What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Web search redirect

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
So are we now just left with the slow browsing issue? Do me a quick favor and run a speedtest on it. I like using http://www.speedtest.net/

Run it on both this PC and your laptop. Compare, and post the results.

Also, do you use any browsers other than IE? If so is it with those as well? How about if you run IE without Add-Ons?

To do that….

Click Start - All Programs - Accessories - System Tools - Internet Explorer (No Add-ons)
Post #17
All right, here's my report.

I used www.speakeasy.net/speedtest and speedtest.net, here they are:

Speakesy.net/speedtest results:

Desktop using IE:
Download Speed: 672 kbps (84 KB/sec transfer rate)
Upload Speed: 302 kbps (37.8 KB/sec transfer rate)


Desktop using Firefox:
Ran it once and got:
Download Speed: 1056 kbps (132 KB/sec transfer rate)
Upload Speed: 321 kbps (40.1 KB/sec transfer rate)

Then I ran it several more times to make sure it wasn't a fluke and I got results that were similar to:
Download Speed: 698 kbps (87.3 KB/sec transfer rate)
Upload Speed: 316 kbps (39.5 KB/sec transfer rate)

I concluded that the first run was a fluke, as I could never replicate it again.


Laptop using IE: 1319 DL, 323 UL
laptop using FF: 1306 DL, 324 UL




speedtest.net results:

Desktop using IE: 414 kbps DL, 312 UL
Desktop using FF: 583 DL, 308 UL


laptop using IE: 1291 UL, 304 DL
laptop using FF: 1303 UL, 315 DL



the strange thing about all of this is that when I notice it most when i'm trying to download files. For example, podiobooks from podiobooks.com. They're pretty large files usually (25+mb). When I try to download them in IE I usually start out at around 100kb/s for a second, then I drop to 70-60-50-45-36-30-40 and it sometimes stabilizes in the 30-40 range but usually is around 15-20. I used to get 100+ fairly regulalry.

When I do the same thing in FF, the download starts slower (30kb/s) then builds up to stabilize around 60-75 or so - still slower than I Was used to seeing.


The laptop downloads these files at roughly 160-200 kb/sec in both IE and FF.



Thanks.

-matt
Post #18
Hmm….so you're on DSL?

One thing I just noticed looking back through your logs is you have a couple of ports that are open globally.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:nfr
"7070:TCP"= 7070:TCP:nfr

They are not normally opened like this. Not sure if one of your games/programs set that, or if it's something you set. Probably not a good idea for security reasons, and may have something to do with what's going on here. We can close those off with a combofix script. I assume you still have combofix? If not then you will just need to download it to your desktop again.

1. Open Notepad

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"=-
"7070:TCP"=-


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #19
All right, here they are. And thanks for all the continued help, I really appreciate it.




HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:45 PM, on 3/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Creative\Shared Files\CTAudSvc.exe
F:\program files\powerstrip\pstrip.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\WINDOWS\SYSTEM32\CTXFISPI.EXE
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\ATKKBService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Audacity\audacity.exe
F:\WINDOWS\system32\notepad.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX6000] F:\WINDOWS\vVX6000.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EA Core] F:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1224074379171
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - F:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 8365 bytes





COMBOFIX Log:

ComboFix 09-03-06.02 - Matt 2009-03-09 22:43:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1590 [GMT -4:00]
Running from: f:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: f:\documents and settings\Matt\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090309-0] *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-02-10 to 2009-03-10 )))))))))))))))))))))))))))))))
.

2009-03-07 01:31 . 2009-03-07 01:43 d——– f:\documents and settings\Matt\DoctorWeb
2009-03-06 17:30 . 2009-03-06 17:30 410,984 –a—— f:\windows\system32\deploytk.dll
2009-03-06 17:30 . 2009-03-06 17:30 73,728 –a—— f:\windows\system32\javacpl.cpl
2009-03-06 16:40 . 2009-03-06 18:03 d——– f:\program files\QuickTime
2009-03-06 16:40 . 2009-03-06 17:47 d——– f:\program files\iTunes
2009-03-06 16:40 . 2009-03-06 17:47 d——– f:\program files\iPod
2009-03-06 16:40 . 2009-03-06 16:40 d——– f:\program files\Bonjour
2009-03-06 16:40 . 2009-03-06 16:40 d——– f:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-06 11:47 . 2009-03-06 11:47 d——– f:\program files\Alwil Software
2009-03-05 02:20 . 2009-03-06 16:39 d–hs—- F:\RECYCLER(2)
2009-02-27 01:09 . 2009-02-27 01:09 d——– f:\program files\Trend Micro
2009-02-27 00:24 . 2009-03-07 02:18 d——– f:\program files\Audacity
2009-02-27 00:08 . 2009-02-27 00:08 d——– f:\program files\Lavasoft
2009-02-27 00:08 . 2009-03-06 16:40 d——– f:\documents and settings\All Users\Application Data\Lavasoft
2009-02-27 00:08 . 2009-03-06 16:40 d—-c— f:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-26 23:58 . 2009-02-26 23:58 0 –a—— f:\windows\system32\drivers\nfr.dll.gpref
2009-02-25 22:36 . 2009-02-25 22:36 d——– f:\program files\MSECache
2009-02-24 17:18 . 2009-01-09 15:19 1,089,593 —–c— f:\windows\system32\dllcache\ntprint.cat
2009-02-22 13:08 . 2009-03-06 16:40 d——– f:\program files\iTunes(2)
2009-02-22 13:08 . 2009-03-06 16:40 d——– f:\program files\iPod(2)
2009-02-22 13:07 . 2009-03-06 16:40 d——– f:\program files\QuickTime(2)
2009-02-22 12:57 . 2009-03-06 16:40 d——– f:\program files\Bonjour(2)
2009-02-18 22:51 . 2009-02-18 22:51 d——– f:\program files\Common Files\AVSMedia
2009-02-18 22:51 . 2009-03-06 16:40 d——– f:\program files\AVS4YOU
2009-02-18 22:37 . 2009-03-06 16:40 d——– f:\program files\DIKO
2009-02-16 23:16 . 2009-03-06 16:40 d——– f:\program files\Google
2009-02-16 23:05 . 2009-03-06 16:40 d——– f:\documents and settings\Matt\.maptool
2009-02-16 23:04 . 2009-02-16 23:04 d——– f:\program files\Java
2009-02-16 22:58 . 2009-03-06 16:40 d——– f:\program files\RPGTools
2009-02-11 23:48 . 2009-03-06 16:41 d——– f:\program files\OpenRPG
2009-02-11 23:47 . 2009-03-06 16:41 d——– F:\Python25

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-08 21:51 196,608 —-a-w f:\windows\system32\drivers\nVivid.bin
2009-03-06 22:07 ——— d—–w f:\program files\Malwarebytes' Anti-Malware
2009-03-06 20:41 ——— d—–w f:\program files\SUPERAntiSpyware
2009-03-06 20:40 ——— d—–w f:\program files\Microsoft LifeCam
2009-03-06 20:40 ——— d—–w f:\program files\Common Files\Apple
2009-03-06 15:20 ——— d—–w f:\documents and settings\Matt\Application Data\SUPERAntiSpyware.com
2009-03-06 15:19 ——— d—–w f:\program files\Common Files\Wise Installation Wizard
2009-02-11 15:19 38,496 —-a-w f:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 15:19 15,504 —-a-w f:\windows\system32\drivers\mbam.sys
2009-02-05 05:10 ——— d—–w f:\program files\World of Warcraft
2009-02-04 23:35 ——— d—–w f:\program files\Common Files\L&H
2009-02-04 01:05 ——— d–h–w f:\program files\InstallShield Installation Information
2009-02-04 01:05 ——— d—–w f:\program files\eBay
2009-01-29 04:47 138,464 —-a-w f:\windows\system32\drivers\PnkBstrK.sys
2009-01-29 04:47 111,928 —-a-w f:\windows\system32\PnkBstrB.exe
2009-01-25 21:34 ——— d—–w f:\documents and settings\Matt\Application Data\Media Player Classic
2009-01-25 21:22 ——— d—–w f:\program files\Combined Community Codec Pack
2009-01-23 01:45 ——— d—–w f:\documents and settings\Matt\Application Data\Apple Computer
2009-01-05 05:18 444,952 —-a-w f:\windows\system32\wrap_oal.dll
2009-01-05 05:18 109,080 —-a-w f:\windows\system32\OpenAL32.dll
2009-01-04 18:19 22,328 —-a-w f:\documents and settings\Matt\Application Data\PnkBstrK.sys
2009-01-04 18:18 682,280 —-a-w f:\windows\system32\pbsvc.exe
2009-01-04 18:18 66,872 —-a-w f:\windows\system32\PnkBstrA.exe
2008-12-20 23:15 826,368 —-a-w f:\windows\system32\wininet.dll
2008-12-17 05:23 53,983 —-a-w F:\MGlogs.zip
2008-12-17 05:13 1,312,755 —-a-w F:\MGtools.exe
2008-10-17 00:04 32,768 –sha-w f:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008101620081017\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="f:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"MSMSGS"="f:\program files\Messenger\msmsgs.exe" [2008-06-02 1660952]
"ctfmon.exe"="f:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"EA Core"="f:\program files\Electronic Arts\EADM\Core.exe" [2008-06-13 2752512]
"SUPERAntiSpyware"="f:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-07-09 1150976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"CTDVDDET"="f:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"RCSystem"="f:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]
"AudioDrvEmulator"="f:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]
"VolPanel"="f:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 122880]
"UpdReg"="f:\windows\UpdReg.EXE" [2000-05-11 90112]
"QuickTime Task"="f:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="f:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"LifeCam"="f:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX6000"="f:\windows\vVX6000.exe" [2007-04-10 996712]
"NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"ASUSGamerOSD"="f:\program files\ASUS\GamerOSD\GamerOSD.exe" [2008-05-28 380928]
"PowerStrip"="f:\program files\powerstrip\pstrip.exe" [2008-11-19 737312]
"SunJavaUpdateSched"="f:\program files\Java\jre6\bin\jusched.exe" [2009-03-06 148888]
"avast!"="f:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"nwiz"="nwiz.exe" [2008-11-12 f:\windows\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2005-08-07 f:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-10-08 f:\windows\system32\Ctxfihlp.exe]
"NWEReboot"="" [BU]

f:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - f:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "f:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 15:56 352256 f:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
"vidc.ffds"= f:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"f:\\Program Files\\Messenger\\Msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"f:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"f:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"f:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"f:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"f:\\Program Files\\ASUS\\GamerOSD\\SBS.exe"=
"f:\\WINDOWS\\system32\\PnkBstrA.exe"=
"f:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"f:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;f:\windows\system32\drivers\aswSP.sys [2009-03-06 114768]
R1 SASDIFSV;SASDIFSV;f:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;f:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-04 55024]
R2 aswFsBlk;aswFsBlk;f:\windows\system32\drivers\aswFsBlk.sys [2009-03-06 20560]
R2 PStrip;PStrip;f:\windows\system32\drivers\pstrip.sys [2007-07-14 27992]
R3 CT20XUT.SYS;CT20XUT.SYS;f:\windows\system32\drivers\CT20XUT.sys [2008-10-08 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;f:\windows\system32\drivers\CTEXFIFX.sys [2008-10-08 1324056]
R3 SASENUM;SASENUM;f:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;f:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-01-05 79360]
S3 CT20XUT;CT20XUT;f:\windows\system32\drivers\CT20XUT.sys [2008-10-08 171032]
S3 CTEXFIFX;CTEXFIFX;f:\windows\system32\drivers\CTEXFIFX.sys [2008-10-08 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;f:\windows\system32\drivers\CTHWIUT.sys [2008-10-08 72728]
S3 CTHWIUT;CTHWIUT;f:\windows\system32\drivers\CTHWIUT.sys [2008-10-08 72728]
S3 VX6000;Microsoft LifeCam VX-6000;f:\windows\system32\drivers\VX6000Xp.sys [2008-11-12 2385896]
.
Contents of the 'Scheduled Tasks' folder

2009-03-06 f:\windows\Tasks\Ad-Aware Update (Weekly).job
- f:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - f:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\o3w1sgg7.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-09 22:46:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(516)
f:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-03-09 22:46:59
ComboFix-quarantined-files.txt 2009-03-10 02:46:57
ComboFix2.txt 2009-03-05 03:52:12
ComboFix3.txt 2008-12-17 05:07:22

Pre-Run: 163,287,801,856 bytes free
Post-Run: 163,752,759,296 bytes free

182 — E O F — 2009-03-06 21:57:30
Post #20
I'm currently attempting to download a file and, while it starts north of 100 kbps, it has no dropped down to the 40-50 range and seems to be stabilized there. Not terrible, but not what it once was. thanks, -matt
Post #23
Good news (sortof). I reconnected my ethernet cable and downloading the same file i'm getting 140-170kbps download speed, much more akin to what I was seeing, and that's while running Microsoft's online Malicious Software Removal Tool. So it's got to be something specific to the wireless adaptor on my desktop, no? I just can't seem to figure out what it is.
Post #24
Ahh…I assumed I guess since it was a desktop that you were wired. My bad. Could be??? Make sure you have the latest drivers running for the wireless adapter. If so try re-installing them. If you need help with that I can direct you over to the Windows forums. We do not advise or condone using Bit Torrents, P2P, ect… in the forums here. I know they do have legit. uses, but many times it's not. Thought maybe that it was "stealing" your bandwidth.
Post #25
Sorry for the delay. I forgot to give you cleanup instructions and final words of "wisdom".

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


  • [external image: Posted Image]
The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.

Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTCleanIt to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

In addition to updating and using what you currently have you may want to consider the following:

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install Winpatrol -
Use Winpatrol to take control of your PC and provide another layer of security.
Help file and tutorial can be found Here

Block unwanted parasites with a custom hosts file -
http://www.mvps.org/winhelp2002/hosts.htm

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

I'll leave the thread open a few days in case you have questions or issues.

Regards,
Dave
Post #26
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI