What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Baseline

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am trying to investigate why the PC has become so very slow offlate.
System I use is a INtel X86 based, 1.5GHz with Creative Audigy SB for audio and Radeon X1300 for display. I use it as a Home Theater and an entertainment server
Prior to running HJT, I have scanned using Malwarebyte's Anti-Malware and Spybot

Here is my HJT log..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:28:56 PM, on 12/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Rogers Online Protection\Rogers Online Protection\pkR.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RogersServicepointAgent.exe] "C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe" /AUTORUN
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.anandabazar.com/wfplayer/tdserver.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232666190781
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: Rogers Online Protection (Radialpoint Security Services) - Rogers - C:\Program Files\Rogers Online Protection\Rogers Online Protection\RpsSecurityAwareR.exe
O23 - Service: Rogers Online Protection SafeConnectAgent (RadialpointSafeConnectAgent) - Sana Security - C:\Program Files\Rogers Online Protection\Rogers Online Protection\SafeConnect\Bin\SanaAgent.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Rogers Online Protection Firewall (RP_FWS) - Rogers - C:\Program Files\Rogers Online Protection\Rogers Online Protection\Fws.exe

–
End of file - 9170 bytes
Post #2
Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #4
Hi,

There are no obvious signs of malware in your logs, there are a couple of files i would like to get scanned:
  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:

    c:\windows\is-3IOGQ.lst

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Please follow the same procedure for the following files:

c:\windows\is-3IOGQ.msg
c:\windows\is-3IOGQ.exe


Can you please give more detail about the slowness, is it overall performance? Only when you are on line or something else?

What CD emulation software are you using? The drivers are present, but I'm not clear on the software?

Have you given the computer a thorough cleaning for dust and debris.

Have you defragged lately?

The event log indicates there may be an issue with your NIC Have you gone online and searched if there are any updates to your NIC driver?



Please do this online scan as well:

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner:

1. Click Accept, when prompted to download and install the program files and database of malware definitions.


2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]

  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #5
VirSCAN.org Scanned Report :
Scanned time : 2009/12/08 18:21:03 (CST)
Scanner results: Scanners did not find malware!
File Name : is-3IOGQ.lst
File Size : 362 byte
File Type : ASCII English text, with CRLF line terminators
MD5 : beb34246798bc18e0f492f3ff030f795
SHA1 : ff3e839a3789a4cb3f1d0fc70ef0b9a7844bd1d6
Online report : http://virscan.org/report/cd9b2c45c535eb69…6ec84d1838.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20091209053146 2009-12-09 4.07 -
AhnLab V3 2009.12.09.00 2009.12.09 2009-12-09 0.95 -
AntiVir 8.2.1.102 7.10.1.201 2009-12-08 0.15 -
Antiy 2.0.18 20091204.3347676 2009-12-04 0.12 -
Arcavir 2009 200912081456 2009-12-08 0.02 -
Authentium 5.1.1 200912081615 2009-12-08 1.20 -
AVAST! 4.7.4 091208-1 2009-12-08 0.00 -
AVG 8.5.288 270.14.99/2553 2009-12-09 0.31 -
BitDefender 7.81008.4704403 7.29362 2009-12-09 4.01 -
CA (VET) 35.1.0 7164 2009-12-07 7.94 -
ClamAV 0.95.2 10128 2009-12-09 0.01 -
Comodo 3.13 3185 2009-12-08 0.95 -
CP Secure 1.3.0.5 2009.12.04 2009-12-04 0.00 -
Dr.Web 4.44.0.9170 2009.12.08 2009-12-08 7.46 -
F-Prot 4.4.4.56 20091208 2009-12-08 1.20 -
F-Secure 7.02.73807 2009.12.08.12 2009-12-08 0.06 -
Fortinet 11.139- 11.139 2009-12-08 0.18 -
GData 19.9216/19.612 20091208 2009-12-08 6.80 -
ViRobot 20091208 2009.12.08 2009-12-08 0.43 -
Ikarus T3.1.01.74 2009.12.08.74700 2009-12-08 4.19 -
JiangMin 13.0.900 2009.12.02 2009-12-02 5.37 -
Kaspersky 5.5.10 2009.12.08 2009-12-08 0.03 -
KingSoft 2009.2.5.15 2009.12.8.23 2009-12-08 0.70 -
McAfee 5.3.00 5826 2009-12-08 3.30 -
Microsoft 1.5302 2009.12.09 2009-12-09 6.53 -
Norman 6.01.09 6.01.00 2009-12-08 4.00 -
Panda 9.05.01 2009.12.07 2009-12-07 3.92 -
Trend Micro 9.000-1003 6.680.08 2009-12-08 0.02 -
Quick Heal 10.00 2009.12.08 2009-12-08 2.04 -
Rising 20.0 22.25.01.09 2009-12-08 0.34 -
Sophos 3.02.0 4.48 2009-12-09 2.72 -
Sunbelt 3.9.2381.2 5550 2009-12-08 2.18 -
Symantec 1.3.0.24 20091208.002 2009-12-08 0.17 -
nProtect 20091208.02 6530937 2009-12-08 4.67 -
The Hacker 6.5.0.2 v00088 2009-12-07 0.94 -
VBA32 3.12.12.0 20091208.1706 2009-12-08 2.38 -
VirusBuster 4.5.11.10 10.115.4/2011277 2009-12-08 2.41 -

VirSCAN.org Scanned Report :
Scanned time : 2009/12/08 18:31:37 (CST)
Scanner results: Scanners did not find malware!
File Name : is-3IOGQ.msg
File Size : 10498 byte
File Type : data
MD5 : e16b6cbcff1928e0312b8319eee7680e
SHA1 : ce5bea7cf69310b09e483fa110fedd7d4116f3d1
Online report : http://virscan.org/report/44ea3a660ccc0d9a…d9dadad1f1.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20091209053146 2009-12-09 4.43 -
AhnLab V3 2009.12.09.00 2009.12.09 2009-12-09 1.11 -
AntiVir 8.2.1.102 7.10.1.201 2009-12-08 0.38 -
Antiy 2.0.18 20091204.3347676 2009-12-04 0.12 -
Arcavir 2009 200912081456 2009-12-08 0.02 -
Authentium 5.1.1 200912081615 2009-12-08 1.22 -
AVAST! 4.7.4 091208-1 2009-12-08 0.00 -
AVG 8.5.288 270.14.99/2553 2009-12-09 0.34 -
BitDefender 7.81008.4704403 7.29362 2009-12-09 4.04 -
CA (VET) 35.1.0 7164 2009-12-07 7.13 -
ClamAV 0.95.2 10128 2009-12-09 0.01 -
Comodo 3.13 3185 2009-12-08 0.93 -
CP Secure 1.3.0.5 2009.12.04 2009-12-04 0.01 -
Dr.Web 4.44.0.9170 2009.12.08 2009-12-08 7.54 -
F-Prot 4.4.4.56 20091208 2009-12-08 1.20 -
F-Secure 7.02.73807 2009.12.08.12 2009-12-08 0.06 -
Fortinet 11.139- 11.139 2009-12-08 0.46 -
GData 19.9216/19.612 20091208 2009-12-08 5.87 -
ViRobot 20091208 2009.12.08 2009-12-08 0.41 -
Ikarus T3.1.01.74 2009.12.08.74700 2009-12-08 4.17 -
JiangMin 13.0.900 2009.12.02 2009-12-02 6.43 -
Kaspersky 5.5.10 2009.12.08 2009-12-08 0.03 -
KingSoft 2009.2.5.15 2009.12.8.23 2009-12-08 0.55 -
McAfee 5.3.00 5826 2009-12-08 3.29 -
Microsoft 1.5302 2009.12.09 2009-12-09 7.95 -
Norman 6.01.09 6.01.00 2009-12-08 4.00 -
Panda 9.05.01 2009.12.07 2009-12-07 2.57 -
Trend Micro 9.000-1003 6.680.08 2009-12-08 0.03 -
Quick Heal 10.00 2009.12.08 2009-12-08 2.06 -
Rising 20.0 22.25.01.09 2009-12-08 0.27 -
Sophos 3.02.0 4.48 2009-12-09 2.79 -
Sunbelt 3.9.2381.2 5550 2009-12-08 2.10 -
Symantec 1.3.0.24 20091208.002 2009-12-08 0.23 -
nProtect 20091208.02 6530937 2009-12-08 3.87 -
The Hacker 6.5.0.2 v00088 2009-12-07 0.68 -
VBA32 3.12.12.0 20091208.1706 2009-12-08 2.21 -
VirusBuster 4.5.11.10 10.115.4/2011277 2009-12-08 2.36 -

VirSCAN.org Scanned Report :
Scanned time : 2009/12/08 18:34:16 (CST)
Scanner results: Scanners did not find malware!
File Name : is-3IOGQ.exe
File Size : 696832 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : d96a20b622cc07d297e2013b94c41ad2
SHA1 : 94a7ecde328f3fead2ce74d69859a2351d72f1d0
Online report : http://virscan.org/report/ac1f1352b57d511e…d66b584485.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20091209053146 2009-12-09 10.54 -
AhnLab V3 2009.12.09.00 2009.12.09 2009-12-09 1.07 -
AntiVir 8.2.1.102 7.10.1.201 2009-12-08 0.52 -
Antiy 2.0.18 20091204.3347676 2009-12-04 0.12 -
Arcavir 2009 200912081456 2009-12-08 0.11 -
Authentium 5.1.1 200912081615 2009-12-08 3.26 -
AVAST! 4.7.4 091208-1 2009-12-08 0.06 -
AVG 8.5.288 270.14.99/2553 2009-12-09 0.36 -
BitDefender 7.81008.4704403 7.29362 2009-12-09 4.04 -
CA (VET) 35.1.0 7164 2009-12-07 5.56 -
ClamAV 0.95.2 10128 2009-12-09 0.16 -
Comodo 3.13 3185 2009-12-08 0.91 -
CP Secure 1.3.0.5 2009.12.04 2009-12-04 0.11 -
Dr.Web 4.44.0.9170 2009.12.08 2009-12-08 7.88 -
F-Prot 4.4.4.56 20091208 2009-12-08 3.05 -
F-Secure 7.02.73807 2009.12.08.12 2009-12-08 0.17 -
Fortinet 11.139- 11.139 2009-12-08 0.26 -
GData 19.9216/19.612 20091208 2009-12-08 5.80 -
ViRobot 20091208 2009.12.08 2009-12-08 0.42 -
Ikarus T3.1.01.74 2009.12.08.74700 2009-12-08 4.54 -
JiangMin 13.0.900 2009.12.02 2009-12-02 4.44 -
Kaspersky 5.5.10 2009.12.08 2009-12-08 0.11 -
KingSoft 2009.2.5.15 2009.12.8.23 2009-12-08 0.54 -
McAfee 5.3.00 5826 2009-12-08 3.46 -
Microsoft 1.5302 2009.12.09 2009-12-09 7.12 -
Norman 6.01.09 6.01.00 2009-12-08 4.00 -
Panda 9.05.01 2009.12.07 2009-12-07 2.06 -
Trend Micro 9.000-1003 6.680.08 2009-12-08 0.04 -
Quick Heal 10.00 2009.12.08 2009-12-08 1.60 -
Rising 20.0 22.25.01.09 2009-12-08 1.16 -
Sophos 3.02.0 4.48 2009-12-09 2.79 -
Sunbelt 3.9.2381.2 5550 2009-12-08 2.19 -
Symantec 1.3.0.24 20091208.002 2009-12-08 0.06 -
nProtect 20091208.02 6530937 2009-12-08 4.18 -
The Hacker 6.5.0.2 v00088 2009-12-07 0.90 -
VBA32 3.12.12.0 20091208.1706 2009-12-08 2.64 -
VirusBuster 4.5.11.10 10.115.4/2011277 2009-12-08 6.46 -
*****************
The above is the virscan report.
The overall speed seems to be slow - like, when opening a file or even the my computer or my documents folder, when starting the browser or opening any program, at times it takes a long time while the disk light keeps flickering and makes the access sound. I tried to run the Kaspersky scan but the updates failed. I will try it once again later and let you know the result. YEs, the disk has been defragmented.

CD emulation software - I am not sure how to find this.. I guess some emulator is in use because I see 4 virtual drives created on my PC and this happened when my daughter had loaded the sims2 game… Can this affect?.. How do I find which emulation software is in use?

The NIC that I use is RAlink RT73.. There is no driver update available on line.
Post #6 last edited
To see what drivers are installed.

Go to Start > Run copy/paste the following command devmgmt.msc into the run box > OK to launch the Device Manager. Expand the "CD/DVD Drives" category in the Device Manager to reveal the adapter for each physical and virtual disc drive on your computer.

This shouldn't have any bearing on the speed of your computer unless there are any 'trouble' indicators. (yellow or red triangles with exclamation marks)

If you cannot get kaspersky to run, please try this other scanner;

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Post #7
Thank you, Catbyte for all the help so far. The drivers for the CD/DVD drives are Microsoft 5.1.2535.0 The ESET scan result is attached. It found and cleaned 7 threats …. it took more than 12 hours to complete… Is it normal or is it because of the slow performance?;… could not run kaspersky; tried twice but it failed during the update process. tnmy2000

Attachments:

Post #9
Appreciate your quick response.. Here are the DDS files attached There certainly has been some noticeable improvement in performance,,,, Do you think ESET scan did it? Do you recommend this tool for future use as well?… I generally use Malwarebytes, noadware , ccleaner and avira… tnmy2000

Attachments:

Post #10
An online scanner is OK to use, but you have a good antivirus in Avira, so I would stick with that.

Your logs are clean,

just some house keeping to do now:

Download and run Auslogics Disc Defragmenter

NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.2)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT


[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 17. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]




NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox, IE and chrome.

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #11
Dear Catbyte… Thanks for your time…. The tips have been useful and I do notice an overall improvement in performance though I will have to keep it under onservation for some time… For the time being this thread may be treated as closed,
Post #13
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI