Dakeyras
Due to inactivity this topic will be closed.
If you need help please start a new thread.
Spyware / Malware / Virus Removal
[Resolved] slow internet helllp
18 min read
irma
sorry D… my inlaw irma lives an hr away and my nephew can't seem to get over here even though he's around the corner….let's see how fast he come's over at x-mas, his b-day, or when he needs somthing…anyway the cpu seems to be running fine except explorer is slow to load….once loaded everything is ggood… thanx for your help and i am sorry for not being prompt with your requests…here is the rsit log that you asked for…
Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-10-02 11:27:54
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 50 GB (69%) free of 72 GB
Total RAM: 223 MB (20% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:04 AM, on 10/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Owner\Desktop\RSIT[1].exe
C:\Program Files\trend micro\Owner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!
user_pref("aim.session.firsttime", false);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.download.dir", "C:\\Documents and Settings\\Owner\\Desktop\\Games");
user_pref("browser.history.last_page_visited", "http://www.fileplanet.com/dropoff.aspx");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.1");
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("prefs.converted-to-utf8", true);
user_pref("security.warn_leaving_secure", false);
user_pref("signon.SignonFileName", "57703880.s");
user_pref("timebomb.first_launch_time", "1050624434656000");
user_pref("update_notifications.provider.0.last_checked", 1058734035);
user_pref("wallet.caveat", true);
user_pref("browser.startup.homepage", "http://www.znmktxblxgldixwxf.com/MLsd3Hqe7CDWAanJxPL4SfTfiwR
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!
user_pref("aim.session.firsttime", false);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.download.dir", "C:\\Documents and Settings\\Owner\\Desktop\\Games");
user_pref("browser.history.last_page_visited", "http://www.fileplanet.com/dropoff.aspx");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.1");
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("prefs.converted-to-utf8", true);
user_pref("security.warn_leaving_secure", false);
user_pref("signon.SignonFileName", "57703880.s");
user_pref("timebomb.first_launch_time", "1050624434656000");
user_pref("update_notifications.provider.0.last_checked", 1058734035);
user_pref("wallet.caveat", true);
user_pref("browser.startup.homepage", "http://www.znmktxblxgldixwxf.com/MLsd3Hqe7CDWAanJxPL4SfTfiwR
O1 - Hosts: ÿþ127.0.0.1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137448251431
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1137876668703
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Update Service (gupdate1c9c42bcd6b7d02) (gupdate1c9c42bcd6b7d02) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
–
End of file - 9440 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\EasyShare Registration Task.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2009-07-30 909040]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-23 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-09-23 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2009-07-30 159472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2009-07-30 909040]
Locked
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2002-10-16 114688]
"StorageGuard"=C:\Program Files\VERITAS Software\Update Manager\sgtray.exe [2002-06-18 155648]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2003-01-24 151597]
"PS2"=C:\WINDOWS\system32\ps2.exe [2002-07-31 81920]
"VTPreset"=C:\WINDOWS\system32\VTPreset.exe [2004-02-24 45056]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-10-14 155648]
"nwiz"=nwiz.exe /installquiet /keeploaded []
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-05-14 2029640]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-09-23 149280]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"=nview.dll,nViewLoadHook []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Documents and Settings\Owner\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2002-10-16 315392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"="C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 3 months======
2009-09-23 13:16:57 —-D—- C:\WINDOWS\Sun
2009-09-23 13:13:10 —-A—- C:\WINDOWS\system32\javaws.exe
2009-09-23 13:13:10 —-A—- C:\WINDOWS\system32\javaw.exe
2009-09-23 13:13:10 —-A—- C:\WINDOWS\system32\deploytk.dll
2009-09-23 13:13:09 —-A—- C:\WINDOWS\system32\java.exe
2009-09-23 12:56:20 —-D—- C:\_OTM
2009-09-20 16:10:29 —-D—- C:\Documents and Settings\Owner\Application Data\ESET
2009-09-20 16:04:56 —-D—- C:\Program Files\ESET
2009-09-20 16:04:56 —-D—- C:\Documents and Settings\All Users\Application Data\ESET
2009-09-18 10:47:55 —-D—- C:\Program Files\trend micro
2009-09-18 10:47:53 —-D—- C:\rsit
2009-09-15 14:01:57 —-A—- C:\WINDOWS\ntbtlog.txt
2009-09-15 12:54:25 —-D—- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2009-09-15 12:53:53 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-09-15 12:53:52 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-15 12:31:18 —-D—- C:\WINDOWS\ERDNT
2009-09-15 12:28:55 —-D—- C:\Program Files\ERUNT
2009-09-15 11:52:19 —-D—- C:\WINDOWS\ie8updates
2009-09-15 11:47:39 —-HDC—- C:\WINDOWS\ie8
2009-09-10 11:57:45 —-HDC—- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-10 11:57:38 —-HDC—- C:\WINDOWS\$NtUninstallKB956844$
2009-09-10 11:57:16 —-HDC—- C:\WINDOWS\$NtUninstallKB971961$
2009-08-26 14:27:02 —-HDC—- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-25 14:27:09 —-HDC—- C:\WINDOWS\$NtUninstallKB973869$
2009-08-25 14:26:51 —-HDC—- C:\WINDOWS\$NtUninstallKB973507$
2009-08-25 14:26:26 —-HDC—- C:\WINDOWS\$NtUninstallKB973815$
2009-08-21 19:27:49 —-HDC—- C:\WINDOWS\$NtUninstallKB960859$
2009-08-21 19:27:26 —-HDC—- C:\WINDOWS\$NtUninstallKB971657$
2009-08-21 19:27:04 —-HDC—- C:\WINDOWS\$NtUninstallKB971557$
2009-08-21 19:26:45 —-HDC—- C:\WINDOWS\$NtUninstallKB956744$
2009-08-21 19:26:22 —-HDC—- C:\WINDOWS\$NtUninstallKB973354$
2009-08-21 19:23:37 —-HDC—- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-07-16 05:23:30 —-HDC—- C:\WINDOWS\$NtUninstallKB973346$
2009-07-16 05:23:15 —-HDC—- C:\WINDOWS\$NtUninstallKB971633$
2009-07-16 05:20:01 —-HDC—- C:\WINDOWS\$NtUninstallKB961371$
======List of files/folders modified in the last 3 months======
2009-10-02 11:23:49 —-D—- C:\WINDOWS\Prefetch
2009-10-02 11:23:01 —-D—- C:\WINDOWS\Temp
2009-09-26 19:15:00 —-A—- C:\WINDOWS\SchedLgU.Txt
2009-09-24 10:09:59 —-SHD—- C:\WINDOWS\Installer
2009-09-24 10:09:28 —-D—- C:\Program Files\Google
2009-09-23 13:16:57 —-D—- C:\WINDOWS
2009-09-23 13:13:10 —-D—- C:\WINDOWS\system32
2009-09-23 13:12:29 —-D—- C:\Program Files\Java
2009-09-23 12:56:29 —-D—- C:\Program Files\Common Files
2009-09-23 12:56:28 —-RAD—- C:\Program Files
2009-09-20 18:40:52 —-D—- C:\WINDOWS\network diagnostic
2009-09-20 16:07:13 —-HD—- C:\WINDOWS\inf
2009-09-20 16:07:13 —-D—- C:\WINDOWS\system32\drivers
2009-09-20 16:05:42 —-D—- C:\WINDOWS\system32\CatRoot2
2009-09-19 13:26:52 —-D—- C:\Program Files\Common Files\Microsoft Shared
2009-09-19 13:26:51 —-SD—- C:\WINDOWS\Tasks
2009-09-19 13:26:01 —-D—- C:\Program Files\AWS
2009-09-19 13:25:10 —-HD—- C:\Program Files\InstallShield Installation Information
2009-09-19 12:54:46 —-SD—- C:\WINDOWS\system32\Microsoft
2009-09-18 13:18:13 —-D—- C:\WINDOWS\system32\FxsTmp
2009-09-18 12:21:32 —-AC—- C:\WINDOWS\system32\PerfStringBackup.INI
2009-09-18 10:29:58 —-RASH—- C:\boot.ini
2009-09-18 10:29:58 —-A—- C:\WINDOWS\win.ini
2009-09-18 10:29:57 —-A—- C:\WINDOWS\system.ini
2009-09-16 13:04:01 —-A—- C:\WINDOWS\imsins.BAK
2009-09-16 13:03:53 —-RASHDC—- C:\WINDOWS\system32\dllcache
2009-09-16 13:01:45 —-HD—- C:\WINDOWS\$hf_mig$
2009-09-15 11:55:56 —-D—- C:\WINDOWS\system32\en-US
2009-09-15 11:55:55 —-D—- C:\WINDOWS\Media
2009-09-15 11:55:55 —-D—- C:\WINDOWS\Help
2009-09-15 11:55:55 —-D—- C:\Program Files\Internet Explorer
2009-09-13 18:41:43 —-D—- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-08-28 17:38:20 —-A—- C:\WINDOWS\system32\MRT.exe
2009-08-21 19:26:25 —-D—- C:\Program Files\Outlook Express
2009-08-05 05:01:48 —-A—- C:\WINDOWS\system32\mswebdvd.dll
2009-07-19 19:48:58 —-A—- C:\WINDOWS\system32\ieframe.dll
2009-07-19 09:18:59 —-A—- C:\WINDOWS\system32\mshtml.dll
2009-07-17 15:01:06 —-A—- C:\WINDOWS\system32\atl.dll
2009-07-14 07:03:14 —-N—- C:\WINDOWS\system32\tzchange.exe
2009-07-13 11:08:14 —-A—- C:\WINDOWS\system32\wmpdxm.dll
2009-07-13 11:08:12 —-A—- C:\WINDOWS\system32\wmp.dll
2009-07-03 13:09:28 —-A—- C:\WINDOWS\system32\wininet.dll
2009-07-03 13:09:27 —-N—- C:\WINDOWS\system32\occache.dll
2009-07-03 13:09:27 —-A—- C:\WINDOWS\system32\urlmon.dll
2009-07-03 13:09:25 —-A—- C:\WINDOWS\system32\msfeedsbs.dll
2009-07-03 13:09:25 —-A—- C:\WINDOWS\system32\msfeeds.dll
2009-07-03 13:09:24 —-N—- C:\WINDOWS\system32\jsproxy.dll
2009-07-03 13:09:24 —-A—- C:\WINDOWS\system32\iertutil.dll
2009-07-03 13:09:23 —-N—- C:\WINDOWS\system32\iepeers.dll
2009-07-03 13:09:21 —-N—- C:\WINDOWS\system32\iedkcs32.dll
2009-07-03 07:01:06 —-N—- C:\WINDOWS\system32\ie4uinit.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-13 37760]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-05-14 55768]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-05-14 133000]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-05-14 33096]
R3 ltmodem5;LT Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2003-03-31 625537]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-11-20 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2002-07-30 23808]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2004-03-02 167040]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\System32\DRIVERS\wanatw4.sys [2001-09-27 28396]
S1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2002-10-25 91774]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2002-10-25 71514]
S3 EPUSBSTOR;EPSON USB Storage Driver; C:\WINDOWS\System32\DRIVERS\epusbsto.sys [2001-09-10 17976]
S3 hamachi_oem;PlayLinc Adapter; C:\WINDOWS\System32\DRIVERS\gan_adapter.sys [2006-09-27 10664]
S3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2002-10-25 80283]
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 rootrepeal[1];rootrepeal[1]; \??\C:\WINDOWS\system32\drivers\rootrepeal[1].sys []
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2005-11-28 229376]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\System32\wdfmgr.exe [2005-01-28 38912]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
S2 gupdate1c9c42bcd6b7d02;Google Update Service (gupdate1c9c42bcd6b7d02); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-23 133104]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-09-23 153376]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2002-12-12 65536]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-05-14 20680]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 KodakCCS;Kodak Camera Connection Software; C:\WINDOWS\system32\drivers\KodakCCS.exe []
S3 msCMTSrvc;Content Monitoring Tool; C:\WINDOWS\system32\msCMTSrvc.exe []
—————–EOF—————–
Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-10-02 11:27:54
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 50 GB (69%) free of 72 GB
Total RAM: 223 MB (20% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:04 AM, on 10/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Owner\Desktop\RSIT[1].exe
C:\Program Files\trend micro\Owner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!
user_pref("aim.session.firsttime", false);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.download.dir", "C:\\Documents and Settings\\Owner\\Desktop\\Games");
user_pref("browser.history.last_page_visited", "http://www.fileplanet.com/dropoff.aspx");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.1");
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("prefs.converted-to-utf8", true);
user_pref("security.warn_leaving_secure", false);
user_pref("signon.SignonFileName", "57703880.s");
user_pref("timebomb.first_launch_time", "1050624434656000");
user_pref("update_notifications.provider.0.last_checked", 1058734035);
user_pref("wallet.caveat", true);
user_pref("browser.startup.homepage", "http://www.znmktxblxgldixwxf.com/MLsd3Hqe7CDWAanJxPL4SfTfiwR
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!
user_pref("aim.session.firsttime", false);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.download.dir", "C:\\Documents and Settings\\Owner\\Desktop\\Games");
user_pref("browser.history.last_page_visited", "http://www.fileplanet.com/dropoff.aspx");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.1");
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("prefs.converted-to-utf8", true);
user_pref("security.warn_leaving_secure", false);
user_pref("signon.SignonFileName", "57703880.s");
user_pref("timebomb.first_launch_time", "1050624434656000");
user_pref("update_notifications.provider.0.last_checked", 1058734035);
user_pref("wallet.caveat", true);
user_pref("browser.startup.homepage", "http://www.znmktxblxgldixwxf.com/MLsd3Hqe7CDWAanJxPL4SfTfiwR
O1 - Hosts: ÿþ127.0.0.1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137448251431
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1137876668703
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Update Service (gupdate1c9c42bcd6b7d02) (gupdate1c9c42bcd6b7d02) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
–
End of file - 9440 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\EasyShare Registration Task.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2009-07-30 909040]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-23 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-09-23 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2009-07-30 159472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2009-07-30 909040]
Locked
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2002-10-16 114688]
"StorageGuard"=C:\Program Files\VERITAS Software\Update Manager\sgtray.exe [2002-06-18 155648]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2003-01-24 151597]
"PS2"=C:\WINDOWS\system32\ps2.exe [2002-07-31 81920]
"VTPreset"=C:\WINDOWS\system32\VTPreset.exe [2004-02-24 45056]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-10-14 155648]
"nwiz"=nwiz.exe /installquiet /keeploaded []
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-05-14 2029640]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-09-23 149280]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"=nview.dll,nViewLoadHook []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Documents and Settings\Owner\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2002-10-16 315392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"="C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 3 months======
2009-09-23 13:16:57 —-D—- C:\WINDOWS\Sun
2009-09-23 13:13:10 —-A—- C:\WINDOWS\system32\javaws.exe
2009-09-23 13:13:10 —-A—- C:\WINDOWS\system32\javaw.exe
2009-09-23 13:13:10 —-A—- C:\WINDOWS\system32\deploytk.dll
2009-09-23 13:13:09 —-A—- C:\WINDOWS\system32\java.exe
2009-09-23 12:56:20 —-D—- C:\_OTM
2009-09-20 16:10:29 —-D—- C:\Documents and Settings\Owner\Application Data\ESET
2009-09-20 16:04:56 —-D—- C:\Program Files\ESET
2009-09-20 16:04:56 —-D—- C:\Documents and Settings\All Users\Application Data\ESET
2009-09-18 10:47:55 —-D—- C:\Program Files\trend micro
2009-09-18 10:47:53 —-D—- C:\rsit
2009-09-15 14:01:57 —-A—- C:\WINDOWS\ntbtlog.txt
2009-09-15 12:54:25 —-D—- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2009-09-15 12:53:53 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-09-15 12:53:52 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-15 12:31:18 —-D—- C:\WINDOWS\ERDNT
2009-09-15 12:28:55 —-D—- C:\Program Files\ERUNT
2009-09-15 11:52:19 —-D—- C:\WINDOWS\ie8updates
2009-09-15 11:47:39 —-HDC—- C:\WINDOWS\ie8
2009-09-10 11:57:45 —-HDC—- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-10 11:57:38 —-HDC—- C:\WINDOWS\$NtUninstallKB956844$
2009-09-10 11:57:16 —-HDC—- C:\WINDOWS\$NtUninstallKB971961$
2009-08-26 14:27:02 —-HDC—- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-25 14:27:09 —-HDC—- C:\WINDOWS\$NtUninstallKB973869$
2009-08-25 14:26:51 —-HDC—- C:\WINDOWS\$NtUninstallKB973507$
2009-08-25 14:26:26 —-HDC—- C:\WINDOWS\$NtUninstallKB973815$
2009-08-21 19:27:49 —-HDC—- C:\WINDOWS\$NtUninstallKB960859$
2009-08-21 19:27:26 —-HDC—- C:\WINDOWS\$NtUninstallKB971657$
2009-08-21 19:27:04 —-HDC—- C:\WINDOWS\$NtUninstallKB971557$
2009-08-21 19:26:45 —-HDC—- C:\WINDOWS\$NtUninstallKB956744$
2009-08-21 19:26:22 —-HDC—- C:\WINDOWS\$NtUninstallKB973354$
2009-08-21 19:23:37 —-HDC—- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-07-16 05:23:30 —-HDC—- C:\WINDOWS\$NtUninstallKB973346$
2009-07-16 05:23:15 —-HDC—- C:\WINDOWS\$NtUninstallKB971633$
2009-07-16 05:20:01 —-HDC—- C:\WINDOWS\$NtUninstallKB961371$
======List of files/folders modified in the last 3 months======
2009-10-02 11:23:49 —-D—- C:\WINDOWS\Prefetch
2009-10-02 11:23:01 —-D—- C:\WINDOWS\Temp
2009-09-26 19:15:00 —-A—- C:\WINDOWS\SchedLgU.Txt
2009-09-24 10:09:59 —-SHD—- C:\WINDOWS\Installer
2009-09-24 10:09:28 —-D—- C:\Program Files\Google
2009-09-23 13:16:57 —-D—- C:\WINDOWS
2009-09-23 13:13:10 —-D—- C:\WINDOWS\system32
2009-09-23 13:12:29 —-D—- C:\Program Files\Java
2009-09-23 12:56:29 —-D—- C:\Program Files\Common Files
2009-09-23 12:56:28 —-RAD—- C:\Program Files
2009-09-20 18:40:52 —-D—- C:\WINDOWS\network diagnostic
2009-09-20 16:07:13 —-HD—- C:\WINDOWS\inf
2009-09-20 16:07:13 —-D—- C:\WINDOWS\system32\drivers
2009-09-20 16:05:42 —-D—- C:\WINDOWS\system32\CatRoot2
2009-09-19 13:26:52 —-D—- C:\Program Files\Common Files\Microsoft Shared
2009-09-19 13:26:51 —-SD—- C:\WINDOWS\Tasks
2009-09-19 13:26:01 —-D—- C:\Program Files\AWS
2009-09-19 13:25:10 —-HD—- C:\Program Files\InstallShield Installation Information
2009-09-19 12:54:46 —-SD—- C:\WINDOWS\system32\Microsoft
2009-09-18 13:18:13 —-D—- C:\WINDOWS\system32\FxsTmp
2009-09-18 12:21:32 —-AC—- C:\WINDOWS\system32\PerfStringBackup.INI
2009-09-18 10:29:58 —-RASH—- C:\boot.ini
2009-09-18 10:29:58 —-A—- C:\WINDOWS\win.ini
2009-09-18 10:29:57 —-A—- C:\WINDOWS\system.ini
2009-09-16 13:04:01 —-A—- C:\WINDOWS\imsins.BAK
2009-09-16 13:03:53 —-RASHDC—- C:\WINDOWS\system32\dllcache
2009-09-16 13:01:45 —-HD—- C:\WINDOWS\$hf_mig$
2009-09-15 11:55:56 —-D—- C:\WINDOWS\system32\en-US
2009-09-15 11:55:55 —-D—- C:\WINDOWS\Media
2009-09-15 11:55:55 —-D—- C:\WINDOWS\Help
2009-09-15 11:55:55 —-D—- C:\Program Files\Internet Explorer
2009-09-13 18:41:43 —-D—- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-08-28 17:38:20 —-A—- C:\WINDOWS\system32\MRT.exe
2009-08-21 19:26:25 —-D—- C:\Program Files\Outlook Express
2009-08-05 05:01:48 —-A—- C:\WINDOWS\system32\mswebdvd.dll
2009-07-19 19:48:58 —-A—- C:\WINDOWS\system32\ieframe.dll
2009-07-19 09:18:59 —-A—- C:\WINDOWS\system32\mshtml.dll
2009-07-17 15:01:06 —-A—- C:\WINDOWS\system32\atl.dll
2009-07-14 07:03:14 —-N—- C:\WINDOWS\system32\tzchange.exe
2009-07-13 11:08:14 —-A—- C:\WINDOWS\system32\wmpdxm.dll
2009-07-13 11:08:12 —-A—- C:\WINDOWS\system32\wmp.dll
2009-07-03 13:09:28 —-A—- C:\WINDOWS\system32\wininet.dll
2009-07-03 13:09:27 —-N—- C:\WINDOWS\system32\occache.dll
2009-07-03 13:09:27 —-A—- C:\WINDOWS\system32\urlmon.dll
2009-07-03 13:09:25 —-A—- C:\WINDOWS\system32\msfeedsbs.dll
2009-07-03 13:09:25 —-A—- C:\WINDOWS\system32\msfeeds.dll
2009-07-03 13:09:24 —-N—- C:\WINDOWS\system32\jsproxy.dll
2009-07-03 13:09:24 —-A—- C:\WINDOWS\system32\iertutil.dll
2009-07-03 13:09:23 —-N—- C:\WINDOWS\system32\iepeers.dll
2009-07-03 13:09:21 —-N—- C:\WINDOWS\system32\iedkcs32.dll
2009-07-03 07:01:06 —-N—- C:\WINDOWS\system32\ie4uinit.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-13 37760]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-05-14 55768]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-05-14 133000]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-05-14 33096]
R3 ltmodem5;LT Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2003-03-31 625537]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-11-20 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2002-07-30 23808]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2004-03-02 167040]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\System32\DRIVERS\wanatw4.sys [2001-09-27 28396]
S1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2002-10-25 91774]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2002-10-25 71514]
S3 EPUSBSTOR;EPSON USB Storage Driver; C:\WINDOWS\System32\DRIVERS\epusbsto.sys [2001-09-10 17976]
S3 hamachi_oem;PlayLinc Adapter; C:\WINDOWS\System32\DRIVERS\gan_adapter.sys [2006-09-27 10664]
S3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2002-10-25 80283]
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 rootrepeal[1];rootrepeal[1]; \??\C:\WINDOWS\system32\drivers\rootrepeal[1].sys []
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2005-11-28 229376]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\System32\wdfmgr.exe [2005-01-28 38912]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
S2 gupdate1c9c42bcd6b7d02;Google Update Service (gupdate1c9c42bcd6b7d02); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-23 133104]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-09-23 153376]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2002-12-12 65536]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-05-14 20680]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 KodakCCS;Kodak Camera Connection Software; C:\WINDOWS\system32\drivers\KodakCCS.exe []
S3 msCMTSrvc;Content Monitoring Tool; C:\WINDOWS\system32\msCMTSrvc.exe []
—————–EOF—————–
Dakeyras
Hi. 
It would be prudent to reset Mozilla FireFox however as follows and consider uninstalling the Netscape (7.0) browser as it is not particularly good and rather outdated these days in my humble opinion.
Launch the Mozilla FireFox >> Tools >> Main >> Restore to Default >> OK
StartUpLite:
Please download this small application from here.
It is very simple to use and quite effective and will advise about any unnecessary system startups that can be safely removed.
Next:
Let myself know if any further issues please, if not we can clean up the tools used during the malware removal process and I will provide some advice about online safety, thank you.
OK no problem I am prepared to give some leeway giving the actual situation.sorry D
Well this actual problem will relate to the lack of RAM(random access memory) presently installed on the system. Which I advised about here. I would run the scanner I recommended to see if the system can support upgraded memory modules…………even just installing another 256MB stick will help with overall performance.anyway the cpu seems to be running fine except explorer is slow to load
It would be prudent to reset Mozilla FireFox however as follows and consider uninstalling the Netscape (7.0) browser as it is not particularly good and rather outdated these days in my humble opinion.
Launch the Mozilla FireFox >> Tools >> Main >> Restore to Default >> OK
StartUpLite:
Please download this small application from here.
It is very simple to use and quite effective and will advise about any unnecessary system startups that can be safely removed.
Next:
Let myself know if any further issues please, if not we can clean up the tools used during the malware removal process and I will provide some advice about online safety, thank you.
Dakeyras
Due to inactivity this topic will be closed.
If you need help please start a new thread.
irma
Sorry D ……..I think I can get this done now….stay with me…almost there….
can't find fire fox anywhere…cpu seems much better after getting rid of startups….netscape been deleted thru add remove…whats next…
thanx again
Dakeyras
Hi.
Next:
Congratulations your computer now appears to be malware free!
Now I have some tasks for your good self to carry out as part of a clean up process and some advice about online safety.
Importance of Regular System Maintenance:
I advice you read both of the below listed topics as this will go a long way to keeping your Computer performing well. Plus bare in mind my prior advice about upgrading the presently installed RAM(Random Access Memory).
Help! My computer is slow!
Also so is this:
What to do if your Computer is running slowly
Clean up with OTM:
Any left over merely delete yourself and empty the Recycle Bin.
Reset the System Restore points:
Malwarebyte's Anti-Malware:
This is a excellent application and I advise you keep this installed. Check for updates and run a scan once a week.
Other installed security software:
Your presently installed combination security application ESET Smart Security automatically checks for updates and downloads/installs them with every system reboot and or periodically if the machine is left running providing a internet connection is active.
I advise you also run a complete scan with this also once per week.
Erunt:
Emergency Recovery Utility NT, I advice you keep this installed as a means to keep a complete backup of your registry and restore it when needed.
Myself I would actually create a new back up once per week as this along with System Restore may prove to be invaluable if something unforeseen occurs!
Keep your system updated:
Microsoft releases patches for Windows and other products regularly:
Windows by default allow scripts (which is VBScript and JavaScript) to run and some of these scripts are malicious. Use Noscript by Symantec or Script Defender by AnalogX to handle these scripts.
Avoid Peer to Peer software:
P2P may be a great way to get lots of seemingly freeware, but it is a great way to get infected as well. There's no way to tell if the file being shared is infected. Worse still, some worms spread via P2P networks, infecting you as well. My advice avoid these types of software applications.
Hosts File:
A Hosts file is like a phone book. You look up someone's name in the phone book before calling him/her. Similarly, your computer will look up the website's IP address before you can view the website.
Hosts file will replace your current Hosts file with another one containing well-known advertisement sites, spyware sites and other bad sites. This new Hosts file will protect you by re-directing these bad sites to 127.0.0.1.
Here are some Hosts files:
Finally a educational source:
To learn more about how to protect yourself while on the internet read this article by Tony Klein:
So how did I get infected in the first place?
Some consider this article outdated, personally I still think it bares relevance and the author is well respected in the Anti-Malware community and by myself also!
Any questions,feel free to ask? If not stay safe!
OK.Sorry D ……..I think I can get this done now….stay with me…almost there….
Has it been uninstalled then? Check in in the Add/Remove panel please, if still present we can perform the reset after the below. If not present then not a problem.can't find fire fox anywhere…cpu seems much better after getting rid of startups….netscape been deleted thru add remove…whats next…
Next:
Congratulations your computer now appears to be malware free!
Now I have some tasks for your good self to carry out as part of a clean up process and some advice about online safety.
Importance of Regular System Maintenance:
I advice you read both of the below listed topics as this will go a long way to keeping your Computer performing well. Plus bare in mind my prior advice about upgrading the presently installed RAM(Random Access Memory).
Help! My computer is slow!
Also so is this:
What to do if your Computer is running slowly
Clean up with OTM:
- Double-click OTM to start the program.
- Close all other programs apart from OTM as this step will require a reboot
- On the OTM main screen, press the CleanUp! button
- Say Yes to the prompt and then allow the program to reboot your computer.
Any left over merely delete yourself and empty the Recycle Bin.
Reset the System Restore points:
- Create a new, clean System Restore point which you can use in case of future system problems:
- Press Start >> All Programs >> Accessories >>System Tools >> System Restore
- Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
- Now remove old, infected System Restore points:
- Next click Start >> Run and type cleanmgr in the box and press OK
- Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
- Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
- Press OK and Yes to confirm
Malwarebyte's Anti-Malware:
This is a excellent application and I advise you keep this installed. Check for updates and run a scan once a week.
Other installed security software:
Your presently installed combination security application ESET Smart Security automatically checks for updates and downloads/installs them with every system reboot and or periodically if the machine is left running providing a internet connection is active.
I advise you also run a complete scan with this also once per week.
Erunt:
Emergency Recovery Utility NT, I advice you keep this installed as a means to keep a complete backup of your registry and restore it when needed.
Myself I would actually create a new back up once per week as this along with System Restore may prove to be invaluable if something unforeseen occurs!
Keep your system updated:
Microsoft releases patches for Windows and other products regularly:
- I advise you visit: http://update.microsoft.com/microsoftupdat…t.aspx?ln=en-us
- Install the Active X
- Once installed it will advise set Auto-Updates if not set and you then you will be able to manually check for updates also via:
- Start >> All Programs >> Microsoft Updates
- Never open email attachments, not even if they are from someone you know. If you need to open them, scan them with your antivirus program before opening.
- Never open emails from unknown senders.
- Beware of emails that warn about viruses that are spreading, especially those from antivirus vendors. These email addresses can be easily spoofed. Check the antivirus vendor websites to be sure.
- Be careful of what you download. Only download files from known sources. Also, avoid cracked programs. If you need a particular program that costs too much for you, try finding free alternatives on Sourceforge or Pricelessware.
Windows by default allow scripts (which is VBScript and JavaScript) to run and some of these scripts are malicious. Use Noscript by Symantec or Script Defender by AnalogX to handle these scripts.
Avoid Peer to Peer software:
P2P may be a great way to get lots of seemingly freeware, but it is a great way to get infected as well. There's no way to tell if the file being shared is infected. Worse still, some worms spread via P2P networks, infecting you as well. My advice avoid these types of software applications.
Hosts File:
A Hosts file is like a phone book. You look up someone's name in the phone book before calling him/her. Similarly, your computer will look up the website's IP address before you can view the website.
Hosts file will replace your current Hosts file with another one containing well-known advertisement sites, spyware sites and other bad sites. This new Hosts file will protect you by re-directing these bad sites to 127.0.0.1.
Here are some Hosts files:
- MVPS Hosts File
- Bluetack's Hosts File
- Bluetack's Host Manager
- hpHosts.
Finally a educational source:
To learn more about how to protect yourself while on the internet read this article by Tony Klein:
So how did I get infected in the first place?
Some consider this article outdated, personally I still think it bares relevance and the author is well respected in the Anti-Malware community and by myself also!
Any questions,feel free to ask? If not stay safe!
irma
thanx D for all your help……Sorry about the delay….you guys are the best
Dakeyras
Not a problem and you are most welcome!
I will leave this topic open for a few days in case any questions before I close it.
Stay safe.
Dakeyras
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI