[Resolved] SillyJilly Needs Help---Again!

Due, in part, to the large numbers of HJT logs being posted, there are four things that you need to be aware of.

1) If you have already posted this log at another forum, you need to post here that you have done so and this topic will be closed.
Multiple posting not only ties up valuable resources, but could also result is some unpleasant side-effects for your system if you follow two sets of instructions at the same time.
If, during research, an identical log is identified at another forum, this thread will be closed.

2) If you don't post a meaningful reply to any of my posts within five days, this thread will be closed. Due to limited free time I can only have so many open threads at any one time and if yours isn't active, somebody else's will be.
If, by omission, the thread hasn't be closed after five days and you post, it will just serve as a reminder to me to close it.
Please note that "I just dropped in to say Hi!" isn't a meaningful reply!

3) Malware removal is a tricky business, and malware writers don't tend to worry about the damage their creations do, so it is advisable to back-up all important files BEFORE we start. Although most cases have a successful conclusion, on occasion things don't go according to plan and it is better to be prepared for the worst.

4) Back-ups can get lost or damaged, so make two if the files are that important to you!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pay a visit to the Kaspersky Online Scanner 7 - I.E. is preferred for this scan.

• Read the Information panel and then click Accept.
• Allow the ActiveX download if necessary.
• Both the anti-virus engine and database will need to be downloaded, which may take a little time.
• Once this has been completed, select My Computer from the Scan section on the left hand side.
• Put the kettle on!
• Although it is recommended by Kaspersky that you should disable your anti-virus scanner before starting this scan, it should work OK with it still active - it does on my PC.
  Although you may find the scan speed increases if you carry out this step, I never like to disable my resident scanner while online, so I don't.
• When the scan has completed, click View scan report at the bottom.
• Click Save Report As…
• Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
• Click Save and pick a location for the file - the Desktop is always handy.

Copy and paste the report into your next reply along with a fresh HJT log, run in Normal Mode, and a description of how your PC is behaving.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download Sec-Info2.zip from here and save it to your Desktop. You will need to extract the file.

Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a folder with a file in it - double click Sec-info2.vbs to run it.
Once you have been informed that the script has completed, a text file called Sec-Info.txt should be created in the same folder - you may need to wait a couple of seconds for it to appear..
Please copy and paste the contents of the text file into your next reply and then you can delete both of the folders and their contents.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Run HJT and click on Open the Misc Tools section.

• Click Open Uninstall Manager…
• Click Save list… and save it to your Desktop.
• Copy and paste the file uninstall_list.txt into your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download RootRepeal from one of the locations below and save it to your Desktop:
Location 1
Location 2
Location 4

• Double click RootRepeal.exe to fire up the tool and OK any Windows confirmation if necessary.
• Ensure that the Report Tab is selected at the bottom.
• Click the Scan button, check ALL the boxes in the window that appears and then click OK.
• Check the box next to your main hard drive - usually C: and click OK
• Put the kettle on and perhaps open a packet of biscuits - the scan will take some time.
• Once the scan has completed a Notepad window will open with the results in.
• These results will also be saved to the root of your main drive as \RootRepeal report date time.txt

Let me have a copy of the contents in your next reply.

Hi, Thanks for the quick response. I have been trying and trying to get Kaspersky to run and it downloads then when updating says it cannot update, that I must be online to update (which I am), and that I have an expired key?? Have tried about 20 times to no avail. Any idea what to do?? Jilly

Kav seems to be having issues at the minute, although they were supposed to have been sorted. Substitute that part with the following:

Pay a visit to the ESET Online Scanner - IE is proffered for this.

• Click the ESET Online Scanner button, read the info in the new window, check the appropriate box and click Start.
• Accept the ActiveX download, and allow it to install.
• Once this has been completed, you will see the Computer Scan settings page - ensure that you uncheck the "Remove found threats" box and then click Start.
• The virus signature database will now need to be downloaded, so don't forget to instruct your firewall to permit it if it asks.
• The above will take a little time, so now is a good time to fire up the kettle and open the biccies.
• Once the scan has completed you will be shown the results - assuming that the scanner has found anything.
• Click List of found threats and then Export to text file… and save the log somewhere convenient.
• You can then close out the scanner - don't bother uninstalling it as you may need to use it again.
• Please post the contents of this file in your next reply, or let me know that nothing was identified.

Let me have the above and the rest of the info from my first post.

Hi, Have been on the road and having a tough time getting a connection. Am downloading the ESET definitions right now, will run the scan, then likely will not be able to post the results until tomorrow. So please be patient with me. Am trying!

Hi, Sorry for the lengthy delay. This computer is now to the point that it takes 45 minutes to boot up, then crashes over and over. I ran the ESET as instructed and it came out with no threats detected. Got the rest of the stuff run, here are the results. I will have internet access for a few days and will be able to leave this thing running so hopefully will be OK until I hear back from you. Thanks so much for your help and patience. SillyJilly SEC-INFO VBS: Script run: 8/26/2009 8:35:00 PM ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: Symantec Corporation AV Name: Norton Internet Security Version Number: 16.5.0.135 On-Access Scanning Enabled: Yes Product up-to-date: Yes ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: Symantec Corporation Firewall Name: Norton Internet Security Version Number: 16.5.0.135 Enabled: Yes ~~~~~~~~~~~~~~~~~~~~~~~~ The Windows Firewall is disabled. ~~~~~~~~~~~~~~~~~~~~~~~~ The Security Center Anti-Virus Alerts are enabled. The Security Center Firewall Alerts are enabled. ~~~~~~~~~~~~~~~~~~~~~~~~ Number of Restore Points found: 29 ~~~~~~~~~~~~~~~~~~~~~~~~ Script run: 8/31/2009 1:12:22 PM ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: Symantec Corporation AV Name: Norton Internet Security Version Number: 16.5.0.135 On-Access Scanning Enabled: Yes Product up-to-date: Yes ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: Symantec Corporation Firewall Name: Norton Internet Security Version Number: 16.5.0.135 Enabled: Yes ~~~~~~~~~~~~~~~~~~~~~~~~ The Windows Firewall is disabled. ~~~~~~~~~~~~~~~~~~~~~~~~ The Security Center Anti-Virus Alerts are enabled. The Security Center Firewall Alerts are enabled. ~~~~~~~~~~~~~~~~~~~~~~~~ Number of Restore Points found: 27 ~~~~~~~~~~~~~~~~~~~~~~~~ HJT UNINSTALL LOG: Adobe Flash Player 10 Plugin Adobe Reader 7.1.0 Adobe Type Manager 4.0 AI RoboForm (All Users) ALPS Touch Pad Driver Apple Software Update ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver Belarc Advisor 7.0 Broadcom Advanced Control Suite CCleaner (remove only) Conexant D480 MDC V.9x Modem Creative Jukebox Driver Critical Update for Windows Media Player 11 (KB959772) DAO 3.5 Dell Digital Jukebox Driver Dell Driver Reset Tool Dell Home Systems Services Agreement Dell Media Experience Dell ResourceCD Dell Support Digital Line Detect ESET Online Scanner v3 Fidelity Active Trader Pro® Good Sync version 3.4.4 Google Earth HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB970653-v3) Intel® mDriver Intel® PROSet for Wireless Internet Explorer Default Page Java 2 Runtime Environment, SE v1.4.2_03 Java™ 6 Update 15 Learn2 Player (Uninstall Only) LiveUpdate (Symantec Corporation) LiveUpdate (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) Logitech Audio Echo Cancellation Component Logitech Legacy USB Camera Driver Package Logitech QuickCam Logitech QuickCam Driver Package Logitech Video Enumerator Macromedia Flash Player 8 Malwarebytes' Anti-Malware MetaProducts StartUp Organizer Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2000 Professional Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Modem Helper Mozilla Firefox (3.0.11) MP3 Update MSN MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MVision NetWaiting NOMAD Explorer Norton Internet Security OLYMPUS CAMEDIA Master 2.0 OLYMPUS USB Reader/Writer PowerDVD 5.1 Quicken 2006 QuickSet QuickTime RealPlayer Basic Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Shockwave Skype™ 3.6 Sonic DLA Sonic RecordNow! Sonic Update Manager Spybot - Search & Destroy SUPERAntiSpyware Free Edition The Rosetta Stone 2000 Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB973815) URGE USB-IDE Bridge Driver Viewpoint Media Player Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Service Pack 3 WordPerfect Office 12 ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/31 13:21 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF4765000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF8CB6000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal[1].sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal[1].sys Address: 0xF1BE4000 Size: 49152 File Visible: No Signed: - Status: - Name: SYMEFA.SYS Image Path: SYMEFA.SYS Address: 0xF8563000 Size: 323584 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: C:\hiberfil.sys Status: Locked to the Windows API! SSDT ——————- #: 012 Function Name: NtAlertResumeThread Status: Hooked by "" at address 0x82aebc10 #: 013 Function Name: NtAlertThread Status: Hooked by "" at address 0x82aebcf0 #: 017 Function Name: NtAllocateVirtualMemory Status: Hooked by "" at address 0x82aef660 #: 019 Function Name: NtAssignProcessToJobObject Status: Hooked by "" at address 0x82aeb3b8 #: 031 Function Name: NtConnectPort Status: Hooked by "" at address 0x8324e9c8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf4c54040 #: 043 Function Name: NtCreateMutant Status: Hooked by "" at address 0x82aeb960 #: 052 Function Name: NtCreateSymbolicLinkObject Status: Hooked by "" at address 0x82aeb1d8 #: 053 Function Name: NtCreateThread Status: Hooked by "" at address 0x82feb910 #: 057 Function Name: NtDebugActiveProcess Status: Hooked by "" at address 0x82aeb498 #: 063 Function Name: NtDeleteKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf4c542c0 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf4c54820 #: 068 Function Name: NtDuplicateObject Status: Hooked by "" at address 0x82aef738 #: 083 Function Name: NtFreeVirtualMemory Status: Hooked by "" at address 0x82aef540 #: 089 Function Name: NtImpersonateAnonymousToken Status: Hooked by "" at address 0x82aeba50 #: 091 Function Name: NtImpersonateThread Status: Hooked by "" at address 0x82aebb30 #: 097 Function Name: NtLoadDriver Status: Hooked by "" at address 0x830b4b28 #: 108 Function Name: NtMapViewOfSection Status: Hooked by "" at address 0x82aef460 #: 114 Function Name: NtOpenEvent Status: Hooked by "" at address 0x82aeb880 #: 122 Function Name: NtOpenProcess Status: Hooked by "" at address 0x82aef858 #: 123 Function Name: NtOpenProcessToken Status: Hooked by "" at address 0x82b181f0 #: 125 Function Name: NtOpenSection Status: Hooked by "" at address 0x82aeb6c0 #: 128 Function Name: NtOpenThread Status: Hooked by "" at address 0x82aef7c8 #: 137 Function Name: NtProtectVirtualMemory Status: Hooked by "" at address 0x82aeb2c8 #: 206 Function Name: NtResumeThread Status: Hooked by "" at address 0x82b1f238 #: 213 Function Name: NtSetContextThread Status: Hooked by "" at address 0x82aebf90 #: 228 Function Name: NtSetInformationProcess Status: Hooked by "" at address 0x82aef2b0 #: 240 Function Name: NtSetSystemInformation Status: Hooked by "" at address 0x82aeb578 #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf4c54a70 #: 253 Function Name: NtSuspendProcess Status: Hooked by "" at address 0x82aeb7a0 #: 254 Function Name: NtSuspendThread Status: Hooked by "" at address 0x82aebdd0 #: 257 Function Name: NtTerminateProcess Status: Hooked by "C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys" at address 0xf4b550b0 #: 258 Function Name: NtTerminateThread Status: Hooked by "" at address 0x82aebeb0 #: 267 Function Name: NtUnmapViewOfSection Status: Hooked by "" at address 0x82aef3a0 #: 277 Function Name: NtWriteVirtualMemory Status: Hooked by "" at address 0x82aef5d0 Shadow SSDT ——————- #: 307 Function Name: NtUserAttachThreadInput Status: Hooked by "" at address 0x8324a6a0 #: 383 Function Name: NtUserGetAsyncKeyState Status: Hooked by "" at address 0xff9b8050 #: 414 Function Name: NtUserGetKeyboardState Status: Hooked by "" at address 0xff97f050 #: 416 Function Name: NtUserGetKeyState Status: Hooked by "" at address 0xff980050 #: 428 Function Name: NtUserGetRawInputData Status: Hooked by "" at address 0x830c3a68 #: 460 Function Name: NtUserMessageCall Status: Hooked by "" at address 0x83287700 #: 475 Function Name: NtUserPostMessage Status: Hooked by "" at address 0x83272918 #: 476 Function Name: NtUserPostThreadMessage Status: Hooked by "" at address 0x832753f8 #: 549 Function Name: NtUserSetWindowsHookEx Status: Hooked by "" at address 0x830c3fc0 #: 552 Function Name: NtUserSetWinEventHook Status: Hooked by "" at address 0x830cb9b8 ==EOF==

Assuming that your anti-virus is up-to-date i'm tending to think that the issue is more a sick operating system rather than malware infections. The difficulty with speed issues is that it is hard to nail down the exact cause. The following steps will serve as a spring clean for your PC. Not all of them will be of benefit to your PC as this is a general post, but the overall effect should be positive.

1) Go to Start > Control Panel > Add/Remove Programs and remove any programs that you no longer use and then reboot your PC.

2) Download ATF Cleaner by Atribune from here and save it to your Desktop.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:
Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Java Cache
The rest are optional - if you want to remove the lot, check "Select All".
Finally click Empty Selected. When you get the "Done Cleaning" message, click OK.

If you use the Firefox or Opera browsers, you can use this program as a quick way to tidy those up as well.

When you have finished, click on the Exit button in the Main menu.

For Technical Support, double-click the e-mail address located at the bottom of each menu.

Please Note: This program is for Windows XP and Windows 2000 only.

3) Double click My Computer.
Right click the disc drive you wish to check.
Click Properties.
In the Properties dialog box, click the Tools Tab.
Under Error-checking, click the Check Now button.
In the "Check Disc Local Disk (C:)" dialog box, check both Automatically fix file system errors and Scan for and attempt recovery of bad sectors, and then click Start.

This will look for and attempt to repair any errors that your hard drive has.

4) Defragment your hard drive. A tutorial for disc defragmentation is available here.

I happen to prefer a third-party defrag tool to the one that Windows offers. You can read about it, and find a linky, here - it's free.

5) Download and run StartUp Inspector.
This program will help you to decide exactly what programs you disable from running at startup.
The Readme.txt file included has instructions on how to use it.

Let me know how you get on.

Hi, Thanks for your speedy reply. Did all of your recommendations. The error check found a couple of things,didn't appear to be anything major. The defrag says it doesn't need to be done, not fragmented enough. Took a couple of things off the startup list. The computer is no longer crashing but still slower than a snail. This has always been my quickest computer to boot up, so pretty perplexed as to why it would suddenly become so slow.

Has your PC experienced anything obviously malicious in nature - pop-ups, browser redirects, lime green monkeys sat on the monitor throwing peanuts at you, that sort of thing?

No, nothing of the sort. Just a few weeks ago it slowed way down, taking forever to bootup, start firefox, etc., plus was crashing all the time. Was wondering about the processor?? Fan is working, doesn't seem to be too hot.

At this point we enter the wonderful world of Who Knows! Your PC could have a malware infection that I either haven't spotted in the information you have posted, or it just doesn't show up in the areas that are logged. ESET doesn't spot it, neither does Symantec or MBAM, assuming you've scanned with both, which does suggest no infection, but that isn't a guarantee. Alternatively the PC has just decided to throw a wobbly because it can - sadly this isn't as far fetched as it should be. If the PC is as unstable as you say, i'd be inclined to back-up whatever you need to and try a reformat and reinstall. No installation of Windows lasts forever, and it could just be time for a fresh start, or something could have become corrupted causing the problems. This step does have the advantage that if you do have malware onboard, it will be removed during this process. This may seem defeatist, but the time taken to start afresh is probably a lot less that hunting for a problem that as yet isn't identified. If the problem isn't software in nature, and your computer has more serious hardware issues, which it may not have but you can't rule that out, then you'll find out as a reformat won't solve the problem.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.