What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] computer running slow

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My girlfriend's mother's computer is running real slow. It takes for ever for a screen to pop up. I don't know what is wrong with it. Sometimes it will redirect to other websites. I am using my computer to get this started.
You guys have helped me out in the past. So I am asking for help with her computer.

Thanks in advance.

Here is her HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:49 PM, on 6/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Bellsouth\HelpCenter\bin\sprtcmd.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\cleanmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://timesfreepress.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Gamevance - {0ED403E8-470A-4a8a-85A4-D7688CFE39A3} - C:\Program Files\Gamevance\gamevancelib32.dll (file missing)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: NetAssistantBHO - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\My.Freeze.com Toolbar\NetAssistant.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: (no name) - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: My.Freeze.com Toolbar - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O4 - HKLM\..\Run: [BellSouthAlertManager.exe] "C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HelpCenter] C:\Program Files\Bellsouth\HelpCenter\bin\sprtcmd.exe /P HelpCenter
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NielsenOnline] C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Fmucogutage] rundll32.exe "C:\WINDOWS\Bqusubemob.dll",e
O4 - HKLM\..\Run: [Byeganalepeti] rundll32.exe "C:\WINDOWS\Llivexetedabe.dat",e
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegTool] C:\Program Files\RegTool\RegTool.exe -boot
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZUxdm265YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1173847261079
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Google Update Service (gupdate1c9d1915648b360) (gupdate1c9d1915648b360) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

–
End of file - 7284 bytes
Post #2
Hi,

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #3
Thanks for the fast reply. I ran combofix and it started then the computer locked up. I had to restart the computer. It never gave me a log. What can I do now. Thanks again.
Post #4
Look for the log at C:\ComboFix - there should be one in the folder - called ComboFix.txt. (use window explorer to search for the file - windows key +E)

If you cannot locate one, go into safe mode (with networking), run ComboFix again - ALLOW it to update if it requests to do so.



to get into safe mode:
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account
Post #5
I found the log. Sorry about that. Here it is.

ComboFix 09-06-29.02 - Marilyn 06/29/2009 22:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.126.13 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Starware349
c:\documents and settings\All Users\Application Data\Starware349\buttons\ebaykeyword.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\ebaykeyword.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\ebaysearch.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\ebaysearch.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\FindIt.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\FindItHot.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\findithotxp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\finditxp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\Highlight.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\HighlightHot.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\highlighthotxp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\highlightxp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\Reference.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\ReferenceHot.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\referencehotxp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\referencexp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\starware_toolbar_icon.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\Weather.bmp
c:\documents and settings\All Users\Application Data\Starware349\buttons\weatherhotxp.png
c:\documents and settings\All Users\Application Data\Starware349\buttons\weatherxp.png
c:\documents and settings\All Users\Application Data\Starware349\contexts\error.xml
c:\documents and settings\All Users\Application Data\Starware349\contexts\related.xml
c:\documents and settings\All Users\Application Data\Starware349\contexts\Travel.xml
c:\documents and settings\All Users\Application Data\Starware349\images\clear.bmp
c:\documents and settings\All Users\Application Data\Starware349\images\cloudy.bmp
c:\documents and settings\All Users\Application Data\Starware349\images\mcloud.bmp
c:\documents and settings\All Users\Application Data\Starware349\images\ncloudy.bmp
c:\documents and settings\All Users\Application Data\Starware349\images\nrain.bmp
c:\documents and settings\All Users\Application Data\Starware349\images\pcloud.bmp
c:\documents and settings\All Users\Application Data\Starware349\images\walertXP.bmp
c:\documents and settings\All Users\Application Data\Starware349\SimpleUpdate\ProductMessagingConfig.xml
c:\documents and settings\All Users\Application Data\Starware349\SimpleUpdate\ProductMessagingConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware349\SimpleUpdate\SimpleUpdateConfig.xml
c:\documents and settings\All Users\Application Data\Starware349\SimpleUpdate\SimpleUpdateConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware349\SimpleUpdate\TimerManagerConfig.xml
c:\documents and settings\All Users\Application Data\Starware349\SimpleUpdate\TimerManagerConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware365
c:\documents and settings\All Users\Application Data\Starware365\buttons\FindIt.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\FindItHot.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\findithotxp.png
c:\documents and settings\All Users\Application Data\Starware365\buttons\finditxp.png
c:\documents and settings\All Users\Application Data\Starware365\buttons\Highlight.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\HighlightHot.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\highlighthotxp.png
c:\documents and settings\All Users\Application Data\Starware365\buttons\highlightxp.png
c:\documents and settings\All Users\Application Data\Starware365\buttons\lottery.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\starware_toolbar_icon.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\sweepstakes.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\Weather.bmp
c:\documents and settings\All Users\Application Data\Starware365\buttons\weatherhotxp.png
c:\documents and settings\All Users\Application Data\Starware365\buttons\weatherxp.png
c:\documents and settings\All Users\Application Data\Starware365\contexts\error.xml
c:\documents and settings\All Users\Application Data\Starware365\contexts\Related.xml
c:\documents and settings\All Users\Application Data\Starware365\contexts\Travel.xml
c:\documents and settings\All Users\Application Data\Starware365\images\clear.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\cloudy.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\mcloud.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\nclear.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\ncloudy.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\nrain.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\pcloud.bmp
c:\documents and settings\All Users\Application Data\Starware365\images\walertXP.bmp
c:\documents and settings\All Users\Application Data\Starware365\SimpleUpdate\ProductMessagingConfig.xml
c:\documents and settings\All Users\Application Data\Starware365\SimpleUpdate\ProductMessagingConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware365\SimpleUpdate\SimpleUpdateConfig.xml
c:\documents and settings\All Users\Application Data\Starware365\SimpleUpdate\SimpleUpdateConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware365\SimpleUpdate\TimerManagerConfig.xml
c:\documents and settings\All Users\Application Data\Starware365\SimpleUpdate\TimerManagerConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware365\Tem91.tmp
c:\documents and settings\Marilyn\Application Data\Starware349
c:\documents and settings\Marilyn\Application Data\Starware349\BrowserSearch\BrowserSearch.xml
c:\documents and settings\Marilyn\Application Data\Starware349\BrowserSearch\BrowserSearch.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Configurator\Configurator.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Configurator\Configurator.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\EbayKeyword\EbayKeywordOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\EbayKeyword\EbayKeywordOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\EbaySearch\EbaySearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\EbaySearch\EbaySearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\ErrorSearch\ErrorSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\ErrorSearch\ErrorSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Games\GamesOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Games\GamesOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Games\images\active\Games0.bmp
c:\documents and settings\Marilyn\Application Data\Starware349\HoroscopesMarketingSitePager\HoroscopesMarketingSitePagerOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\HoroscopesMarketingSitePager\HoroscopesMarketingSitePagerOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\HoroscopesMarketingSitePager\images\active\HoroscopesMarketingSitePager0.bmp
c:\documents and settings\Marilyn\Application Data\Starware349\Layouts\ToolbarLayout.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Layouts\ToolbarLayout.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Layouts\WeatherLayout.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Layouts\WeatherLayout.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Manager\ManagerOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Manager\ManagerOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Movies\images\active\Movies0.bmp
c:\documents and settings\Marilyn\Application Data\Starware349\Movies\MoviesOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Movies\MoviesOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Reference\ReferenceOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Reference\ReferenceOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\RelatedSearch\RelatedSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\RelatedSearch\RelatedSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
c:\documents and settings\Marilyn\Application Data\Starware349\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Tem37A.tmp
c:\documents and settings\Marilyn\Application Data\Starware349\Tem6AB.tmp
c:\documents and settings\Marilyn\Application Data\Starware349\Toolbar\TBProductsOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Toolbar\TBProductsOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\ToolbarLogo\ToolbarLogoOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\ToolbarLogo\ToolbarLogoOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\ToolbarSearch\ToolbarSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\ToolbarSearch\ToolbarSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\TravelSearch\TravelSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\TravelSearch\TravelSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Weather\AlertArchive.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Weather\AlertArchive.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware349\Weather\WeatherOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware349\Weather\WeatherOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365
c:\documents and settings\Marilyn\Application Data\Starware365\BrowserSearch\BrowserSearch.xml
c:\documents and settings\Marilyn\Application Data\Starware365\BrowserSearch\BrowserSearch.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Configurator\Configurator.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Configurator\Configurator.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\ErrorSearch\ErrorSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\ErrorSearch\ErrorSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Games\GamesOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Games\GamesOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Games\images\active\Games0.bmp
c:\documents and settings\Marilyn\Application Data\Starware365\Layouts\PreferencesLayout.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Layouts\PreferencesLayout.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Layouts\ToolbarLayout.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Layouts\ToolbarLayout.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Layouts\WeatherLayout.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Layouts\WeatherLayout.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Lottery\LotteryOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Lottery\LotteryOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Manager\ManagerOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Manager\ManagerOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Movies\images\active\Movies0.bmp
c:\documents and settings\Marilyn\Application Data\Starware365\Movies\MoviesOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Movies\MoviesOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\RelatedSearch\RelatedSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\RelatedSearch\RelatedSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
c:\documents and settings\Marilyn\Application Data\Starware365\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Sweepstakes\SweepstakesOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Sweepstakes\SweepstakesOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Toolbar\TBProductsOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Toolbar\TBProductsOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\ToolbarLogo\ToolbarLogoOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\ToolbarLogo\ToolbarLogoOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\ToolbarSearch\ToolbarSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\ToolbarSearch\ToolbarSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\TravelSearch\TravelSearchOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\TravelSearch\TravelSearchOptions.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Weather\AlertArchive.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Weather\AlertArchive.xml.backup
c:\documents and settings\Marilyn\Application Data\Starware365\Weather\WeatherOptions.xml
c:\documents and settings\Marilyn\Application Data\Starware365\Weather\WeatherOptions.xml.backup
c:\documents and settings\Marilyn\Local Settings\Application Data\{A51CB38F-9793-4184-8ACD-F676F64BD70D}
c:\documents and settings\Marilyn\Local Settings\Application Data\{A51CB38F-9793-4184-8ACD-F676F64BD70D}\chrome.manifest
c:\documents and settings\Marilyn\Local Settings\Application Data\{A51CB38F-9793-4184-8ACD-F676F64BD70D}\chrome\content\_cfg.js
c:\documents and settings\Marilyn\Local Settings\Application Data\{A51CB38F-9793-4184-8ACD-F676F64BD70D}\chrome\content\c.js
c:\documents and settings\Marilyn\Local Settings\Application Data\{A51CB38F-9793-4184-8ACD-F676F64BD70D}\chrome\content\overlay.xul
c:\documents and settings\Marilyn\Local Settings\Application Data\{A51CB38F-9793-4184-8ACD-F676F64BD70D}\install.rdf
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Images\01D59C68.urr
c:\program files\FunWebProducts\ScreenSaver\Images\01FA9BFE.urr
c:\program files\FunWebProducts\ScreenSaver\Images\01FB0B49.dat
c:\program files\FunWebProducts\ScreenSaver\Images\101x135\01FB0B49.jpg
c:\program files\FunWebProducts\ScreenSaver\Images\wrkparam.lst
c:\program files\INSTALL.LOG
c:\program files\MalwareAlarm
c:\program files\MalwareAlarm\MalwareAlarm.lic
c:\program files\MalwareAlarm\Uninstall.exe
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\setting2.htm.bak
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\program files\MyWebSearch\bar\Settings\settings.dat.bak
c:\program files\spamblockerutility
c:\program files\Starware349
c:\program files\Starware349\bin\Starware349.dll
c:\program files\Starware349\brand.bmp
c:\program files\Starware349\icons\star_16.ico
c:\program files\Starware349\Starware349Config.xml
c:\program files\Starware349\Starware349Uninstall.exe
c:\program files\Starware365
c:\program files\Starware365\bin\Starware365.dll
c:\program files\Starware365\brand.bmp
c:\program files\Starware365\icons\star_16.ico
c:\program files\Starware365\Starware365Config.xml
c:\program files\Starware365\Starware365Uninstall.exe
C:\Redemption.ECF
c:\windows\Bqusubemob.dll
c:\windows\ejujakokupujaxa.dll
c:\windows\ewuwejatazal.dll

.
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-30 )))))))))))))))))))))))))))))))
.

2009-06-30 02:24 . 2009-06-30 02:24 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-06-29 03:24 . 2009-06-29 03:24 ——– d—–w- c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 00:12 . 2009-05-28 00:12 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-05-24 00:26 . 2009-05-24 00:21 ——– d—–w- c:\documents and settings\All Users\Application Data\DriverCure
2009-05-24 00:22 . 2009-05-24 00:22 ——– d—–w- c:\documents and settings\Marilyn\Application Data\DriverCure
2009-05-24 00:21 . 2009-05-24 00:21 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-05-21 20:22 . 2009-05-21 19:45 ——– d—–w- c:\program files\Registry Genius
2009-05-17 20:15 . 2009-03-13 17:14 ——– d—–w- c:\program files\Winferno
2009-05-17 20:08 . 2009-04-27 07:11 ——– d—–w- c:\program files\My.Freeze.com Toolbar
2009-05-17 19:59 . 2009-04-27 07:12 ——– d—–w- c:\program files\Kwinzy
2009-05-17 19:32 . 2009-03-13 17:17 ——– d—–w- c:\program files\Freeze.com
2009-05-13 07:19 . 2009-05-11 19:28 ——– d—–w- c:\program files\Ascentive
2009-05-13 05:05 . 2007-03-14 16:32 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-05-13 05:05 . 2009-05-13 05:05 ——– d—–w- c:\documents and settings\Marilyn\Application Data\InstallShield
2009-05-10 17:08 . 2007-03-25 02:11 ——– d—–w- c:\program files\Google
2009-05-07 15:32 . 2001-08-23 12:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-06 16:23 . 2009-05-06 16:11 ——– d—–w- c:\program files\Coupons
2009-04-29 04:56 . 2004-01-08 20:23 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 ——w- c:\windows\system32\ieencode.dll
2009-04-20 20:43 . 2009-04-17 01:04 145920 —-a-w- c:\windows\Llivexetedabe.dat
2009-04-17 12:26 . 2001-08-23 12:00 1847168 —-a-w- c:\windows\system32\win32k.sys
2009-04-16 23:10 . 2009-04-16 23:10 156672 -c–a-w- c:\windows\ocakicil.dll
2009-04-15 14:51 . 2007-03-23 14:35 585216 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-02 19:55 . 2009-05-11 19:29 217088 —-a-w- c:\windows\system32\ConTest.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}]
2008-11-26 23:40 253048 —-a-w- c:\program files\My.Freeze.com Toolbar\NetAssistant.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BellSouthAlertManager.exe"="c:\program files\BellSouth\AM\BellSouthAlertManager.exe" [2007-01-28 2061816]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"HelpCenter"="c:\program files\Bellsouth\HelpCenter\bin\sprtcmd.exe" [2006-10-30 192512]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-22 136600]
"NielsenOnline"="c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe" [2008-10-31 45056]
"Lexmark X83 Button Monitor"="c:\progra~1\LEXMAR~1\ACMonitor_X83.exe" [2001-10-18 40960]
"Lexmark X83 Button Manager"="c:\progra~1\LEXMAR~1\AcBtnMgr_X83.exe" [2001-06-14 53248]
"PrinTray"="c:\windows\System32\spool\DRIVERS\W32X86\3\printray.exe" [2002-06-27 36864]
"Byeganalepeti"="c:\windows\Llivexetedabe.dat" [2009-04-20 145920]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceActiveDesktopOn"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys [3/3/2009 1:24 PM 21888]
R1 nnrnstdi;nnrnstdi;c:\windows\system32\drivers\nnrnstdi.sys [3/3/2009 1:26 PM 14336]
R3 km_filter;km_filter;c:\windows\system32\drivers\km_filter.sys [3/3/2009 1:26 PM 8832]
S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys [3/3/2009 1:24 PM 9088]
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 20:42]

2009-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 17:03]

2009-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 17:03]

2009-06-26 c:\windows\Tasks\PCConfidential.job
- c:\program files\Winferno\PC Confidential\PCConfidential.exe [2009-03-13 18:10]

2009-05-11 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-11 02:18]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-RegTool - c:\program files\RegTool\RegTool.exe
HKCU-Run-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
HKLM-Run-Fmucogutage - c:\windows\Bqusubemob.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://timesfreepress.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant =
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZUxdm265YYUS
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-29 23:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-30 23:19
ComboFix-quarantined-files.txt 2009-06-30 03:19

Pre-Run: 1,739,882,496 bytes free
Post-Run: 2,095,869,952 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

331 — E O F — 2009-06-10 22:17

Thanks again for all of your help.

Now, what do I need to do?
Post #6
Hi,

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Folder::
c:\program files\My.Freeze.com Toolbar

File::
c:\program files\Freeze.com
c:\windows\ocakicil.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}]

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

I would like you to upload a file to be scanned
  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\Llivexetedabe.dat

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.


Do the same for the following file:


c:\windows\system32\ConTest.dll

Post #7
Here is the ComboFix log.

ComboFix 09-07-01.01 - Marilyn 07/01/2009 17:57.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.126.32 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Marilyn\Desktop\CFScript.txt

FILE ::
"c:\program files\Freeze.com"
"c:\windows\ocakicil.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Marilyn\Local Settings\Application Data\{3BE41CF7-8169-4FED-BE31-A14EA22E0796}
c:\documents and settings\Marilyn\Local Settings\Application Data\{3BE41CF7-8169-4FED-BE31-A14EA22E0796}\chrome.manifest
c:\documents and settings\Marilyn\Local Settings\Application Data\{3BE41CF7-8169-4FED-BE31-A14EA22E0796}\chrome\content\_cfg.js
c:\documents and settings\Marilyn\Local Settings\Application Data\{3BE41CF7-8169-4FED-BE31-A14EA22E0796}\chrome\content\c.js
c:\documents and settings\Marilyn\Local Settings\Application Data\{3BE41CF7-8169-4FED-BE31-A14EA22E0796}\chrome\content\overlay.xul
c:\documents and settings\Marilyn\Local Settings\Application Data\{3BE41CF7-8169-4FED-BE31-A14EA22E0796}\install.rdf
c:\program files\My.Freeze.com Toolbar
c:\program files\My.Freeze.com Toolbar\NetAssistant.dll
c:\program files\My.Freeze.com Toolbar\uninstall.exe
c:\windows\ocakicil.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-01 to 2009-07-01 )))))))))))))))))))))))))))))))
.

2009-06-30 02:24 . 2009-06-30 02:24 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-06-29 03:24 . 2009-06-29 03:24 ——– d—–w- c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 00:12 . 2009-05-28 00:12 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-05-24 00:26 . 2009-05-24 00:21 ——– d—–w- c:\documents and settings\All Users\Application Data\DriverCure
2009-05-24 00:22 . 2009-05-24 00:22 ——– d—–w- c:\documents and settings\Marilyn\Application Data\DriverCure
2009-05-24 00:21 . 2009-05-24 00:21 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-05-21 20:22 . 2009-05-21 19:45 ——– d—–w- c:\program files\Registry Genius
2009-05-17 20:15 . 2009-03-13 17:14 ——– d—–w- c:\program files\Winferno
2009-05-17 19:59 . 2009-04-27 07:12 ——– d—–w- c:\program files\Kwinzy
2009-05-17 19:32 . 2009-03-13 17:17 ——– d—–w- c:\program files\Freeze.com
2009-05-13 07:19 . 2009-05-11 19:28 ——– d—–w- c:\program files\Ascentive
2009-05-13 05:05 . 2007-03-14 16:32 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-05-13 05:05 . 2009-05-13 05:05 ——– d—–w- c:\documents and settings\Marilyn\Application Data\InstallShield
2009-05-10 17:08 . 2007-03-25 02:11 ——– d—–w- c:\program files\Google
2009-05-07 15:32 . 2001-08-23 12:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-06 16:23 . 2009-05-06 16:11 ——– d—–w- c:\program files\Coupons
2009-04-29 04:56 . 2004-01-08 20:23 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 ——w- c:\windows\system32\ieencode.dll
2009-04-20 20:43 . 2009-04-17 01:04 145920 —-a-w- c:\windows\Llivexetedabe.dat
2009-04-17 12:26 . 2001-08-23 12:00 1847168 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2007-03-23 14:35 585216 —-a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-30_03.13.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-01 21:33 . 2009-07-01 21:33 16384 c:\windows\Temp\Perflib_Perfdata_2fc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BellSouthAlertManager.exe"="c:\program files\BellSouth\AM\BellSouthAlertManager.exe" [2007-01-28 2061816]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"HelpCenter"="c:\program files\Bellsouth\HelpCenter\bin\sprtcmd.exe" [2006-10-30 192512]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-22 136600]
"NielsenOnline"="c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe" [2008-10-31 45056]
"Lexmark X83 Button Monitor"="c:\progra~1\LEXMAR~1\ACMonitor_X83.exe" [2001-10-18 40960]
"Lexmark X83 Button Manager"="c:\progra~1\LEXMAR~1\AcBtnMgr_X83.exe" [2001-06-14 53248]
"PrinTray"="c:\windows\System32\spool\DRIVERS\W32X86\3\printray.exe" [2002-06-27 36864]
"Byeganalepeti"="c:\windows\Llivexetedabe.dat" [2009-04-20 145920]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys [3/3/2009 1:24 PM 21888]
R1 nnrnstdi;nnrnstdi;c:\windows\system32\drivers\nnrnstdi.sys [3/3/2009 1:26 PM 14336]
R3 km_filter;km_filter;c:\windows\system32\drivers\km_filter.sys [3/3/2009 1:26 PM 8832]
S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys [3/3/2009 1:24 PM 9088]
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 20:42]

2009-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 17:03]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 17:03]

2009-06-26 c:\windows\Tasks\PCConfidential.job
- c:\program files\Winferno\PC Confidential\PCConfidential.exe [2009-03-13 18:10]

2009-05-11 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-11 02:18]
.
- - - - ORPHANS REMOVED - - - -

BHO-{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://timesfreepress.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZUxdm265YYUS
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-01 18:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-01 18:14
ComboFix-quarantined-files.txt 2009-07-01 22:14
ComboFix2.txt 2009-06-30 03:19

Pre-Run: 2,111,324,160 bytes free
Post-Run: 2,140,004,352 bytes free

132 — E O F — 2009-06-10 22:17

________________________________________________

Here is clipboard files:

VirSCAN.org Scanned Report :
Scanned time : 2009/07/01 17:37:53 (CDT)
Scanner results: 45% Scanner(17/38) found malware!
File Name : Llivexetedabe.dat
File Size : 145920 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 823599e8f93e5d42335db0f476eedba1
SHA1 : 62058a4ca595b985f2324f67b54d52fffdcc4452
Online report : http://virscan.org/report/efdfe09a7e764b36…1ceffe90c1.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090701154618 2009-07-01 2.56 Trojan.Win32.Hiloti!IK
AhnLab V3 2009.07.01.03 2009.07.01 2009-07-01 0.72 -
AntiVir 8.2.0.199 7.1.4.165 2009-07-01 0.52 TR/Crypt.XPACK.Gen
Antiy 2.0.18 20090701.2583795 2009-07-01 0.12 -
Arcavir 2009 200907011613 2009-07-01 0.04 -
Authentium 5.1.1 200907011613 2009-07-01 1.13 -
AVAST! 4.7.4 090701-0 2009-07-01 0.01 Win32:Fasec [Trj]
AVG 8.5.286 270.13.2/2213 2009-07-02 3.37 Vundo.GT
BitDefender 7.81008.3830208 7.26302 2009-07-02 3.63 Trojan.Packed.Hiloti.Gen.1
CA (VET) 9.0.0.143 31.6.6590 2009-07-01 7.26 -
ClamAV 0.95.2 9531 2009-07-01 0.03 -
Comodo 3.9 1537 2009-07-01 0.74 Unclassified Malware
CP Secure 1.1.0.715 2009.07.01 2009-07-01 10.82 -
Dr.Web 4.44.0.9170 2009.07.01 2009-07-01 4.76 -
F-Prot 4.4.4.56 20090701 2009-07-01 1.13 -
F-Secure 5.51.6100 2009.07.01.13 2009-07-01 5.92 Trojan:W32/Hiloti.S [Orion]
Fortinet 2.81-3.117 10.554 2009-07-01 0.20 W32/Hiloti!tr
GData 19.6204/19.382 20090701 2009-07-01 4.71 Win32:Fasec [Trj] [Engine:B]
ViRobot 20090701 2009.07.01 2009-07-01 0.43 -
Ikarus T3.1.01.64 2009.07.01.72958 2009-07-01 3.02 Trojan.Win32.Hiloti
JiangMin 11.0.800 2009.07.01 2009-07-01 3.23 -
Kaspersky 5.5.10 2009.06.30 2009-06-30 0.05 -
KingSoft 2009.2.5.15 2009.7.1.19 2009-07-01 0.45 -
McAfee 5.3.00 5663 2009-07-01 2.94 Hiloti
Microsoft 1.4803 2009.07.01 2009-07-01 5.38 Trojan:Win32/Hiloti.gen!A
mks_vir 2.01 2009.06.30 2009-06-30 3.20 -
Norman 6.01.09 6.01.00 2009-07-01 4.01 -
Panda 9.05.01 2009.07.01 2009-07-01 1.64 -
Trend Micro 8.700-1004 6.240.10 2009-07-01 0.03 -
Quick Heal 10.00 2009.07.01 2009-07-01 1.00 Trojan.Hiloti.a
Rising 20.0 21.36.24.00 2009-07-01 0.86 -
Sophos 2.88.0 4.43 2009-07-02 2.56 Mal/Generic-A
Sunbelt 5221 5221 2009-07-01 0.94 Trojan.Win32.Hiloti.gen (v)
Symantec 1.3.0.24 20090701.004 2009-07-01 0.06 Trojan Horse
nProtect 20090701.02 4799619 2009-07-01 6.36 Trojan.Packed.Hiloti.Gen.1
The Hacker 6.3.4.3 v00358 2009-06-30 0.65 -
VBA32 3.12.10.7 20090630.1521 2009-06-30 2.01 -
VirusBuster 4.5.11.10 10.107.32/1724224 2009-07-01 2.13 -

________________________________________________________________________________
__________________

VirSCAN.org Scanned Report :
Scanned time : 2009/07/01 17:43:14 (CDT)
Scanner results: 5% Scanner(2/38) found malware!
File Name : ConTest.dll
File Size : 217088 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 9c9b2f1e84189dde1c0780aec35eb0ab
SHA1 : bb5fc1c7424007f2e640672b75bac5808f86ae77
Online report : http://virscan.org/report/3ed375515d415974…dfa60feb5c.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090701154618 2009-07-01 40.13 -
AhnLab V3 2009.07.01.03 2009.07.01 2009-07-01 0.74 -
AntiVir 8.2.0.199 7.1.4.165 2009-07-01 0.23 -
Antiy 2.0.18 20090701.2583795 2009-07-01 0.12 -
Arcavir 2009 200907011613 2009-07-01 0.03 Trojan.Bho.Lkl
Authentium 5.1.1 200907011613 2009-07-01 1.13 -
AVAST! 4.7.4 090701-0 2009-07-01 0.01 -
AVG 8.5.286 270.13.2/2213 2009-07-02 3.41 -
BitDefender 7.81008.3830208 7.26302 2009-07-02 3.63 -
CA (VET) 9.0.0.143 31.6.6590 2009-07-01 8.61 -
ClamAV 0.95.2 9531 2009-07-01 0.04 -
Comodo 3.9 1537 2009-07-01 0.85 -
CP Secure 1.1.0.715 2009.07.01 2009-07-01 10.84 -
Dr.Web 4.44.0.9170 2009.07.01 2009-07-01 4.80 Program.Fakespeedup
F-Prot 4.4.4.56 20090701 2009-07-01 1.14 -
F-Secure 5.51.6100 2009.07.01.13 2009-07-01 5.97 -
Fortinet 2.81-3.117 10.555 2009-07-01 0.19 -
GData 19.6204/19.382 20090701 2009-07-01 4.42 -
ViRobot 20090701 2009.07.01 2009-07-01 0.41 -
Ikarus T3.1.01.64 2009.07.01.72958 2009-07-01 3.04 -
JiangMin 11.0.800 2009.07.01 2009-07-01 3.46 -
Kaspersky 5.5.10 2009.06.30 2009-06-30 0.05 -
KingSoft 2009.2.5.15 2009.7.1.19 2009-07-01 0.45 -
McAfee 5.3.00 5663 2009-07-01 2.98 -
Microsoft 1.4803 2009.07.01 2009-07-01 4.93 -
mks_vir 2.01 2009.06.30 2009-06-30 3.24 -
Norman 6.01.09 6.01.00 2009-07-01 4.01 -
Panda 9.05.01 2009.07.01 2009-07-01 1.68 -
Trend Micro 8.700-1004 6.240.10 2009-07-01 0.03 -
Quick Heal 10.00 2009.07.01 2009-07-01 1.08 -
Rising 20.0 21.36.24.00 2009-07-01 0.77 -
Sophos 2.88.0 4.43 2009-07-02 2.54 -
Sunbelt 5221 5221 2009-07-01 0.84 -
Symantec 1.3.0.24 20090701.004 2009-07-01 0.06 -
nProtect 20090701.02 4799619 2009-07-01 6.38 -
The Hacker 6.3.4.3 v00358 2009-06-30 0.82 -
VBA32 3.12.10.7 20090630.1521 2009-06-30 2.00 -
VirusBuster 4.5.11.10 10.107.32/1724224 2009-07-01 2.15 -

Thanks for everything that you have done for me so far.

Now what do I do?
Post #8
Hi,

we need to get rid of those suspicious files now.

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/computer_running_slow_t104611.html&view=findpost&p=573817#entry573817

Collect::
c:\windows\Llivexetedabe.dat

File::
c:\program files\Freeze.com

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Byeganalepeti"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.

NEXT

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI