Possible Trojan

Doug from your Windows forum suggested I try here. I ran all your diagnostics, as posted for 1st timers. Nothing jumped out as a virus or trojan during those runs. I am posting the 4 attachments from ARK, MBAM and Attach/DDS logs. My basic problem is PC runs like a snail much of the time (CPU shows at 100% usage—mostly by Explorer.EXE–although it hasn't exhbited this behavior in 24 hours). Since PC is not running poorly at this moment, I wonder if it's likely that any problems won't show up in the posted logs. Should I wait and repost when it slows down or do you see anything from the attached? I am running a 2 GB hard disk paging file. Hard drive is 150 GB and has 85GB available. PC has 1.25 GB of memory, 2GHz Pentium. Windows XP-SP3. Avast anti-virus for 5 days (before that AVG9). Thanks for your advice & help, LarryFromVegas

Hi,

there are no obvious signs of malware in your logs:

but I'd like to have one file analized, then have you do an online scan just to be certain:

Please do the following:

show hidden files and folders:

Start > "my computer" > Tools > Folder Options > View
check "show hidden files and folders"

then do this:

• Make sure to use Internet Explorer for this
• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
  
  • c:\docume~1\alluse~1\applic~1\ÝÃÄ™˜3113›.sys
• Click on the Upload button
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

NEXT


Using Internet Explorer or Firefox, visit Kaspersky Online Scanner:
1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.

• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
  [external image: Posted Image]
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

DONE! I'm attaching the reports from the on-line scans from VirScan.Org and Kaspersky. I'm hoping that all the questionable items flagged by Kas was already in my quarantine areas. BTW: It took around 15 hours to run Kas, partly because the CPU is running so slowly at 100% (my original reported symptom) and partly because it auto-scanned all mapped drives on that PC. It just so happens that each mapped drive is a sub-set of other physical drive physically located on another PC that is attached to the network. I look forward to your reply on how to get this PC cranking steadily. Thanks for all your help and suggestions thus far. LarryFromVegas

There are items that you want to delete - adware and email exploits.

Nothing that would account for your symptoms though:

These are the email locations:

Unfortunately - Kaspersky cannot identify which particular email is infected - therefore, you need to delete anything you don't need, delete the backups and make new backups.
Delete anything from anyone you don't know and anything with attchments such as jokes or videos.

G:\Larry Aaron\Files from Desktop 'Mark'\PST backup info from Larry's Desktop PC (Mark)\Outlook.pst
C:\Program Files\Common Files\System\MSMAPI\1033\Outlook Personal Folder2 (2003 format).pst
G:\PST Inactive-Closed\paula\Outlook.pst
G:\Sue Peterson\suep.pst


These are the infected files: Navigate to the locations > right click and delete: They were all bundled with adware - not desirable to have on your system.

C:\Documents and Settings\Larry\Desktop\IT In Process, Desktop\Wed Site Development Tools\FirstPage 2006-final-3.00 Webpage Developer setup (FREE).exe
C:\Documents and Settings\Larry2\Desktop\IT In Process, Desktop\Wed Site Development Tools\FirstPage 2006-final-3.00 Webpage Developer setup (FREE).exe
G:\Larry Aaron\Download & Installs\DONE 7-9-01 aaJavaScripter.exe
G:\Larry Aaron\Download & Installs\mors32 - MoreSpace HardDisk Utility.zip
G:\Larry Aaron\Download & Installs\Web Stripper.exe
G:\Larry Aaron\Files from Desktop 'Mark'\My Downloads & Installs\Download_CoffeeAnimator75R.exe
Z:\Download & Installs\mors32 - MoreSpace HardDisk Utility.zip
Z:\Download & Installs\Utility Software\Web Utilities, Search Engines, HTML Utilities & Browsers\DONE 7-9-01 aaJavaScripter.exe
Z:\Download & Installs\Utility Software\Web Utilities, Search Engines, HTML Utilities & Browsers\Web Stripper.exe


NEXT

when you have deleted the emails and adware files > delete the DDS and GMER folders/logs from your desktop.

set a new system restore point:

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it and click Create, when the confirmation screen shows the restore point has been created click Close.
Next goto Start Menu > Run > type (or copy and paste)

cleanmgr

Press OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once that's finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.
To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.


NEXT

Head back to your topic in the Tech Forum and advise them your issues do not appear to be malware related and link back to this topic.

good luck.