molongriff
Topic Starter
I am trying to help a friend with a problem. She seems to have a programme called PC Power Speed installed on her system, which she did not install and which tells her that she has loads of registry problems. I suspect this is fake software. Also her McAfee security software has been deactivated. I contacted McAfee via her computer, using their chat function, and they had a look at it, but failed to sort the problem before we got disconnected. I was then unable to get back to their chat because IE kept having problems before I could get there. (It now seems to freeze rather often). I also installed MalwareBytes, updated and ran it, then re-ran it in safe mode, but it found nothing. (Maybe I should also have installed it in safe mode?)
PC Power Speed appears as if it is a a normal programme, and I wondered if I could simply uninstall it or somehow delete it, but I am concerned that it may not allow me to do so or that bits of it may get left behind . It appears in the start menu, but there is not an icon for it on the desktop. I suspect, but don't know for sure, that it is causing the problem with McAfee.
As it is not my computer, I don't want to do anything risky.
I have run DDS and the results are as follows:
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 11:42:41.10 on 08/10/2011
Internet Explorer: 7.0.6000.16982
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.44.1033.18.1982.1262 [GMT 1:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\PCPowerSpeed\PCPowerTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\Edna Stewart\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\RebateInformer\RebateInf.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10w_ActiveX.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Edna Stewart\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.inbox.com/homepage.aspx?tbid=80269&lng=en
uWindow Title = Internet Explorer provided by Dell
mSearchAssistant = hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80269&lng=en
mCustomizeSearch = hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80269
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program
files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AppGraffiti: {6f6a5334-78e9-4d9b-8182-8b41ea8c39ef} - c:\progra~1\appgra~1
\APPGRA~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program
files\java\jre1.6.0\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common
files\mcafee\systemcore\ScriptSn.20110819113044.dll
BHO: ALOT Appbar Helper: {85f5cf95-ec8f-49fc-bb3f-38c79455cba2} - c:\program
files\alotappbar\bin\ALOTHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program
files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program
files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1
\mcafee\sitead~1\mcieplg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program
files\dell\bae\BAE.dll
BHO: : {ccb69577-088b-4004-9ed8-ff5bcc83a039} - c:\progra~1\rebate~1\RebateI.dll
BHO: Inbox Toolbar: {d3d233d5-9f6d-436c-b6c7-e63f77503b30} - c:\progra~1\inboxt~1\Inbox.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1
\mcafee\sitead~1\mcieplg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google
toolbar\GoogleToolbar_32.dll
TB: &Inbox Toolbar: {d7e97865-918f-41e4-9cd0-25ab1c574ce8} - c:\progra~1\inboxt~1\Inbox.dll
TB: ALOT Appbar: {a531d99c-5a22-449b-83da-872725c6d0ed} - c:\program
files\alotappbar\bin\ALOTHelper.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [EPSON Stylus Photo RX585 Series] c:\windows\system32\spool\drivers\w32x86\3
\e_faticle.exe /fu "c:\windows\temp\E_S4D54.tmp" /EF "HKCU"
uRun: [Google Update] "c:\users\edna stewart\appdata\local\google\update\GoogleUpdate.exe"
/c
uRun: [RebateInformer] c:\progra~1\rebate~1\REBATE~1.EXE /STARTUP
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0\bin\jusched.exe"
mRun: []
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0
\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [PCPowerSpeed] "c:\program files\pcpowerspeed\PCPowerTray.exe" /startup
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google
toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} -
c:\program files\java\jre1.6.0\bin\npjpi160.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} -
c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} -
c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} -
c:\windows\windowsmobile\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} -
c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: internet
Trusted Zone: mcafee.com
Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - c:\program
files\tiscali\tiscali internet\dlls\tiscalifilter.dll
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1
\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1
\McIEPlg.dll
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - c:\progra~1\inboxt~1\Inbox.dll
Handler: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - c:\progra~1\rebate~1
\RebateI.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1
\McIEPlg.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2011-3-13 459728]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2011-8-12
64648]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2011-8-12 89368]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\common
files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2011-8-12 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common
files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2011-8-12 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common
files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2011-8-12 214904]
R2 McProxy;McAfee Proxy Service;"c:\program files\common
files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2011-8-12 214904]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe
[2011-8-12 165000]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common
files\mcafee\systemcore\mfefire.exe [2011-8-12 159832]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011
-8-12 148520]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-8-12 57432]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2011-8-12 179248]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2011-8-12 59288]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-8-12
337912]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe
[2011-6-14 135664]
S3 gupdatem;Google Update Service (gupdatem);c:\program
files\google\update\GoogleUpdate.exe [2011-6-14 135664]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-8-12 85984]
.
=============== Created Last 30 ================
.
2011-10-07 17:12:25 ——– d—–w- c:\progra~2\Citrix
2011-10-07 17:07:51 ——– d—–w- c:\program files\Citrix
2011-10-07 17:06:42 ——– d—–w- c:\users\ednast~1
\appdata\local\Citrix
2011-10-07 17:06:37 103784 —-a-w- c:\users\edna
stewart\GoToAssistDownloadHelper.exe
2011-10-07 17:06:14 ——– d—–w- c:\users\ednast~1
\appdata\local\Deployment
2011-10-07 17:06:14 ——– d—–w- c:\users\ednast~1
\appdata\local\Apps
2011-10-07 16:47:09 ——– d—–w- c:\users\ednast~1
\appdata\roaming\McAfee
2011-10-07 16:03:16 ——– d—–w- c:\users\ednast~1
\appdata\roaming\Malwarebytes
2011-10-07 16:03:08 ——– d—–w- c:\progra~2\Malwarebytes
2011-10-07 16:03:04 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-10-07 16:03:03 ——– d—–w- c:\program files\Malwarebytes'
Anti-Malware
2011-10-01 10:49:36 ——– d—–w- c:\program files\alotappbar
2011-09-27 10:46:38 ——– d—–w- c:\program files\AppGraffiti
2011-09-27 10:46:36 ——– d—–w- c:\users\ednast~1
\appdata\roaming\PCPowerSpeed
2011-09-27 10:46:36 ——– d—–w- c:\progra~2\PCPowerSpeed
2011-09-27 10:46:34 ——– d—–w- c:\program files\PCPowerSpeed
2011-09-27 10:37:42 ——– d—–w- c:\program files\Inbox.com
2011-09-27 10:37:41 ——– d—–w- c:\program files\RebateInformer
2011-09-27 10:36:14 ——– d—–w- c:\program files\Inbox Toolbar
.
==================== Find3M ====================
.
2011-08-29 19:03:45 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 11:43:27.19 ===============
