpk78 - c:\winnt\system32\drivers\winpk78.sys (file missing) S0 Winpq65 - c:\winnt\system32\drivers\winpq65.sys (file missing) S0 Winqp85 - c:\winnt\system32\drivers\winqp85.sys (file missing) S0 Winsa65 - c:\winnt\system32\drivers\winsa65.sys (file missing) S0 Wintn66 - c:\winnt\system32\drivers\wintn66.sys (file missing) S0 Winuf71 - c:\winnt\system32\drivers\winuf71.sys (file missing) S0 Winvd14 - c:\winnt\system32\drivers\winvd14.sys (file missing) S0 Winwo16 - c:\winnt\system32\drivers\winwo16.sys (file missing) S0 Winwr23 - c:\winnt\system32\drivers\winwr23.sys (file missing) S0 Winxf38 - c:\winnt\system32\drivers\winxf38.sys (file missing) S0 Winxl02 - c:\winnt\system32\drivers\winxl02.sys (file missing) S0 Winxy73 - c:\winnt\system32\drivers\winxy73.sys (file missing) S0 Winyk55 - c:\winnt\system32\drivers\winyk55.sys (file missing) S1 jwzpqng - c:\winnt\system32\jwzpqng.sys S3 EagleNT - c:\winnt\system32\drivers\eaglent.sys (file missing) S3 kbeepm - c:\docume~1\owner\locals~1\temp\kbeepm.sys (file missing) S3 Pfc (Padus ASPI Shell) - c:\winnt\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 astcc (AST Service) - c:\winnt\system32\astsrv.exe <Not Verified; Nalpeiron Ltd.; Nalpeiron License Management> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> S2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > S4 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing) S4 LiveUpdate Notice Ex (LiveUpdate Notice Service Ex) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Process Modules ------------------------------------------------------------- C:\WINNT\system32\winlogon.exe (pid 660) 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-08-06 11:06:58 16896 --a------ C:\WINNT\system32\WinCtrl32.dll C:\WINNT\system32\svchost.exe (pid 888) 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> C:\WINNT\system32\svchost.exe (pid 1032) 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-07-24 15:17:08 147456 --a------ C:\Program Files\Bonjour\mdnsNSP.dll <Not Verified; Apple Inc.; Bonjour> C:\WINNT\explorer.exe (pid 1540) 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2005-01-19 17:34:24 14848 --a------ C:\Program Files\CursorXP\CurXP0.dll <Not Verified; ; Stardock CursorXP> C:\WINNT\system32\svchost.exe (pid 1616) 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> C:\WINNT\system32\svchost.exe (pid 464) 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> -- Scheduled Tasks ------------------------------------------------------------- 2008-07-14 15:06:44 284 --a------ C:\WINNT\Tasks\AppleSoftwareUpdate.job 2008-06-06 17:23:15 376 --a------ C:\WINNT\Tasks\1-Click Maintenance.job -- Files created between 2008-07-06 and 2008-08-06 ----------------------------- 2008-08-06 11:13:42 23600 --a------ C:\WINNT\system32\drivers\TVICHW32.SYS <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> 2008-08-05 12:46:58 16896 --a------ C:\WINNT\system32\WinCtrl32.dll 2008-07-30 14:44:31 0 d-------- C:\Documents and Settings\Default User\Application Data\Macromedia 2008-07-28 09:56:36 0 d-------- C:\Program Files\SpywareBlaster 2008-07-28 09:56:16 0 d-------- C:\ie-spyad_zo 2008-07-27 14:11:07 0 d--hs---- C:\Documents and Settings\Owner\Recent 2008-07-25 06:42:36 0 d-------- C:\Program Files\CCleaner 2008-07-25 06:05:37 0 --a------ C:\Documents and Settings\Owner\tasklist 2008-07-24 18:06:29 0 d-------- C:\!KillBox 2008-07-11 12:52:11 0 d-------- C:\Program Files\Linksys EasyLink Advisor 2008-07-10 16:09:04 0 d-------- C:\Program Files\Netflix 2008-07-08 17:25:46 0 d-------- C:\Documents and Settings\Default User\Application Data\Gtek 2008-07-08 17:25:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Gtek 2008-07-07 23:28:38 57344 --a------ C:\WINNT\system32\ASTSRV.EXE <Not Verified; Nalpeiron Ltd.; Nalpeiron License Management> 2008-07-07 23:28:38 0 d-------- C:\Documents and Settings\Owner\Application Data\onOne Software -- Find3M Report --------------------------------------------------------------- 2008-08-06 11:00:00 0 d-------- C:\Program Files\Mozilla Thunderbird 2008-08-03 15:19:35 0 --a------ C:\Documents and Settings\Owner\Application Data\AVSDVDPlayer.m3u 2008-07-30 14:44:55 0 d-------- C:\Program Files\Google 2008-07-28 09:52:11 0 d-------- C:\Program Files\Get-Torrent 2008-07-28 03:10:53 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-27 13:29:50 664 --a------ C:\WINNT\system32\d3d9caps.dat 2008-07-27 11:54:27 0 d-------- C:\Program Files\Common Files 2008-07-27 11:50:49 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-07-25 23:02:06 0 d-------- C:\Program Files\Trillian 2008-07-25 06:34:06 0 d-------- C:\Program Files\Mozilla Sunbird 2008-07-25 06:29:06 0 d-------- C:\Program Files\Wesnoth 2008-07-23 16:37:48 0 d-------- C:\Documents and Settings\Owner\Application Data\AVGTOOLBAR 2008-07-23 16:21:12 0 d-------- C:\Program Files\Opera 2008-07-21 07:06:30 0 d-------- C:\Program Files\iTunes 2008-07-21 07:05:48 0 d-------- C:\Program Files\iPod 2008-07-16 14:45:46 0 d-------- C:\Program Files\Apple Software Update 2008-07-08 17:25:46 0 d--h----- C:\Documents and Settings\Owner\Application Data\GTek 2008-07-07 12:54:21 0 d-------- C:\Documents and Settings\Owner\Application Data\Mozilla 2008-07-03 10:24:08 0 d-------- C:\Documents and Settings\Owner\Application Data\U3 2008-06-12 08:09:11 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 2 2008-06-12 08:09:08 0 d-------- C:\Program Files\GameSpy Arcade 2008-06-12 08:09:06 0 d-------- C:\Program Files\Microsoft Works 2008-06-12 05:52:16 0 d-------- C:\Program Files\Bonjour 2008-06-12 05:51:37 0 d-------- C:\Program Files\QuickTime 2008-06-11 16:00:35 0 --a------ C:\WINNT\system32\jwzpqng.sys 2008-06-11 15:50:26 0 d-------- C:\Program Files\ToniArts 2008-06-10 15:33:10 0 d-------- C:\Program Files\Common Files\s?mbols 2008-06-10 15:17:13 16305 --ahs---- C:\WINNT\system32\tsvGPqru.ini2 2008-06-10 14:10:04 0 d-------- C:\Program Files\Common Files\F?nts 2008-06-10 13:46:58 0 d-------- C:\Program Files\AVG 2008-06-10 13:31:37 0 d-------- C:\Program Files\Panda Security 2008-06-10 13:19:44 2 --a------ C:\-1137163503 2008-06-10 13:19:21 577536 --a------ C:\WINNT\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-10 13:04:39 0 d-------- C:\Program Files\Windows NT 2008-06-10 13:04:39 0 d-------- C:\Program Files\Movie Maker 2008-06-10 13:04:39 0 d-------- C:\Program Files\Messenger 2008-06-08 18:03:43 0 d-------- C:\Program Files\DivX 2008-06-06 11:47:02 0 d-------- C:\Documents and Settings\Owner\Application Data\TuneUp Software 2008-06-06 10:20:20 0 d-------- C:\Program Files\Common Files\Macromedia 2008-06-06 10:20:11 0 d-------- C:\Program Files\Macromedia 2008-06-06 10:16:17 0 d-------- C:\Documents and Settings\Owner\Application Data\Macromedia 2008-06-06 10:14:45 0 d-------- C:\Program Files\ReadPlease 2003 2008-06-06 10:14:33 0 d-------- C:\Program Files\Rainlendar2 2008-06-04 13:31:20 218624 --a------ C:\WINNT\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [07/25/2008 09:54 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2008 10:51 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/01/2007 08:19 PM] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [01/19/2005 05:34 PM] "Uniblue ProcessQuickLink 2"="C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" [11/02/2007 06:46 PM] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [10/4/2004 2:12:18 AM] Gmail Notifier.lnk - C:\Program Files\Google\Gmail Notifier\gnotify.exe [7/15/2005 4:48:33 PM] Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [5/4/2007 6:37:52 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [10/4/2004 2:12:18 AM] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [1/15/2008 2:27:08 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [5/28/2007 7:16:11 AM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "DisableTaskMgr"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDesktop"=0 (0x0) "NoLowDiskSpaceChecks"=0 (0x0) "NoViewOnDrive"=0 (0x0) "NoFolderOptions"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winctrl32] WinCtrl32.dll 08/06/2008 11:06 AM 16896 C:\WINNT\system32\WinCtrl32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINNT\system32\urqPGvst [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winba02.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winch51.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincq54.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincs63.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincv74.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincw67.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfg60.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfx34.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wingf08.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingk66.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingv10.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winhh18.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winib65.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winie66.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winig38.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winil75.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winin35.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winiy06.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlo18.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlv24.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winmd23.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winme11.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winmt78.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winoo74.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winpb18.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winpd32.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winpk78.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winpq65.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winqp85.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winsa65.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintn66.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winuf71.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvd14.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwo16.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwr23.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxf38.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxl02.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxy73.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winyk55.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a1166b6-4331-11dd-8e7b-00038a000015}] AutoRun\command- E:\LaunchU3.exe -a *Newly Created Service* - TVICHW32 -- End of Deckard's System Scanner: finished at 2008-08-06 11:29:09 ------------ Last edited by AmazingShoelace; 08-06-2008 at 10:42 AM. Reason: Disabled Smilies |
|
|
|
|
08-06-2008, 11:14 AM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Hello again, AmazingShoelace.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folder if it still exists: C:\Program Files\Viewpoint ----------------------------------------------------- Quote:
We suggest uninstalling them via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Please run Deckard's System Scanner again, this time using these instructions(this assumes dss.exe is on your desktop): Click Start >> Run then Copy/Paste the following single-line command into the Run box & click OK "%userprofile%\desktop\dss.exe" /daft
Please download ComboFix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named to your Desktop. Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: daft.txt C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
|
08-06-2008, 02:14 PM
|
#7 (permalink) | |||
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
Well and good, then. That took longer than expected, but all the logs are now acquired. Posted in order requested:
daft.txt C:\ComboFix.txt new HijackThis log .................. daft.txt - (This is what it generated, and if there's something else I should be posting, I don't know what I'm looking for.) Quote:
Combofix.txt Quote:
hijackthis.txt Quote:
|
|||
|
|
|
|
08-06-2008, 07:38 PM
|
#8 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Hello again, AmazingShoelace.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Although listed as disabled, it appears that you have remnants of a previous installation of Norton Internet Worm Protection on your system. Quote:
Uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist: LiveUpdate Notice Symantec KB-DocID:2003093015493306 Please download the Norton Removal Tool and Save it to your Desktop.
Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to install an ActiveX component.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior |
||
|
|
|
|
08-07-2008, 12:31 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
Concerning the Kaspersky Online Scanner, it tells me that my license has expired (though I've never used the program before). I've made it to the point of an online scanner without difficulty.
Are there alternatives I should address at this point? |
|
|
|
|
08-07-2008, 04:07 AM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Try this online scanner instead:
Go here to run an online scannner from ESET. **Note** To optimize scanning time and produce a more sensible report for review:
|
|
|
|
|
08-15-2008, 03:06 PM
|
#13 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Hello again. When you finish those last instructions, please delete dss.exe from your desktop.
Please read >> http://www.techsupportforum.com/secu...r-dss-exe.html |
|
|
|
|
08-15-2008, 10:15 PM
|
#14 (permalink) | |||
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
chemist:
Let's see if I have everything you need. ............................... C:\ComboFix.txt Quote:
ESET report Quote:
new HijackThis log Quote:
report on system behavior Hmmm. Honestly, nothing's really sped up except the computer's startup time, which is commendably fast. Everything else, though, from notepad to Firefox takes literal minutes to decide to open. I don't think I'm running anything particularly system-intensive, and I've got plenty of free space. I've noticed that I'm getting the "windows virtual memory low" alert more often than usual, which leads me to believe that maybe the problem is hardware-based. Maybe the RAM's going out? |
|||
|
|
|
|
08-16-2008, 05:06 AM
|
#15 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Quote:
------------------------------------------------------ Are you sure you carried out the following instructions? Please try again.
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) O4 - HKCU\..\Run: [Uniblue ProcessQuickLink 2] "C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" /autostart Please remember to close all other windows, including browsers then click Fix checked. Click Scan then click Save log and post the new HijackThis log. |
|
|
|
|
|
08-16-2008, 11:58 AM
|
#16 (permalink) | |||
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
Quote:
When it opens normally, I don't see the "memory low" flag at all. That doesn't account for some of the other slowness, certainly, but it seems to be connected with at least a bit of it. And I checked the previous instructions within display properties to make sure nothing has changed. I did it the first time I received the instructions, but it never hurts to check. :) No change. HijackThis log is posted below: Quote:
End of file - 6613 bytes |
|||
|
|
|
|
08-16-2008, 12:57 PM
|
#17 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Did you install FlashGet since my last post?
Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: FlashGet<<Please read here and this ------------------------------------------------------ Please go to: VirusTotal
Open Notepad and copy/paste the entire contents of the quotebox below into Notepad: Quote:
It should look like this:  Double-click on peek.bat & allow it to run. A Notepad file will open. Copy/paste that information into your next reply and then delete peek.bat ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. |
|
|
|
|
|
08-16-2008, 01:16 PM
|
#18 (permalink) | ||||
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
Quote:
 .................... VirusTotal Log Quote:
Peek.bat Log Quote:
HijackThis Log Quote:
|
||||
|
|
|
|
08-16-2008, 01:48 PM
|
#19 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,280
OS: XP SP3
|
Re: Massive Slowdown
Open Notepad and copy/paste the entire contents of the quotebox below into Notepad:
Quote:
It should look like this: Double-click on replace.bat to run it. A Notepad file will open. Copy that information into your next reply, please. You may then delete replace.bat ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. |
|
|
|
|
|
08-16-2008, 01:58 PM
|
#20 (permalink) | ||
|
Registered User
Join Date: Jul 2008
Posts: 17
OS: XP
|
Re: Massive Slowdown
Replace.bat log
Replace.bat couldn't locate the first two file directories it tried to replace. ....................... Quote:
HijackThis Log Quote:
|
||
|
|
|
| Thread Tools | |
|
|
