|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
04-12-2009, 04:58 PM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 8
OS: XP
|
firefox and IE running very slow (100% CPU usage)
My computer has been running extremely slow as of late I had some trojans but got most of them with malwarebytes and adaware. My CPU usage spikes to 100% when running firefox and IE. I wasn't able to run GMER as the scan function was not working. I attached an image so you can see what I mean.
xx DDS (Ver_09-03-16.01) - NTFSx86 Run by tmo at 17:56:47.43 on Sun 04/12/2009 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_03 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1289 [GMT -4:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) FW: McAfee Personal Firewall *enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Creative\Sound Blaster Audigy 2\DVDAudio\CTDVDDET.EXE C:\Program Files\Creative\Sound Blaster Audigy 2\Surround Mixer\CTSysVol.exe C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe C:\Program Files\UltraMon\UltraMon.exe C:\Program Files\Dell AIO Printer A940\dlbabmon.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\WINDOWS\CTHELPER.EXE C:\Program Files\UltraMon\UltraMonTaskbar.exe C:\Program Files\Creative\Feature Mode Utility\CTModUtl.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Feature Mode Utility\CTAPR.exe C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe C:\Program Files\FileOpen\plug_ins\FileOpenAPI.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Documents and Settings\...\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.economist.com/ uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://www.dell4me.com/myway uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway uInternet Settings,ProxyOverride = *.local mSearchAssistant = hxxp://www.google.com/ie uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: {67FAFD9A-208A-4D7B-A243-E76B008E900A} - No File BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll uRun: [Aim6] uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [lrijh8s73jhbfgfd] c:\docume~1\tmo~1\locals~1\temp\winlognn.exe uRun: [tezrtsjhfr84iusjfo84f] c:\docume~1\tmo~1\locals~1\temp\csrssc.exe uRun: [SetDefaultMIDI] MIDIDef.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [<NO NAME>] mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [CTDVDDET] "c:\program files\creative\sound blaster audigy 2\dvdaudio\CTDVDDET.EXE" mRun: [CTSysVol] c:\program files\creative\sound blaster audigy 2\surround mixer\CTSysVol.exe /r mRun: [Dell AIO Printer A940] "c:\program files\dell aio printer a940\dlbabmgr.exe" mRun: [UltraMon] "c:\program files\ultramon\UltraMon.exe" /auto mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_03\bin\jusched.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe mRun: [CTHelper] CTHELPER.EXE mRun: [CTxfiHlp] CTXFIHLP.EXE mRun: [CTFeatureModeUtility] c:\program files\creative\feature mode utility\CTModUtl.exe mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [Launch LCDMon] "c:\program files\common files\logitech\lcd manager\lcdmon.exe" mRun: [Launch LGDCore] "c:\program files\common files\logitech\g-series software\LGDCore.exe" /SHOWHIDE mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe mRun: [SiteAdvisor] c:\program files\siteadvisor\6066\SiteAdv.exe mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto StartupFolder: c:\docume~1\tmo~1\startm~1\programs\startup\fileop~1.lnk - c:\program files\fileopen\plug_ins\FileOpenAPI.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL Trusted Zone: aol.com\free DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {3334504D-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/mpeg4ax.cab DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238979938062 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll Notify: urqQGyww - urqQGyww.dll AppInit_DLLs: sunrmc.dll rofgqd.dll vcdewa.dll jcbiqd.dll vegcjd.dll npotds.dll jtjahc.dll zsdrge.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\tmo~1\applic~1\mozilla\firefox\profiles\fvzaa0rj.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\tmo\application data\mozilla\firefox\profiles\fvzaa0rj.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPMCult3DP.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint_.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - plugin: c:\windows\system32\cult3d\NPMCult3DP.dll FF - HiddenExtension: XUL Cache: {BEF655F6-A259-4278-9B44-0E15C1899D3A} - c:\documents and settings\tmo\local settings\application data\{BEF655F6-A259-4278-9B44-0E15C1899D3A} ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: browser.sessionstore.resume_from_crash - false ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-11 64160] R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-3-19 213640] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-3-19 79304] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-3-19 35272] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-3-19 40552] S1 11be965a;11be965a;c:\windows\system32\drivers\11be965a.sys [2009-1-25 0] S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [2005-9-1 375424] S3 CTMSFSYN;Creative SoundFont Synth;c:\windows\system32\drivers\ctmsfsyn.sys --> c:\windows\system32\drivers\ctmsfsyn.sys [?] S3 EZUSB;EZUSB PC/SC Smart Card Reader;c:\windows\system32\drivers\ezusb.sys [2007-6-19 57356] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-3-19 34216] =============== Created Last 30 ================ 2009-04-12 16:42 <DIR> --d----- c:\program files\Trend Micro 2009-04-12 13:04 <DIR> --d----- c:\windows\LastGood.Tmp 2009-04-12 12:50 <DIR> --d----- c:\windows\system32\scripting 2009-04-12 12:50 <DIR> --d----- c:\windows\l2schemas 2009-04-12 12:50 <DIR> --d----- c:\windows\system32\en 2009-04-12 12:50 <DIR> --d----- c:\windows\system32\bits 2009-04-12 12:45 <DIR> --d----- c:\windows\ServicePackFiles 2009-04-11 19:22 15,688 a------- c:\windows\system32\lsdelete.exe 2009-04-11 17:05 64,160 a------- c:\windows\system32\drivers\Lbd.sys 2009-04-11 17:03 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-04-11 17:02 <DIR> --d----- c:\program files\Lavasoft 2009-04-08 22:16 0 a------- c:\windows\Cjubaku.bin 2009-04-08 22:16 408 a------- c:\windows\Ndawu.dat 2009-04-06 19:45 <DIR> --d----- c:\program files\iTunes 2009-04-06 19:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-06 19:41 <DIR> --d----- c:\program files\Bonjour 2009-04-06 19:33 1,900,544 a------- c:\windows\system32\usbaaplrc.dll 2009-03-29 13:25 51 a------- C:\Netloaded.URL ==================== Find3M ==================== 2009-04-12 12:58 89,947 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-04-06 15:32 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 15:32 15,504 a------- c:\windows\system32\drivers\mbam.sys 2009-03-26 15:23 36,864 a------- c:\windows\system32\drivers\usbaapl.sys 2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys 2009-02-09 07:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys 2009-01-16 21:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll ============= FINISH: 18:00:09.92 =============== Last edited by silverslider09; 04-12-2009 at 05:04 PM. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
04-15-2009, 09:03 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: firefox and IE running very slow (100% CPU usage)
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
04-15-2009, 05:28 PM
|
#3 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 8
OS: XP
|
Re: firefox and IE running very slow (100% CPU usage)
It looks like it got csrssc, winlognn, and lockx. Thanks for you help
ComboFix 09-04-15.08 - tmo 04/15/2009 19:13.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1491 [GMT -4:00] Running from: c:\documents and settings\tmo\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\windows\IE4 Error Log.txt c:\windows\system32\tcjtlyun.ini c:\windows\system32\TDSSnero.dat c:\windows\wiaserviv.log . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_OREANS32 -------\Legacy_TDSSSERV.SYS -------\Service_oreans32 -------\Service_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 ))))))))))))))))))))))))))))))) . 2009-04-15 04:14 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll 2009-04-15 04:14 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe 2009-04-15 04:14 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll 2009-04-15 04:14 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe 2009-04-15 04:14 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll 2009-04-15 04:14 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-15 04:13 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-15 04:13 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll 2009-04-15 04:13 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll 2009-04-15 04:13 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll 2009-04-15 04:11 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll 2009-04-15 04:11 . 2009-03-27 06:58 1203922 ------w c:\windows\system32\dllcache\sysmain.sdb 2009-04-15 04:11 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe 2009-04-15 02:00 . 2009-04-15 02:01 -------- d-----w C:\rsit 2009-04-15 01:11 . 2009-04-15 01:11 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2009-04-15 01:06 . 2009-04-15 01:06 -------- d--h--w c:\documents and settings\Administrator\Application Data\GTek 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Logitech 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Application Data\Realtime Soft 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\scripting 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\l2schemas 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\en 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\bits 2009-04-12 16:45 . 2009-04-12 16:50 -------- d-----w c:\windows\ServicePackFiles 2009-04-11 23:22 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe 2009-04-11 21:05 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys 2009-04-11 21:03 . 2009-04-11 21:03 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-04-11 21:02 . 2009-04-11 21:05 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft 2009-04-09 02:16 . 2009-04-11 14:44 0 ----a-w c:\windows\Cjubaku.bin 2009-04-09 02:16 . 2009-04-09 02:16 -------- d-----w c:\documents and settings\tmo\Local Settings\Application Data\{BEF655F6-A259-4278-9B44-0E15C1899D3A} 2009-04-09 02:16 . 2009-04-11 17:15 408 ----a-w c:\windows\Ndawu.dat 2009-04-06 23:45 . 2009-04-06 23:46 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-06 23:33 . 2009-03-26 19:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll 2009-04-06 00:54 . 2009-04-15 07:27 1374 ----a-w c:\windows\imsins.BAK 2009-03-29 17:25 . 2008-09-08 11:09 51 ----a-w C:\Netloaded.URL 2009-03-23 02:09 . 2009-03-23 02:09 -------- d-----w c:\windows\system32\config\systemprofile\Application Data\SACore 2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-15 07:34 . 2009-04-11 23:47 2684 ----a-w C:\aaw7boot.log 2009-04-15 01:10 . 2005-09-01 16:21 92115 ----a-w c:\windows\system32\nvModes.dat 2009-04-12 20:42 . 2009-04-12 20:42 -------- d-----w c:\program files\Trend Micro 2009-04-12 17:57 . 2009-04-12 17:58 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009041220090413\index.dat 2009-04-12 16:58 . 2004-08-19 21:05 89947 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-12 16:42 . 2004-08-19 20:50 250048 --sha-r C:\ntldr 2009-04-11 21:02 . 2009-04-11 21:02 -------- d-----w c:\program files\Lavasoft 2009-04-11 20:20 . 2007-05-07 04:45 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-04-11 15:11 . 2009-02-01 21:58 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-06 23:46 . 2009-04-06 23:45 -------- d-----w c:\program files\iTunes 2009-04-06 23:45 . 2006-07-14 01:37 -------- d-----w c:\program files\iPod 2009-04-06 23:45 . 2008-07-17 00:43 -------- d-----w c:\program files\Common Files\Apple 2009-04-06 23:41 . 2009-04-06 23:41 -------- d-----w c:\program files\Bonjour 2009-04-06 23:40 . 2005-10-20 22:49 -------- d-----w c:\program files\QuickTime 2009-04-06 23:02 . 2006-03-20 05:55 -------- d-----w c:\documents and settings\Tmo\Application Data\acccore 2009-04-06 19:32 . 2009-02-01 21:58 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 19:32 . 2009-02-01 21:58 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-05 19:06 . 2007-03-20 00:38 -------- d-----w c:\program files\McAfee 2009-03-29 07:26 . 2007-03-20 00:31 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-03-26 19:23 . 2008-07-17 00:46 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys 2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-12 00:27 . 2005-09-01 16:31 -------- d--h--w c:\program files\InstallShield Installation Information 2009-03-12 00:27 . 2007-08-14 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Logitech 2009-03-12 00:27 . 2007-08-14 23:29 -------- d-----w c:\program files\Common Files\Logitech 2009-03-12 00:19 . 2009-03-12 00:19 -------- d-----w c:\program files\Common Files\Logishrd 2009-03-06 14:22 . 2004-08-19 20:49 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2006-05-10 05:25 826368 ----a-w c:\windows\system32\dllcache\wininet.dll 2009-03-03 00:18 . 2004-08-19 20:49 826368 ----a-w c:\windows\system32\wininet.dll 2009-03-02 22:35 . 2007-01-06 17:06 2587 ---ha-w C:\IPH.PH 2009-03-02 22:34 . 2007-01-06 17:07 -------- d-----w c:\program files\AIM6 2009-03-02 22:34 . 2009-03-02 22:34 -------- d-----w c:\program files\Common Files\Software Update Utility 2009-03-02 22:33 . 2009-03-02 22:33 -------- d-----w c:\program files\AIM Toolbar 2009-03-02 22:33 . 2009-03-02 22:33 -------- d-----w c:\documents and settings\All Users\Application Data\AIM Toolbar 2009-03-02 22:33 . 2009-03-02 22:32 -------- d-----w c:\program files\Viewpoint 2009-03-02 22:33 . 2005-09-01 16:41 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-03-02 22:32 . 2009-03-02 22:32 -------- d-----w c:\documents and settings\All Users\Application Data\acccore 2009-03-02 22:28 . 2006-03-20 05:53 -------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads 2009-02-28 04:54 . 2006-10-17 17:04 636072 ------w c:\windows\system32\dllcache\iexplore.exe 2009-02-26 01:11 . 2007-08-14 23:28 -------- d-----w c:\program files\Logitech 2009-02-20 10:20 . 2007-05-09 18:53 13824 ------w c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 10:20 . 2006-11-07 08:26 70656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:14 . 2006-11-07 08:25 161792 ------w c:\windows\system32\dllcache\ieakui.dll 2009-02-09 12:10 . 2004-08-19 20:49 729088 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 12:10 . 2004-08-19 20:49 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 12:10 . 2004-08-19 20:49 714752 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 12:10 . 2004-08-19 20:49 617472 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 11:13 . 2008-10-16 03:17 1846784 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 11:13 . 2004-08-19 20:49 1846784 ----a-w c:\windows\system32\win32k.sys 2009-02-07 23:02 . 2008-10-16 03:17 2066048 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-07 23:02 . 2004-08-04 03:59 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-06 11:11 . 2004-08-19 20:49 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 11:08 . 2008-10-16 03:17 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 11:08 . 2004-08-19 20:49 2189056 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 11:06 . 2008-10-16 03:17 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 10:39 . 2004-08-19 20:49 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 10:32 . 2008-10-16 03:17 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll 2009-02-03 19:59 . 2004-08-19 20:49 56832 ----a-w c:\windows\system32\secur32.dll 2008-11-15 02:19 . 2005-09-29 01:31 103904 ----a-w c:\documents and settings\Tmo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2005-09-09 20:50 . 2005-09-09 20:47 130 ----a-w c:\documents and settings\Tmo\Local Settings\Application Data\fusioncache.dat 2004-08-19 21:16 . 2004-08-19 21:16 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SetDefaultMIDI"="MIDIDef.exe" - c:\windows\MIDIDEF.EXE [2006-08-11 25600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-01 4636672] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "CTDVDDET"="c:\program files\Creative\Sound Blaster Audigy 2\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "CTSysVol"="c:\program files\Creative\Sound Blaster Audigy 2\Surround Mixer\CTSysVol.exe" [2003-09-17 57344] "Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-02-08 86102] "UltraMon"="c:\program files\UltraMon\UltraMon.exe" [2005-05-14 187904] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-07-14 180269] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "CTFeatureModeUtility"="c:\program files\Creative\Feature Mode Utility\CTModUtl.exe" [2005-01-10 81920] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2006-07-19 549376] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136] "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920] "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944] c:\documents and settings\Tmo\Start Menu\Programs\Startup\ FileOpenAPI.exe.lnk - c:\program files\FileOpen\plug_ins\FileOpenAPI.exe [2006-8-28 57344] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 21:08 110592 ----a-w c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec.dll "vidc.SEDG"= SamsungVfWCodec.dll "vidc.DX50"= DivXVfWCodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk backup=c:\windows\pss\Cisco Systems VPN Client.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] 2004-09-13 21:33 155648 ----a-w c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] 2004-06-15 22:34 98304 ------w c:\program files\Creative\MediaSource\Detector\CTDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] 2005-02-23 21:19 53248 ------w c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-04-02 20:11 342312 ----a-w c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 21:45 313472 ----a-r c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2004-12-01 04:05 921600 ----a-w c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\WINDOWS\\system32"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1142834057\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1142834057\\ee\\aim6.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupXu.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\StarNet\\X-Win32 7.1\\xwin32.exe"= "c:\\Program Files\\AIM\\aim.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\WINDOWS\\system32\\javaw.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R1 11be965a;11be965a;c:\windows\System32\drivers\11be965a.sys [2009-01-27 0] R3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\DRIVERS\AngelUsb.sys [2005-02-17 375424] R3 CTMSFSYN;Creative SoundFont Synth; [x] R3 EZUSB;EZUSB PC/SC Smart Card Reader;c:\windows\system32\DRIVERS\ezusb.sys [2004-09-23 57356] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216] S2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2005-06-02 10496] S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys [2005-05-14 3328] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\BPRAutoRun.exe . Contents of the 'Scheduled Tasks' folder 2009-04-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06] 2009-04-15 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] 2009-04-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-20 14:53] 2009-04-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-20 14:53] . - - - - ORPHANS REMOVED - - - - BHO-{67FAFD9A-208A-4D7B-A243-E76B008E900A} - (no file) HKCU-Run-Aim6 - (no file) HKLM-Run-Launch LGDCore - c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe Notify-LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll Notify-urqQGyww - urqQGyww.dll MSConfigStartUp-lrijh8s73jhbfgfd - c:\docume~1\Tmo~1\LOCALS~1\Temp\winlognn.exe MSConfigStartUp-mmtask - c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe MSConfigStartUp-MskAgentexe - c:\program files\McAfee\MSK\MskAgent.exe MSConfigStartUp-tezrtsjhfr84iusjfo84f - c:\docume~1\Tmo~1\LOCALS~1\Temp\csrssc.exe MSConfigStartUp-freestyle - lockx.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.economist.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway uInternet Settings,ProxyOverride = *.local IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 Trusted Zone: aol.com\free FF - ProfilePath - c:\documents and settings\Tmo\Application Data\Mozilla\Firefox\Profiles\fvzaa0rj.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Tmo \Application Data\Mozilla\Firefox\Profiles\fvzaa0rj.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMCult3DP.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - plugin: c:\windows\SYSTEM32\Cult3D\NPMCult3DP.dll ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: browser.sessionstore.resume_from_crash - false . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-15 19:17 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Driver Signing] @Denied: (2) (Administrators) "Policy"=hex:00,00,00,00 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1872) c:\program files\Intel\Wireless\Bin\LgNotify.dll - - - - - - - > 'explorer.exe'(3144) c:\program files\McAfee\SiteAdvisor\saHook.dll c:\program files\UltraMon\RTSUltraMonHook.dll c:\program files\UltraMon\Resources\en\RTSUltraMonHookRes.dll . Completion time: 2009-04-15 19:22 ComboFix-quarantined-files.txt 2009-04-15 23:21 Pre-Run: 19,182,657,536 bytes free Post-Run: 19,156,606,976 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4 325 --- E O F --- 2009-04-15 07:28 Last edited by silverslider09; 04-15-2009 at 05:31 PM. |
|
|
|
|
04-15-2009, 05:44 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: firefox and IE running very slow (100% CPU usage)
Hello silverslider09.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here ------------------------------------------------------ I see you have P2P software ( Ares ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Please download GooredFix and Save it to your Desktop.
------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
File:: c:\windows\Cjubaku.bin c:\windows\Ndawu.dat RegLock:: [HKEY_LOCAL_MACHINE\software\Microsoft\Driver Signing] FixCSet::  Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. ------------------------------------------------------ |
|
|
|
|
04-16-2009, 04:30 PM
|
#5 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 8
OS: XP
|
Re: firefox and IE running very slow (100% CPU usage)
GooredFix v1.92 by jpshortstuff
Log created at 21:03 on 15/04/2009 running Option #1 (Tmo) Firefox version 3.0.8 (en-US) =====Suspect Goored Entries===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{BEF655F6-A259-4278-9B44-0E15C1899D3A}"="C:\Documents and Settings\tmo\Local Settings\Application Data\{BEF655F6-A259-4278-9B44-0E15C1899D3A}" =====Dumping Registry Values===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.8\extensions] "Plugins"="C:\Program Files\Mozilla Firefox\plugins" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.8\extensions] "Components"="C:\Program Files\Mozilla Firefox\components" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{BEF655F6-A259-4278-9B44-0E15C1899D3A}"="C:\Documents and Settings\Tmo\Local Settings\Application Data\{BEF655F6-A259-4278-9B44-0E15C1899D3A}" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{B7082FAA-CB62-4872-9106-E42DD88EDE45}"="C:\Program Files\McAfee\SiteAdvisor" combofix ComboFix 09-04-15.08 - tmo 04/15/2009 22:44.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1484 [GMT -4:00] Running from: c:\documents and settings\Tmo\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Tmo\Desktop\CFScript.txt AV: McAfee VirusScan *On-access scanning enabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point * Resident AV is active FILE :: c:\windows\Cjubaku.bin c:\windows\Ndawu.dat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\windows\Cjubaku.bin c:\windows\Ndawu.dat . ((((((((((((((((((((((((( Files Created from 2009-03-16 to 2009-04-16 ))))))))))))))))))))))))))))))) . 2009-04-15 04:14 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll 2009-04-15 04:14 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe 2009-04-15 04:14 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll 2009-04-15 04:14 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe 2009-04-15 04:14 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll 2009-04-15 04:14 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-15 04:13 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-15 04:13 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll 2009-04-15 04:13 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll 2009-04-15 04:13 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll 2009-04-15 04:11 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll 2009-04-15 04:11 . 2009-03-27 06:58 1203922 ------w c:\windows\system32\dllcache\sysmain.sdb 2009-04-15 04:11 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe 2009-04-15 02:00 . 2009-04-15 02:01 -------- d-----w C:\rsit 2009-04-15 01:11 . 2009-04-15 01:11 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2009-04-15 01:06 . 2009-04-15 01:06 -------- d--h--w c:\documents and settings\Administrator\Application Data\GTek 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Logitech 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Application Data\Realtime Soft 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\scripting 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\l2schemas 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\en 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\bits 2009-04-12 16:45 . 2009-04-12 16:50 -------- d-----w c:\windows\ServicePackFiles 2009-04-11 23:22 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe 2009-04-11 21:05 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys 2009-04-11 21:03 . 2009-04-11 21:03 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-04-11 21:02 . 2009-04-11 21:05 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft 2009-04-09 02:16 . 2009-04-09 02:16 -------- d-----w c:\documents and settings\Tmo \Local Settings\Application Data\{BEF655F6-A259-4278-9B44-0E15C1899D3A} 2009-04-06 23:45 . 2009-04-06 23:46 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-06 23:33 . 2009-03-26 19:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll 2009-04-06 00:54 . 2009-04-15 07:27 1374 ----a-w c:\windows\imsins.BAK 2009-03-29 17:25 . 2008-09-08 11:09 51 ----a-w C:\Netloaded.URL 2009-03-23 02:09 . 2009-03-23 02:09 -------- d-----w c:\windows\system32\config\systemprofile\Application Data\SACore 2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-16 02:51 . 2009-04-11 23:47 3356 ----a-w C:\aaw7boot.log 2009-04-16 01:02 . 2005-09-01 16:41 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-04-15 01:10 . 2005-09-01 16:21 92115 ----a-w c:\windows\system32\nvModes.dat 2009-04-12 20:42 . 2009-04-12 20:42 -------- d-----w c:\program files\Trend Micro 2009-04-12 17:57 . 2009-04-12 17:58 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009041220090413\index.dat 2009-04-12 16:58 . 2004-08-19 21:05 89947 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-12 16:42 . 2004-08-19 20:50 250048 --sha-r C:\ntldr 2009-04-11 21:02 . 2009-04-11 21:02 -------- d-----w c:\program files\Lavasoft 2009-04-11 20:20 . 2007-05-07 04:45 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-04-11 15:11 . 2009-02-01 21:58 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-06 23:46 . 2009-04-06 23:45 -------- d-----w c:\program files\iTunes 2009-04-06 23:45 . 2006-07-14 01:37 -------- d-----w c:\program files\iPod 2009-04-06 23:45 . 2008-07-17 00:43 -------- d-----w c:\program files\Common Files\Apple 2009-04-06 23:41 . 2009-04-06 23:41 -------- d-----w c:\program files\Bonjour 2009-04-06 23:40 . 2005-10-20 22:49 -------- d-----w c:\program files\QuickTime 2009-04-06 23:02 . 2006-03-20 05:55 -------- d-----w c:\documents and settings\Tmo\Application Data\acccore 2009-04-06 19:32 . 2009-02-01 21:58 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 19:32 . 2009-02-01 21:58 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-05 19:06 . 2007-03-20 00:38 -------- d-----w c:\program files\McAfee 2009-03-29 07:26 . 2007-03-20 00:31 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-03-26 19:23 . 2008-07-17 00:46 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys 2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-12 00:27 . 2005-09-01 16:31 -------- d--h--w c:\program files\InstallShield Installation Information 2009-03-12 00:27 . 2007-08-14 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Logitech 2009-03-12 00:27 . 2007-08-14 23:29 -------- d-----w c:\program files\Common Files\Logitech 2009-03-12 00:19 . 2009-03-12 00:19 -------- d-----w c:\program files\Common Files\Logishrd 2009-03-06 14:22 . 2004-08-19 20:49 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2006-05-10 05:25 826368 ----a-w c:\windows\system32\dllcache\wininet.dll 2009-03-03 00:18 . 2004-08-19 20:49 826368 ----a-w c:\windows\system32\wininet.dll 2009-03-02 22:35 . 2007-01-06 17:06 2587 ---ha-w C:\IPH.PH 2009-03-02 22:34 . 2007-01-06 17:07 -------- d-----w c:\program files\AIM6 2009-03-02 22:34 . 2009-03-02 22:34 -------- d-----w c:\program files\Common Files\Software Update Utility 2009-03-02 22:33 . 2009-03-02 22:33 -------- d-----w c:\program files\AIM Toolbar 2009-03-02 22:33 . 2009-03-02 22:33 -------- d-----w c:\documents and settings\All Users\Application Data\AIM Toolbar 2009-03-02 22:32 . 2009-03-02 22:32 -------- d-----w c:\documents and settings\All Users\Application Data\acccore 2009-03-02 22:28 . 2006-03-20 05:53 -------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads 2009-02-28 04:54 . 2006-10-17 17:04 636072 ------w c:\windows\system32\dllcache\iexplore.exe 2009-02-26 01:11 . 2007-08-14 23:28 -------- d-----w c:\program files\Logitech 2009-02-20 10:20 . 2007-05-09 18:53 13824 ------w c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 10:20 . 2006-11-07 08:26 70656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:14 . 2006-11-07 08:25 161792 ------w c:\windows\system32\dllcache\ieakui.dll 2009-02-09 12:10 . 2004-08-19 20:49 729088 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 12:10 . 2004-08-19 20:49 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 12:10 . 2004-08-19 20:49 714752 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 12:10 . 2004-08-19 20:49 617472 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 11:13 . 2008-10-16 03:17 1846784 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 11:13 . 2004-08-19 20:49 1846784 ----a-w c:\windows\system32\win32k.sys 2009-02-07 23:02 . 2008-10-16 03:17 2066048 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-07 23:02 . 2004-08-04 03:59 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-06 11:11 . 2004-08-19 20:49 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 11:08 . 2008-10-16 03:17 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 11:08 . 2004-08-19 20:49 2189056 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 11:06 . 2008-10-16 03:17 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 10:39 . 2004-08-19 20:49 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 10:32 . 2008-10-16 03:17 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll 2009-02-03 19:59 . 2004-08-19 20:49 56832 ----a-w c:\windows\system32\secur32.dll 2008-11-15 02:19 . 2005-09-29 01:31 103904 ----a-w c:\documents and settings\tmo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2005-09-09 20:50 . 2005-09-09 20:47 130 ----a-w c:\documents and settings\Tmo\Local Settings\Application Data\fusioncache.dat 2004-08-19 21:16 . 2004-08-19 21:16 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat . ((((((((((((((((((((((((((((( SnapShot@2009-04-15_23.17.42 ))))))))))))))))))))))))))))))))))))))))) . + 2005-09-09 20:39 . 2009-04-16 00:08 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2005-09-09 20:39 . 2009-04-15 19:23 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2005-09-09 20:39 . 2009-04-16 00:08 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat - 2005-09-09 20:39 . 2009-04-15 19:23 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SetDefaultMIDI"="MIDIDef.exe" - c:\windows\MIDIDEF.EXE [2006-08-11 25600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-01 4636672] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "CTDVDDET"="c:\program files\Creative\Sound Blaster Audigy 2\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "CTSysVol"="c:\program files\Creative\Sound Blaster Audigy 2\Surround Mixer\CTSysVol.exe" [2003-09-17 57344] "Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-02-08 86102] "UltraMon"="c:\program files\UltraMon\UltraMon.exe" [2005-05-14 187904] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-07-14 180269] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "CTFeatureModeUtility"="c:\program files\Creative\Feature Mode Utility\CTModUtl.exe" [2005-01-10 81920] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2006-07-19 549376] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136] "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920] "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944] c:\documents and settings\Tmo\Start Menu\Programs\Startup\ FileOpenAPI.exe.lnk - c:\program files\FileOpen\plug_ins\FileOpenAPI.exe [2006-8-28 57344] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 21:08 110592 ----a-w c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec.dll "vidc.SEDG"= SamsungVfWCodec.dll "vidc.DX50"= DivXVfWCodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk backup=c:\windows\pss\Cisco Systems VPN Client.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] 2004-09-13 21:33 155648 ----a-w c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] 2004-06-15 22:34 98304 ------w c:\program files\Creative\MediaSource\Detector\CTDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] 2005-02-23 21:19 53248 ------w c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-04-02 20:11 342312 ----a-w c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 21:45 313472 ----a-r c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2004-12-01 04:05 921600 ----a-w c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\WINDOWS\\system32"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1142834057\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1142834057\\ee\\aim6.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupXu.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\StarNet\\X-Win32 7.1\\xwin32.exe"= "c:\\Program Files\\AIM\\aim.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\WINDOWS\\system32\\javaw.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R1 11be965a;11be965a;c:\windows\System32\drivers\11be965a.sys [2009-01-27 0] R3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\DRIVERS\AngelUsb.sys [2005-02-17 375424] R3 CTMSFSYN;Creative SoundFont Synth; [x] R3 EZUSB;EZUSB PC/SC Smart Card Reader;c:\windows\system32\DRIVERS\ezusb.sys [2004-09-23 57356] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216] S2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2005-06-02 10496] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys [2005-05-14 3328] --- Other Services/Drivers In Memory --- *Deregistered* - ALG *Deregistered* - Apple Mobile Device *Deregistered* - AudioSrv *Deregistered* - Bonjour Service *Deregistered* - Browser *Deregistered* - COMSysApp *Deregistered* - Creative Service for CDROM Access *Deregistered* - CryptSvc *Deregistered* - CVPND *Deregistered* - DcomLaunch *Deregistered* - Dhcp *Deregistered* - DNE *Deregistered* - Dnscache *Deregistered* - dsunidrv *Deregistered* - ehRecvr *Deregistered* - ehSched *Deregistered* - emupia *Deregistered* - ERSvc *Deregistered* - EventSystem *Deregistered* - EvtEng *Deregistered* - Fastfat *Deregistered* - Fax *Deregistered* - Fips *Deregistered* - FltMgr *Deregistered* - Ftdisk *Deregistered* - Gpc *Deregistered* - ha10kx2k *Deregistered* - hap17v2k *Deregistered* - helpsvc *Deregistered* - HidServ *Deregistered* - HTTP *Deregistered* - i2omgmt *Deregistered* - IntelIde *Deregistered* - IpFilterDriver *Deregistered* - IpNat *Deregistered* - iPod Service *Deregistered* - IPSec *Deregistered* - IWCA *Deregistered* - KSecDD *Deregistered* - lanmanserver *Deregistered* - lanmanworkstation *Deregistered* - Lavasoft Ad-Aware Service *Deregistered* - Lbd *Deregistered* - LexBceS *Deregistered* - LmHosts *Deregistered* - McAfee SiteAdvisor Service *Deregistered* - mcmscsvc *Deregistered* - McNASvc *Deregistered* - McProxy *Deregistered* - McShield *Deregistered* - MCSTRM *Deregistered* - MDM *Deregistered* - mdmxsdk *Deregistered* - mfeavfk *Deregistered* - mfebopk *Deregistered* - mfehidk *Deregistered* - mnmdd *Deregistered* - MountMgr *Deregistered* - MPFP *Deregistered* - MpfService *Deregistered* - MRxDAV *Deregistered* - MRxSmb *Deregistered* - Msfs *Deregistered* - MSK80Service *Deregistered* - mssmbios *Deregistered* - Mup *Deregistered* - NDIS *Deregistered* - NdisTapi *Deregistered* - Ndisuio *Deregistered* - NdisWan *Deregistered* - NDProxy *Deregistered* - NetBIOS *Deregistered* - NetBT *Deregistered* - Netman *Deregistered* - NICCONFIGSVC *Deregistered* - Nla *Deregistered* - Npfs *Deregistered* - Ntfs *Deregistered* - Null *Deregistered* - NVSvc *Deregistered* - omci *Deregistered* - ossrv *Deregistered* - PartMgr *Deregistered* - PfModNT *Deregistered* - PolicyAgent *Deregistered* - PptpMiniport *Deregistered* - ProtectedStorage *Deregistered* - PSched *Deregistered* - RasAcd *Deregistered* - Rasl2tp *Deregistered* - RasMan *Deregistered* - RasPppoe *Deregistered* - Raspti *Deregistered* - Rdbss *Deregistered* - RDPCDD *Deregistered* - rdpdr *Deregistered* - RemoteRegistry *Deregistered* - ROOTMODEM *Deregistered* - RpcSs *Deregistered* - S24EventMonitor *Deregistered* - s24trans *Deregistered* - SamSs *Deregistered* - SCardSvr *Deregistered* - Schedule *Deregistered* - seclogon *Deregistered* - SENS *Deregistered* - SharedAccess *Deregistered* - ShellHWDetection *Deregistered* - Spooler *Deregistered* - sr *Deregistered* - srservice *Deregistered* - Srv *Deregistered* - SSDPSRV *Deregistered* - stisvc *Deregistered* - swenum *Deregistered* - TapiSrv *Deregistered* - Tcpip *Deregistered* - TermDD *Deregistered* - TermService *Deregistered* - Themes *Deregistered* - Tosrfcom *Deregistered* - TrkWks *Deregistered* - UltraMonMirror *Deregistered* - UltraMonUtility *Deregistered* - Update *Deregistered* - VgaSave *Deregistered* - VolSnap *Deregistered* - w32time *Deregistered* - Wanarp *Deregistered* - Wdf01000 *Deregistered* - WebClient *Deregistered* - winmgmt *Deregistered* - WLANKEEPER *Deregistered* - WS2IFSL *Deregistered* - wscsvc *Deregistered* - wuauserv *Deregistered* - WZCSVC [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\BPRAutoRun.exe . Contents of the 'Scheduled Tasks' folder 2009-04-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06] 2009-04-15 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] 2009-04-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-20 14:53] 2009-04-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-20 14:53] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.economist.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway uInternet Settings,ProxyOverride = *.local IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 Trusted Zone: aol.com\free FF - ProfilePath - c:\documents and settings\Tmo\Application Data\Mozilla\Firefox\Profiles\fvzaa0rj.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Tmo\Application Data\Mozilla\Firefox\Profiles\fvzaa0rj.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMCult3DP.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - plugin: c:\windows\SYSTEM32\Cult3D\NPMCult3DP.dll ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: browser.sessionstore.resume_from_crash - false . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-15 23:00 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1916) c:\program files\Intel\Wireless\Bin\LgNotify.dll - - - - - - - > 'explorer.exe'(2720) c:\program files\McAfee\SiteAdvisor\saHook.dll c:\program files\UltraMon\RTSUltraMonHook.dll c:\windows\system32\ctagent.dll c:\program files\UltraMon\Resources\en\RTSUltraMonHookRes.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\windows\system32\scardsvr.exe c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\CTSVCCDA.EXE c:\progra~1\Intel\Wireless\Bin\1XConfig.exe c:\program files\Cisco Systems\VPN Client\cvpnd.exe c:\windows\ehome\ehRecvr.exe c:\windows\ehome\ehSched.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\Common Files\McAfee\MNA\McNASvc.exe c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\McAfee\MPF\MpfSrv.exe c:\program files\McAfee\MSK\msksrver.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\fxssvc.exe c:\progra~1\McAfee.com\Agent\mcagent.exe c:\windows\system32\dllhost.exe c:\windows\system32\wbem\unsecapp.exe c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe c:\windows\ehome\ehmsas.exe c:\program files\Dell AIO Printer A940\dlbabmon.exe c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe c:\program files\Creative\Feature Mode Utility\CTAPR.exe c:\program files\iPod\bin\iPodService.exe c:\program files\UltraMon\UltraMonTaskbar.exe . ************************************************************************** . Completion time: 2009-04-16 23:34 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-16 03:33 ComboFix2.txt 2009-04-15 23:22 Pre-Run: 19,696,898,048 bytes free Post-Run: 19,669,864,448 bytes free 477 --- E O F --- 2009-04-15 07:28 |
|
|
|
|
04-16-2009, 06:32 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: firefox and IE running very slow (100% CPU usage)
Hello again, silverslider09. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Make sure all instances of Firefox are closed at this point. Please double-click GooredFix.exe to run it.
------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: GooredLog.txt Kaspersky report report on system behavior |
|
|
|
|
04-17-2009, 07:45 AM
|
#7 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 8
OS: XP
|
Re: firefox and IE running very slow (100% CPU usage)
Chemist, thank you so much for your help. My machine is running much better after the steps taken, probably better than before I had the viruses. Here are my logs.
GooredFix v1.92 by jpshortstuff Log created at 21:13 on 16/04/2009 running Option #2 tmo) Firefox version 3.0.8 (en-US) =====Goored Deletions===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{BEF655F6-A259-4278-9B44-0E15C1899D3A}"="C:\Documents and Settings\Tmo\Local Settings\Application Data\{BEF655F6-A259-4278-9B44-0E15C1899D3A}" ->Backing up value... Done. ->Deleting value... Done. C:\Documents and Settings\Tmo\Local Settings\Application Data\{BEF655F6-A259-4278-9B44-0E15C1899D3A} ->Backing up folder... Done. ->Emptying folder... Done. ->Deleting folder... Done. =====Dumping Registry Values===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.8\extensions] "Plugins"="C:\Program Files\Mozilla Firefox\plugins" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.8\extensions] "Components"="C:\Program Files\Mozilla Firefox\components" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{B7082FAA-CB62-4872-9106-E42DD88EDE45}"="C:\Program Files\McAfee\SiteAdvisor" *KASPERSKY ONLINE SCANNER 7.0 REPORT* Friday, April 17, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kapersky Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Friday, April 17, 2009 03:50:12 Records in database: 2052138 *Scan settings* Scan using the following database extended Scan archives yes Scan mail databases yes *Scan area* My Computer C:\ D:\ E:\ *Scan statistics* Files scanned 110402 Threat name 0 Infected objects 0 Suspicious objects 0 Duration of the scan 03:50:55 |
|
|
|
|
04-17-2009, 10:30 AM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: firefox and IE running very slow (100% CPU usage)
Hello again, silverslider09.
Click Start > Run and copy/paste the following into the Run box and click OK: "%userprofile%\Desktop\GooredFix.exe" /uninstall If any of your security programs request a new Registry/AutoStart value being added please Allow the changes. ------------------------------------------------------ There seems to be a problem with your WMI. Let's try to fix it. Download CF-querySvc.exe and Save it to your Desktop. Double-click CF-querySvc.exe to run it, then please post the log it produces, sUBs.txt, in your next reply. ------------------------------------------------------ Please download Dial-a-fix and Save it to your Desktop.
|
|
|
|
|
04-17-2009, 11:51 AM
|
#9 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 8
OS: XP
|
Re: firefox and IE running very slow (100% CPU usage)
Here are the logs.
------ REGISTRY: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] - HTTPFilter - HTTPFilter - LocalService - Alerter, WebClient, LmHosts, RemoteRegistry, upnphost, SSDPSRV - NetworkService - DnsCache - DcomLaunch - DcomLaunch, TermService - rpcss - RpcSs - imgsvc - StiSvc - termsvcs - TermService - eapsvcs - eaphost - dot3svc - dot3svc - netsvcs - 6to4, AppMgmt, AudioSrv, Browser, CryptSvc, DMServer, DHCP, ERSvc, EventSystem, FastUserSwitchingCompatibility, HidServ, Ias, Iprip, Irmon, LanmanServer, LanmanWorkstation, Messenger, Netman, Nla, Ntmssvc, NWCWorkstation, Nwsapagent, Rasauto, Rasman, Remoteaccess, Schedule, Seclogon, SENS, Sharedaccess, SRService, Tapisrv, Themes, TrkWks, W32Time, WZCSVC, Wmi, WmdmPmSp, winmgmt, wscsvc, xmlprov, MHN, BITS, wuauserv, ShellHWDetection, helpsvc, WmdmPmSN, napagent, hkmsvc HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\DComLaunch CoInitializeSecurityParam REG_DWORD 1 (0x1) DefaultRpcStackSize REG_DWORD 8 (0x8) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\dot3svc AuthenticationCapabilities REG_DWORD 12320 (0x3020) CoInitializeSecurityParam REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\eapsvcs AuthenticationCapabilities REG_DWORD 12320 (0x3020) CoInitializeSecurityParam REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\HTTPFilter CoInitializeSecurityParam REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService CoInitializeSecurityParam REG_DWORD 1 (0x1) AuthenticationCapabilities REG_DWORD 8192 (0x2000) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs CoInitializeSecurityParam REG_DWORD 1 (0x1) AuthenticationCapabilities REG_DWORD 12320 (0x3020) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\PCHealth CoInitializeSecurityParam REG_DWORD 2 (0x2) AuthenticationCapabilities REG_DWORD 64 (0x40) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs CoInitializeSecurityParam REG_DWORD 1 (0x1) DefaultRpcStackSize REG_DWORD 8 (0x8) HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 ------ SVCHOST SERVICES NOT RUNNING STOPPED: DEMAND_START: AppMgmt : Application Management STOPPED: DEMAND_START: BITS : Background Intelligent Transfer Service STOPPED: DEMAND_START: dmserver : Logical Disk Manager STOPPED: DEMAND_START: Dot3svc : Wired AutoConfig STOPPED: DEMAND_START: EapHost : Extensible Authentication Protocol Service STOPPED: DEMAND_START: FastUserSwitchingCompatibility : Fast User Switching Compatibility STOPPED: DEMAND_START: hkmsvc : Health Key and Certificate Management Service STOPPED: DEMAND_START: MHN : MHN STOPPED: DEMAND_START: napagent : Network Access Protection Agent STOPPED: DEMAND_START: NtmsSvc : Removable Storage STOPPED: DEMAND_START: RasAuto : Remote Access Auto Connection Manager STOPPED: DEMAND_START: upnphost : Universal Plug and Play Device Host STOPPED: DEMAND_START: WmdmPmSN : Portable Media Serial Number Service STOPPED: DEMAND_START: Wmi : Windows Management Instrumentation Driver Extensions STOPPED: DEMAND_START: xmlprov : Network Provisioning Service STOPPED: DISABLED: Alerter : Alerter STOPPED: DISABLED: Messenger : Messenger STOPPED: DISABLED: RemoteAccess : Routing and Remote Access ------ SVCHOST CURRENTLY RUNNING: 160- C:\WINDOWS\system32\svchost -k DcomLaunch - DcomLaunch : DCOM Server Process Launcher - TermService : Terminal Services 252- C:\WINDOWS\system32\svchost -k rpcss - RpcSs : Remote Procedure Call (RPC) 288- C:\WINDOWS\System32\svchost.exe -k netsvcs - AudioSrv : Windows Audio - Browser : Computer Browser - CryptSvc : Cryptographic Services - Dhcp : DHCP Client - ERSvc : Error Reporting Service - EventSystem : COM+ Event System - helpsvc : Help and Support - HidServ : HID Input Service - lanmanserver : Server - lanmanworkstation : Workstation - Netman : Network Connections - Nla : Network Location Awareness (NLA) - RasMan : Remote Access Connection Manager - Schedule : Task Scheduler - seclogon : Secondary Logon - SENS : System Event Notification - SharedAccess : Windows Firewall/Internet Connection Sharing (ICS) - ShellHWDetection : Shell Hardware Detection - srservice : System Restore Service - TapiSrv : Telephony - Themes : Themes - TrkWks : Distributed Link Tracking Client - w32time : Windows Time - winmgmt : Windows Management Instrumentation - wscsvc : Security Center - wuauserv : Automatic Updates - WZCSVC : Wireless Zero Configuration 728- C:\WINDOWS\system32\svchost.exe -k NetworkService - Dnscache : DNS Client 764- C:\WINDOWS\system32\svchost.exe -k LocalService - LmHosts : TCP/IP NetBIOS Helper - RemoteRegistry : Remote Registry - SSDPSRV : SSDP Discovery Service 684- C:\WINDOWS\system32\svchost.exe -k LocalService - WebClient : WebClient 3396- C:\WINDOWS\system32\svchost.exe -k imgsvc - stisvc : Windows Image Acquisition (WIA) 3712- C:\WINDOWS\System32\svchost.exe -k HTTPFilter - HTTPFilter : HTTP SSL ------ SVCHOST SUB-DEPENDENTS SSDPSRV = 1 STOPPED: upnphost: Universal Plug and Play Device Host DMServer = 1 STOPPED: dmadmin: Logical Disk Manager Administrative Service EventSystem = 1 RUNNING: SENS: System Event Notification LanmanServer = 1 RUNNING: Browser: Computer Browser LanmanWorkstation = 5 RUNNING: Browser: Computer Browser STOPPED: Alerter: Alerter STOPPED: Messenger: Messenger STOPPED: Netlogon: Net Logon STOPPED: RpcLocator: Remote Procedure Call (RPC) Locator Netman = 1 RUNNING: SharedAccess: Windows Firewall/Internet Connection Sharing (ICS) Rasman = 1 STOPPED: RasAuto: Remote Access Auto Connection Manager Tapisrv = 3 RUNNING: RasMan: Remote Access Connection Manager STOPPED: Fax: Fax STOPPED: RasAuto: Remote Access Auto Connection Manager winmgmt = 2 RUNNING: SharedAccess: Windows Firewall/Internet Connection Sharing (ICS) RUNNING: wscsvc: Security Center TermService = 1 STOPPED: FastUserSwitchingCompatibility: Fast User Switching Compatibility RpcSs = 63 RUNNING: AudioSrv: Windows Audio RUNNING: COMSysApp: COM+ System Application RUNNING: CryptSvc: Cryptographic Services RUNNING: ehRecvr: Media Center Receiver Service RUNNING: ehSched: Media Center Scheduler Service RUNNING: ERSvc: Error Reporting Service RUNNING: EventSystem: COM+ Event System RUNNING: EvtEng: EvtEng RUNNING: helpsvc: Help and Support RUNNING: HidServ: HID Input Service RUNNING: iPod Service: iPod Service RUNNING: Lavasoft Ad-Aware Service: Lavasoft Ad-Aware Service RUNNING: LexBceS: LexBce Server RUNNING: McAfee SiteAdvisor Service: McAfee SiteAdvisor Service RUNNING: McNASvc: McAfee Network Agent RUNNING: MDM: Machine Debug Manager RUNNING: Netman: Network Connections RUNNING: PolicyAgent: IPSEC Services RUNNING: ProtectedStorage: Protected Storage RUNNING: RasMan: Remote Access Connection Manager RUNNING: RegSrvc: RegSrvc RUNNING: RemoteRegistry: Remote Registry RUNNING: S24EventMonitor: Spectrum24 Event Monitor RUNNING: SamSs: Security Accounts Manager RUNNING: Schedule: Task Scheduler RUNNING: SENS: System Event Notification RUNNING: SharedAccess: Windows Firewall/Internet Connection Sharing (ICS) RUNNING: ShellHWDetection: Shell Hardware Detection RUNNING: Spooler: Print Spooler RUNNING: srservice: System Restore Service RUNNING: stisvc: Windows Image Acquisition (WIA) RUNNING: TapiSrv: Telephony RUNNING: TermService: Terminal Services RUNNING: TrkWks: Distributed Link Tracking Client RUNNING: winmgmt: Windows Management Instrumentation RUNNING: WLANKEEPER: WLANKEEPER RUNNING: wscsvc: Security Center RUNNING: WZCSVC: Wireless Zero Configuration STOPPED: BITS: Background Intelligent Transfer Service STOPPED: CiSvc: Indexing Service STOPPED: dmadmin: Logical Disk Manager Administrative Service STOPPED: dmserver: Logical Disk Manager STOPPED: Dot3svc: Wired AutoConfig STOPPED: EapHost: Extensible Authentication Protocol Service STOPPED: FastUserSwitchingCompatibility: Fast User Switching Compatibility STOPPED: Fax: Fax STOPPED: hkmsvc: Health Key and Certificate Management Service STOPPED: Messenger: Messenger STOPPED: MHN: MHN STOPPED: MSDTC: Distributed Transaction Coordinator STOPPED: MSIServer: Windows Installer STOPPED: napagent: Network Access Protection Agent STOPPED: NtmsSvc: Removable Storage STOPPED: RasAuto: Remote Access Auto Connection Manager STOPPED: RDSessMgr: Remote Desktop Help Session Manager STOPPED: RemoteAccess: Routing and Remote Access STOPPED: RSVP: QoS RSVP STOPPED: SwPrv: MS Software Shadow Copy Provider STOPPED: TlntSvr: Telnet STOPPED: UMWdf: Windows User Mode Driver Framework STOPPED: VSS: Volume Shadow Copy STOPPED: WmiApSrv: WMI Performance Adapter STOPPED: xmlprov: Network Provisioning Service TermService = 1 STOPPED: FastUserSwitchingCompatibility: Fast User Switching Compatibility eaphost = 1 STOPPED: Dot3svc: Wired AutoConfig Dial a fix Notes about this log: 1) "->" denotes an external command being executed, and "-> (number)" indicates the return code from the previous command 2) Not all external command return codes are accurate, or useful 3) Sometimes commands return 0 (no error) even when they fail or crash 4) If an error occurs while registering an object, please send an email to: dial-a-fix@DjLizard.net and include a copy of this log DAF version: v0.60.0.24 --- System info --- OS: Microsoft Windows XP Service Pack 3 IE version: 7.0.5730.11 MPC: 76487-OEM CPU: Intel(R) Pentium(R) M processor 2.13GHz (~800MHz) BIOS: 6/21/2005 Memory (approx): 2047MB Uptime: 4 hour(s) Current directory: C:\Documents and Settings\Tmo\Desktop\Dial-a-fix-v0.60.0.24 --- 4/17/2009 1:46:22 PM -- Dial-a-fix : [v0.60.0.24] -- started 1:46:23 PM | Policy scan started 1:46:23 PM | Policy scan ended - no restrictive policies were found 1:46:49 PM | --- Reset WMI/WBEM --- 1:46:51 PM | Registered: C:\WINDOWS\system32\wbem\cimwin32.dll 1:46:52 PM | Registered: C:\WINDOWS\system32\wbem\CmdEvTgProv.dll 1:46:52 PM | Registered: C:\WINDOWS\system32\wbem\dsprov.dll 1:46:52 PM | Registered: C:\WINDOWS\system32\wbem\esscli.dll 1:46:52 PM | Registered: C:\WINDOWS\system32\wbem\evntrprv.dll 1:46:52 PM | Registered: C:\WINDOWS\system32\wbem\fastprox.dll 1:46:52 PM | Registered: C:\WINDOWS\system32\wbem\fwdprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\krnlprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\mofd.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\msiprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\ncprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\ntevt.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\policman.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\repdrvfs.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\smtpcons.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\stdprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\tmplprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\trnsprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\updprov.dll 1:46:53 PM | Registered: C:\WINDOWS\system32\wbem\viewprov.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemads.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemcntl.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemcons.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemcore.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemdisp.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemess.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemperf.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemprox.dll 1:46:54 PM | Registered: C:\WINDOWS\system32\wbem\wbemsvc.dll 1:48:26 PM | Registered: C:\WINDOWS\system32\wbem\wbemupgd.dll 1:48:28 PM | Registered: C:\WINDOWS\system32\wbem\wmiaprpl.dll 1:48:28 PM | Registered: C:\WINDOWS\system32\wbem\wmicookr.dll 1:48:28 PM | Registered: C:\WINDOWS\system32\wbem\wmidcprv.dll 1:48:28 PM | Registered: C:\WINDOWS\system32\wbem\wmimsg.dll 1:48:28 PM | Registered: C:\WINDOWS\system32\wbem\wmipcima.dll 1:48:28 PM | Registered: C:\WINDOWS\system32\wbem\wmipdskq.dll 1:48:29 PM | Registered: C:\WINDOWS\system32\wbem\wmipiprt.dll 1:48:29 PM | Registered: C:\WINDOWS\system32\wbem\wmiprov.dll 1:48:30 PM | Registered: C:\WINDOWS\system32\wbem\wmipsess.dll 1:48:32 PM | Registered: C:\WINDOWS\system32\wbem\wmisvc.dll 1:48:32 PM | Registered: C:\WINDOWS\system32\wbem\wmitimep.dll 1:48:32 PM | Registered: C:\WINDOWS\system32\wbem\wmiutils.dll 1:48:49 PM | Started WinMgmt service |
|
|
|
|
04-17-2009, 12:29 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: firefox and IE running very slow (100% CPU usage)
Hello again, silverslider09. Good job!
Restart your PC Disable your antivirus. Double-click ComboFix.exe and follow the prompts to run it. IMPORTANT: Please do NOT download a newer version of ComboFix.exe if prompted. Post the ComboFix.txt log in your next reply. Thanks. Dont forget to Re-enable your Antivirus program. ------------------------------------------------------ Last edited by LonnyRJones; 04-17-2009 at 02:31 PM. |
|
|
|
|
04-18-2009, 12:08 PM
|
#11 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 8
OS: XP
|
Re: firefox and IE running very slow (100% CPU usage)
Sorry for the delay.
ComboFix 09-04-15.08 - Tmo 04/18/2009 13:51.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1451 [GMT -4:00] Running from: c:\documents and settings\Tmo\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning enabled* (Updated) FW: McAfee Personal Firewall *enabled* . ((((((((((((((((((((((((( Files Created from 2009-03-18 to 2009-04-18 ))))))))))))))))))))))))))))))) . 2009-04-17 01:48 . 2009-04-17 01:45 73728 ----a-w c:\windows\system32\javacpl.cpl 2009-04-17 01:48 . 2009-04-17 01:45 410984 ----a-w c:\windows\system32\deploytk.dll 2009-04-15 04:14 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll 2009-04-15 04:14 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe 2009-04-15 04:14 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll 2009-04-15 04:14 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe 2009-04-15 04:14 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll 2009-04-15 04:14 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-15 04:13 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-15 04:13 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll 2009-04-15 04:13 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll 2009-04-15 04:13 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll 2009-04-15 04:11 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll 2009-04-15 04:11 . 2009-03-27 06:58 1203922 ------w c:\windows\system32\dllcache\sysmain.sdb 2009-04-15 04:11 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe 2009-04-15 02:00 . 2009-04-15 02:01 -------- d-----w C:\rsit 2009-04-15 01:11 . 2009-04-15 01:11 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2009-04-15 01:06 . 2009-04-15 01:06 -------- d--h--w c:\documents and settings\Administrator\Application Data\GTek 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Logitech 2009-04-15 01:06 . 2009-04-15 01:06 -------- d-----w c:\documents and settings\Administrator\Application Data\Realtime Soft 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\scripting 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\l2schemas 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\en 2009-04-12 16:50 . 2009-04-12 16:50 -------- d-----w c:\windows\system32\bits 2009-04-12 16:45 . 2009-04-12 16:50 -------- d-----w c:\windows\ServicePackFiles 2009-04-11 23:22 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe 2009-04-11 21:05 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys 2009-04-11 21:03 . 2009-04-11 21:03 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-04-11 21:02 . 2009-04-11 21:05 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft 2009-04-06 23:45 . 2009-04-06 23:46 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-06 23:33 . 2009-03-26 19:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll 2009-04-06 00:54 . 2009-04-15 07:27 1374 ----a-w c:\windows\imsins.BAK 2009-03-29 17:25 . 2008-09-08 11:09 51 ----a-w C:\Netloaded.URL 2009-03-23 02:09 . 2009-03-23 02:09 -------- d-----w c:\windows\system32\config\systemprofile\Application Data\SACore 2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-18 17:30 . 2009-04-11 23:47 4924 ----a-w C:\aaw7boot.log 2009-04-17 19:22 . 2008-09-28 23:27 -------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2009-04-17 13:11 . 2007-03-20 00:38 -------- d-----w c:\program files\McAfee 2009-04-17 01:44 . 2005-09-01 16:29 -------- d-----w c:\program files\Java 2009-04-16 01:02 . 2005-09-01 16:41 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-04-15 01:10 . 2005-09-01 16:21 92115 ----a-w c:\windows\system32\nvModes.dat 2009-04-12 20:42 . 2009-04-12 20:42 -------- d-----w c:\program files\Trend Micro 2009-04-12 17:57 . 2009-04-12 17:58 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009041220090413\index.dat 2009-04-12 16:58 . 2004-08-19 21:05 89947 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-12 16:42 . 2004-08-19 20:50 250048 --sha-r C:\ntldr 2009-04-11 21:02 . 2009-04-11 21:02 -------- d-----w c:\program files\Lavasoft 2009-04-11 20:20 . 2007-05-07 04:45 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-04-11 15:11 . 2009-02-01 21:58 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-06 23:46 . 2009-04-06 23:45 -------- d-----w c:\program files\iTunes 2009-04-06 23:45 . 2006-07-14 01:37 -------- d-----w c:\program files\iPod 2009-04-06 23:45 . 2008-07-17 00:43 -------- d-----w c:\program files\Common Files\Apple 2009-04-06 23:41 . 2009-04-06 23:41 -------- d-----w c:\program files\Bonjour 2009-04-06 23:40 . 2005-10-20 22:49 -------- d-----w c:\program files\QuickTime 2009-04-06 23:02 . 2006-03-20 05:55 -------- d-----w c:\documents and settings\Tmo\Application Data\acccore 2009-04-06 19:32 . 2009-02-01 21:58 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 19:32 . 2009-02-01 21:58 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-03-29 07:26 . 2007-03-20 00:31 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-03-26 19:23 . 2008-07-17 00:46 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys 2009-03-25 15:06 . 2007-03-20 00:39 40552 ----a-w c:\windows\system32\drivers\mfesmfk.sys 2009-03-25 15:06 . 2007-03-20 00:39 35272 ----a-w c:\windows\system32\drivers\mfebopk.sys 2009-03-25 15:06 . 2007-03-20 00:39 79880 ----a-w c:\windows\system32\drivers\mfeavfk.sys 2009-03-25 15:06 . 2007-03-20 00:39 214024 ----a-w c:\windows\system32\drivers\mfehidk.sys 2009-03-25 15:05 . 2007-03-20 00:39 34216 ----a-w c:\windows\system32\drivers\mferkdk.sys 2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-12 00:27 . 2005-09-01 16:31 -------- d--h--w c:\program files\InstallShield Installation Information 2009-03-12 00:27 . 2007-08-14 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Logitech 2009-03-12 00:27 . 2007-08-14 23:29 -------- d-----w c:\program files\Common Files\Logitech 2009-03-12 00:19 . 2009-03-12 00:19 -------- d-----w c:\program files\Common Files\Logishrd 2009-03-06 14:22 . 2004-08-19 20:49 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2006-05-10 05:25 826368 ----a-w c:\windows\system32\dllcache\wininet.dll 2009-03-03 00:18 . 2004-08-19 20:49 826368 ----a-w c:\windows\system32\wininet.dll 2009-03-02 22:35 . 2007-01-06 17:06 2587 ---ha-w C:\IPH.PH 2009-03-02 22:34 . 2007-01-06 17:07 -------- d-----w c:\program files\AIM6 2009-03-02 22:34 . 2009-03-02 22:34 -------- d-----w c:\program files\Common Files\Software Update Utility 2009-03-02 22:33 . 2009-03-02 22:33 -------- d-----w c:\program files\AIM Toolbar 2009-03-02 22:33 . 2009-03-02 22:33 -------- d-----w c:\documents and settings\All Users\Application Data\AIM Toolbar 2009-03-02 22:32 . 2009-03-02 22:32 -------- d-----w c:\documents and settings\All Users\Application Data\acccore 2009-03-02 22:28 . 2006-03-20 05:53 -------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads 2009-02-28 04:54 . 2006-10-17 17:04 636072 ------w c:\windows\system32\dllcache\iexplore.exe 2009-02-26 01:11 . 2007-08-14 23:28 -------- d-----w c:\program files\Logitech 2009-02-20 10:20 . 2007-05-09 18:53 13824 ------w c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 10:20 . 2006-11-07 08:26 70656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:14 . 2006-11-07 08:25 161792 ------w c:\windows\system32\dllcache\ieakui.dll 2009-02-09 12:10 . 2004-08-19 20:49 729088 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 12:10 . 2004-08-19 20:49 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 12:10 . 2004-08-19 20:49 714752 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 12:10 . 2004-08-19 20:49 617472 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 11:13 . 2008-10-16 03:17 1846784 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 11:13 . 2004-08-19 20:49 1846784 ----a-w c:\windows\system32\win32k.sys 2009-02-07 23:02 . 2008-10-16 03:17 2066048 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-07 23:02 . 2004-08-04 03:59 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-06 11:11 . 2004-08-19 20:49 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 11:08 . 2008-10-16 03:17 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 11:08 . 2004-08-19 20:49 2189056 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 11:06 . 2008-10-16 03:17 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 10:39 . 2004-08-19 20:49 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 10:32 . 2008-10-16 03:17 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll 2009-02-03 19:59 . 2004-08-19 20:49 56832 ----a-w c:\windows\system32\secur32.dll 2008-11-15 02:19 . 2005-09-29 01:31 103904 ----a-w c:\documents and settings\Tmo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2005-09-09 20:50 . 2005-09-09 20:47 130 ----a-w c:\documents and settings\Tmo\Local Settings\Application Data\fusioncache.dat 2004-08-19 21:16 . 2004-08-19 21:16 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat . ((((((((((((((((((((((((((((( SnapShot@2009-04-15_23.17.42 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-18 17:31 . 2009-04-18 17:31 16384 c:\windows\Temp\Perflib_Perfdata_280.dat - 2004-08-19 20:49 . 2009-04-15 07:40 65446 c:\windows\system32\perfc009.dat + 2004-08-19 20:49 . 2009-04-17 19:22 65446 c:\windows\system32\perfc009.dat + 2007-03-20 00:39 . 2009-03-25 15:06 40552 c:\windows\system32\drivers\mfesmfk.sys - 2007-03-20 00:39 . 2009-01-17 00:04 40552 c:\windows\system32\drivers\mfesmfk.sys - 2007-03-20 00:39 . 2009-01-17 00:03 34216 c:\windows\system32\drivers\mferkdk.sys + 2007-03-20 00:39 . 2009-03-25 15:05 34216 c:\windows\system32\drivers\mferkdk.sys - 2007-03-20 00:39 . 2009-01-17 00:04 35272 c:\windows\system32\drivers\mfebopk.sys + 2007-03-20 00:39 . 2009-03-25 15:06 35272 c:\windows\system32\drivers\mfebopk.sys + 2007-03-20 00:39 . 2009-03-25 15:06 79880 c:\windows\system32\drivers\mfeavfk.sys - 2005-09-09 20:39 . 2009-04-15 19:23 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2005-09-09 20:39 . 2009-04-18 16:18 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2005-09-09 20:39 . 2009-04-15 19:23 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat + 2005-09-09 20:39 . 2009-04-18 16:18 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat + 2004-08-19 20:49 . 2009-04-17 19:22 411142 c:\windows\system32\perfh009.dat - 2004-08-19 20:49 . 2009-04-15 07:40 411142 c:\windows\system32\perfh009.dat + 2009-04-17 01:48 . 2009-04-17 01:45 148888 c:\windows\system32\javaws.exe + 2009-04-17 01:48 . 2009-04-17 01:45 144792 c:\windows\system32\javaw.exe + 2009-04-17 01:48 . 2009-04-17 01:45 144792 c:\windows\system32\java.exe + 2007-03-20 00:39 . 2009-03-25 15:06 214024 c:\windows\system32\drivers\mfehidk.sys + 2009-04-17 01:48 . 2009-04-17 01:45 410984 c:\windows\system32\deploytk.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SetDefaultMIDI"="MIDIDef.exe" - c:\windows\MIDIDEF.EXE [2006-08-11 25600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-01 4636672] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "CTDVDDET"="c:\program files\Creative\Sound Blaster Audigy 2\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "CTSysVol"="c:\program files\Creative\Sound Blaster Audigy 2\Surround Mixer\CTSysVol.exe" [2003-09-17 57344] "Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-02-08 86102] "UltraMon"="c:\program files\UltraMon\UltraMon.exe" [2005-05-14 187904] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-07-14 180269] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "CTFeatureModeUtility"="c:\program files\Creative\Feature Mode Utility\CTModUtl.exe" [2005-01-10 81920] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2006-07-19 549376] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-17 148888] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136] "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920] "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944] c:\documents and settings\Tmo\Start Menu\Programs\Startup\ FileOpenAPI.exe.lnk - c:\program files\FileOpen\plug_ins\FileOpenAPI.exe [2006-8-28 57344] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 21:08 110592 ----a-w c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec.dll "vidc.SEDG"= SamsungVfWCodec.dll "vidc.DX50"= DivXVfWCodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk backup=c:\windows\pss\Cisco Systems VPN Client.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] 2004-09-13 21:33 155648 ----a-w c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] 2004-06-15 22:34 98304 ------w c:\program files\Creative\MediaSource\Detector\CTDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] 2005-02-23 21:19 53248 ------w c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-04-02 20:11 342312 ----a-w c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 21:45 313472 ----a-r c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2004-12-01 04:05 921600 ----a-w c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\WINDOWS\\system32"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1142834057\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1142834057\\ee\\aim6.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupXu.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\StarNet\\X-Win32 7.1\\xwin32.exe"= "c:\\Program Files\\AIM\\aim.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\WINDOWS\\system32\\javaw.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R1 11be965a;11be965a;c:\windows\System32\drivers\11be965a.sys [2009-01-27 0] R3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\DRIVERS\AngelUsb.sys [2005-02-17 375424] R3 CTMSFSYN;Creative SoundFont Synth; [x] R3 EZUSB;EZUSB PC/SC Smart Card Reader;c:\windows\system32\DRIVERS\ezusb.sys [2004-09-23 57356] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216] S2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2005-06-02 10496] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys [2005-05-14 3328] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\BPRAutoRun.exe . Contents of the 'Scheduled Tasks' folder 2009-04-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06] 2009-04-15 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] 2009-04-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-20 14:53] 2009-04-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-20 14:53] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.economist.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway uInternet Settings,ProxyOverride = *.local IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 Trusted Zone: aol.com\free FF - ProfilePath - c:\documents and settings\Tmo\Application Data\Mozilla\Firefox\Profiles\fvzaa0rj.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Tmo\Application Data\Mozilla\Firefox\Profiles\fvzaa0rj.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMCult3DP.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - plugin: c:\windows\SYSTEM32\Cult3D\NPMCult3DP.dll ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: browser.sessionstore.resume_from_crash - false . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-18 13:56 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1872) c:\program files\Intel\Wireless\Bin\LgNotify.dll - - - - - - - > 'explorer.exe'(808) c:\program files\McAfee\SiteAdvisor\saHook.dll c:\program files\UltraMon\RTSUltraMonHook.dll c:\program files\UltraMon\Resources\en\RTSUltraMonHookRes.dll . Completion time: 2009-04-18 14:00 ComboFix-quarantined-files.txt 2009-04-18 17:59 ComboFix2.txt 2009-04-15 23:22 Pre-Run: 19,729,412,096 bytes free Post-Run: 19,793,776,640 bytes free 311 --- E O F --- 2009-04-15 07:28 |
|
|
|
|
04-18-2009, 12:27 PM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: firefox and IE running very slow (100% CPU usage)
Congratulations. Well done! Your logs appear clean. You should be good to go.
Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Click Start > Run and copy/paste the following into the Run box and click OK: "%userprofile%\Desktop\GooredFix.exe" /uninstall If any of your security programs request a new Registry/AutoStart value being added please Allow the changes. ------------------------------------------------------ Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. Last edited by chemist; 04-18-2009 at 12:28 PM. |
|
|
|
| Thread Tools | |
|
|
