What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

computer taking forever to loadup [Closed]

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hi guys my computer is very slow to start and load up pages it also freezes for a couple of seconds sometimes all help appreciated

hijack this log attached

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:29:58, on 07/02/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Users\Martin\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Windows\system32\UI0Detect.exe
C:\Users\Martin\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…;m=extensa_5230
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…;m=extensa_5230
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…;m=extensa_5230
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\partner.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKCU\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll
O20 - AppInit_DLLs: C:\PROGRA~1\GOOGLE\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe

–
End of file - 9078 bytes
Post #2 last edited
Hello mushey and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan
Post #3 last edited
Hello again mushey

There is nothing bad showing up in your log but you have McAfee on your computer as well as AVG. This is probably causing the problems.

If you didn’t knowingly install McAfee, it was probably installed when you updated Flash or Java.

Whichever, I suggest you uninstall it. You can do this via Start, Control Panel, Programs, and then Programs and Features.

===================================================

Just to be sure there isn't another cause, let's run a couple of deeper scans.

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

• disable any script blocking protection (How to Disable your Security Programs)
• double click DDS icon to run the tool (may take up to 3 minutes to run)
• when done, DDS.txt will open.
• after a few moments, attach.txt will open in a second window.
• save both reports to your desktop.
• Post the contents of the DDS.txt and Attach.txt reports in your next reply
===================================================

Run aswMBR
  • download aswMBR.exe to your desktop.
  • double click the aswMBR.exe to run it
  • if asked, accept the AVAST virus definition download
  • click the "Scan" button to start scan
  • on completion of the scan click Save log, save it to your desktop and post in your next reply
Logs to include with next post:

DDS.txt
Attach.txt
aswMBR log

Thanks

Satchfan
Post #4
hi there Satchfan, thanks for taking time to have a look at my post. I have removed McAfee as suggested and attached log files. . DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 17:14:15 on 2012-02-09 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.353.1033.18.952.293 [GMT 0:00] . AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\PROGRA~1\AVG\AVG2012\avgrsx.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe C:\Program Files\Acer\Empowering Technology\Service\ETService.exe C:\Program Files\AVG\AVG2012\avgnsx.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Acer\Mobility Center\MobilityService.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Windows\RtHDVCpl.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\igfxsrvc.exe C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\alg.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\AVG Secure Search\vprot.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Users\Martin\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\conime.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1809&s=2&o=vz32&d=0309&m=extensa_5230 uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1809&s=2&o=vz32&d=0309&m=extensa_5230 mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1809&s=2&o=vz32&d=0309&m=extensa_5230 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll BHO: Partner BHO Class: {83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} - c:\programdata\partner\partner.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - c:\progra~1\flashfxp\IEFlash.dll TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll {e7df6bff-55a5-4eb7-a673-4ed3e9456d39} uRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe" uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Google Update] "c:\users\martin\appdata\local\google\update\GoogleUpdate.exe" /c mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [BkupTray] "c:\program files\newtech infosystems\nti backup now 5\BkupTray.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [LManager] c:\progra~1\launch~1\LManager.exe mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" mRun: [vProt] "c:\program files\avg secure search\vprot.exe" mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{14CBCD23-836E-4D16-8E5D-5A14F2126D11} : DhcpNameServer = [removed] 8.8.8.8 TCP: Interfaces\{45F28548-3ECF-4CF1-A15E-2459F4ECC136} : DhcpNameServer = [removed] 8.8.8.8 TCP: Interfaces\{A1D2FC69-47A7-43DE-8412-FAB258803D5B} : DhcpNameServer = [removed] 8.8.8.8 TCP: Interfaces\{E5139895-6A35-4399-9E8A-61D45BA34CD1} : DhcpNameServer = 192.168.1.1 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\10.0.6\ViProtocol.dll Notify: igfxcui - igfxdev.dll AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384] R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2009-2-3 24576] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-7 50424] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-4 131072] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032] R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\10.0.6\ToolbarUpdater.exe [2012-1-25 909152] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-3-28 210432] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-3-13 112128] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664] S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-3-17 113664] S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-7-15 30192] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664] S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2011-3-17 101120] S3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\drivers\TpChoice.sys [2008-5-13 17968] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-02-08 16:28:05 6557240 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{ddc5ef4b-ba1b-4aee-b03b-2426d0ca9b6e}\mpengine.dll 2012-01-20 18:31:21 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat 2012-01-20 18:28:57 72704 —-a-w- c:\windows\system32\secur32.dll 2012-01-20 18:28:56 9728 —-a-w- c:\windows\system32\lsass.exe 2012-01-20 18:28:56 278528 —-a-w- c:\windows\system32\schannel.dll 2012-01-20 18:28:55 377344 —-a-w- c:\windows\system32\winhttp.dll 2012-01-20 18:28:55 1259008 —-a-w- c:\windows\system32\lsasrv.dll 2012-01-20 18:28:54 440192 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-01-19 21:11:48 189952 —-a-w- c:\windows\system32\winmm.dll 2012-01-19 21:11:47 23552 —-a-w- c:\windows\system32\mciseq.dll 2012-01-19 21:11:04 66560 —-a-w- c:\windows\system32\packager.dll 2012-01-19 21:10:52 376320 —-a-w- c:\windows\system32\winsrv.dll 2012-01-19 21:09:01 1314816 —-a-w- c:\windows\system32\quartz.dll 2012-01-19 21:09:00 497152 —-a-w- c:\windows\system32\qdvd.dll 2012-01-19 20:59:00 1205064 —-a-w- c:\windows\system32\ntdll.dll . ==================== Find3M ==================== . 2012-01-29 05:10:42 237072 ——w- c:\windows\system32\MpSigStub.exe 2011-11-23 13:37:27 2043904 —-a-w- c:\windows\system32\win32k.sys . ============= FINISH: 17:15:43.35 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-23.01) . Microsoft® Windows Vista™ Business Boot Device: \Device\HarddiskVolume2 Install Date: 13/03/2009 13:56:19 System Uptime: 09/02/2012 16:49:50 (1 hours ago) . Motherboard: Acer | | Homa Processor: Genuine Intel® CPU 585 @ 2.16GHz | U2E1 | 2161/166mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 70 GiB total, 27.817 GiB free. D: is FIXED (NTFS) - 70 GiB total, 69.216 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Acer Empowering Technology Acer ePower Management Acer eRecovery Management Acer GridVista Acer Mobility Center Plug-In Acer Product Registration Acer ScreenSaver Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Reader 9 Amazing Adventures The Lost Tomb 1.0.0.5 Apple Application Support Apple Mobile Device Support Apple Software Update AVG 2012 AVG PC Tuneup 2011 AVG Security Toolbar Big Fish Games: Game Manager Bonjour Broadcom Gigabit Integrated Controller Business Contact Manager for Outlook 2007 SP2 Canon iP1900 series Printer Driver Canon iP1900 series User Registration Canon Utilities Easy-PhotoPrint EX Canon Utilities My Printer Canon Utilities Solution Menu Choice Guard Compatibility Pack for the 2007 Office system eSobi v2 Facebook Video Calling 1.1.1.1 FlashFXP v3 Google Chrome Google Desktop Google Toolbar for Internet Explorer Google Update Helper Hidden Expedition: Amazon ™ Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Graphics Media Accelerator Driver InterVideo WinDVD 8 iTunes Junk Mail filter update Launch Manager Licensing Service Install LightScribe 1.4.142.1 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Application Error Reporting Microsoft Office 2003 Web Components Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access Runtime (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Edition 2003 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Small Business 2007 Microsoft Office Small Business Connectivity Components Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mobile Partner MSVC80_x86 MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nokia Connectivity Cable Driver Nokia PC Suite NTI Backup Now 5 NTI Backup Now Standard NTI Media Maker 8 NTI Shadow O2 Broadband O2 Broadband USB Modem QuickTime RealNetworks - Microsoft Visual C++ 2005 Runtime RealPlayer Realtek High Definition Audio Driver Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2288931) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB2553089) Security Update for 2007 Microsoft Office System (KB2553090) Security Update for 2007 Microsoft Office System (KB2584063) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) Synaptics Pointing Device Driver Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596686) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office 2007 System (KB2539530) Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Outlook 2007 (KB2583910) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Windows Driver Package - Nokia Modem (02/23/2009 7.01.0.2) Windows Driver Package - Nokia Modem (02/24/2009 4.0) Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Live Writer . ==== Event Viewer Messages From Past Week ======== . 09/02/2012 16:51:52, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 09/02/2012 16:51:29, Error: Microsoft-Windows-SharedAccess_NAT [34001] - The ICS_IPV6 failed to configure IPv6 stack. 09/02/2012 16:51:29, Error: Microsoft-Windows-SharedAccess_NAT [30013] - The DHCP allocator has disabled itself on IP address 192.168.1.103, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope. 09/02/2012 16:50:43, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\Martin\AppData\Local\Microsoft\Windows\UsrClass.dat' was corrupted and it has been recovered. Some data might have been lost. 09/02/2012 11:04:25, Error: Microsoft-Windows-SharedAccess_NAT [30013] - The DHCP allocator has disabled itself on IP address 192.168.1.101, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope. 08/02/2012 15:52:19, Error: Microsoft-Windows-SharedAccess_NAT [30013] - The DHCP allocator has disabled itself on IP address 192.168.1.100, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope. 07/02/2012 20:02:15, Error: Microsoft-Windows-SharedAccess_NAT [30013] - The DHCP allocator has disabled itself on IP address 192.168.1.102, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope. 07/02/2012 20:01:53, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.203 for the Network Card with network address 00242BB9E2AD has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 07/02/2012 19:48:52, Error: bowser [8003] - The master browser has received a server announcement from the computer VODAFONE that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E5139895-6A35-4399-9E8A-61D45BA34. The master browser is stopping or an election is being forced. 07/02/2012 19:45:20, Error: Microsoft-Windows-SharedAccess_NAT [30009] - The DHCP allocator encountered a network error while attempting to reply on IP address 0.0.0.0 to a request from a client. The data is the error code. 07/02/2012 19:45:20, Error: Microsoft-Windows-SharedAccess_NAT [30005] - The DHCP allocator has detected a DHCP server with IP address 192.168.0.1 on the same network as the interface with IP address 192.168.0.203. The allocator has disabled itself on the interface to avoid confusing DHCP clients. . ==== End Of File =========================== aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software Run date: 2012-02-09 17:20:05 —————————– 17:20:05.411 OS Version: Windows 6.0.6002 Service Pack 2 17:20:05.411 Number of processors: 1 586 0xF0D 17:20:05.427 ComputerName: MARTIN-PC UserName: Martin 17:20:08.719 Initialize success 17:20:34.637 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 17:20:34.637 Disk 0 Vendor: Hitachi_HTS543216L9A300 FB2OC40C Size: 152627MB BusType: 3 17:20:34.668 Disk 0 MBR read successfully 17:20:34.668 Disk 0 MBR scan 17:20:34.668 Disk 0 unknown MBR code 17:20:34.683 Disk 0 Partition 1 00 27 Hidden NTFS WinRE MSDOS5.0 10000 MB offset 2048 17:20:34.683 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 71317 MB offset 20482048 17:20:34.715 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 71308 MB offset 166539264 17:20:34.715 Disk 0 scanning sectors +312578048 17:20:34.793 Disk 0 scanning C:\Windows\system32\drivers 17:20:43.934 Service scanning 17:20:45.947 Modules scanning 17:21:11.281 Disk 0 trace - called modules: 17:21:11.312 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys 17:21:11.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x854c0780] 17:21:11.328 3 CLASSPNP.SYS[86f9f8b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x844fc030] 17:21:11.343 Scan finished successfully 17:21:20.126 Disk 0 MBR has been saved successfully to "C:\Users\Martin\Documents\MBR.dat" 17:21:20.157 The log file has been saved successfully to "C:\Users\Martin\Documents\aswMBR.txt"
Post #5 last edited
Hi Mushey

Nothing jumping out from those logs but so we'll run some more checks.

Download and run MBRCheck

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
==================================

Run Farbar Service Scanner

Please download Farbar Service Scanner
  • make sure "Include All Files" option remains checked
  • press Scan
  • it will create a log (FSS.txt) in the same directory the tool is run
  • please copy and paste the log to your reply.
Logs to include in the next post:

MBRCheck log
FSS.txt

Can you also tell me if you notice a change since McAfee was uninstalled.

Thanks

Satchfan
Post #6
Hi Satchfan, The computer is responding better since I removed McAfee, logs attached as requested, thanks again for taking the time to help out. MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Business Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: Acer BIOS Manufacturer: Phoenix Technologies LTD System Manufacturer: Acer System Product Name: Extensa 5230 Logical Drives Mask: 0x0000001c Kernel Drivers (total 145): 0x82A40000 \SystemRoot\system32\ntkrnlpa.exe 0x82A0D000 \SystemRoot\system32\hal.dll 0x8040F000 \SystemRoot\system32\kdcom.dll 0x80416000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x80486000 \SystemRoot\system32\PSHED.dll 0x80497000 \SystemRoot\system32\BOOTVID.dll 0x8049F000 \SystemRoot\system32\CLFS.SYS 0x804E0000 \SystemRoot\system32\CI.dll 0x8060B000 \SystemRoot\system32\drivers\Wdf01000.sys 0x80687000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x80694000 \SystemRoot\system32\drivers\acpi.sys 0x806DA000 \SystemRoot\system32\drivers\WMILIB.SYS 0x806E3000 \SystemRoot\system32\drivers\msisadrv.sys 0x806EB000 \SystemRoot\system32\drivers\pci.sys 0x80712000 \SystemRoot\System32\drivers\partmgr.sys 0x80721000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x80724000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x8072E000 \SystemRoot\system32\drivers\volmgr.sys 0x8073D000 \SystemRoot\System32\drivers\volmgrx.sys 0x80787000 \SystemRoot\system32\DRIVERS\pcmcia.sys 0x807B4000 \SystemRoot\System32\drivers\mountmgr.sys 0x807C4000 \SystemRoot\System32\Drivers\UBHelper.sys 0x807CC000 \SystemRoot\system32\drivers\atapi.sys 0x807D4000 \SystemRoot\system32\drivers\ataport.SYS 0x807F2000 \SystemRoot\system32\drivers\msahci.sys 0x805C0000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x805CE000 \SystemRoot\system32\drivers\fltmgr.sys 0x86A06000 \SystemRoot\system32\drivers\fileinfo.sys 0x86A16000 \SystemRoot\System32\Drivers\ksecdd.sys 0x86A88000 \SystemRoot\system32\drivers\ndis.sys 0x86B93000 \SystemRoot\system32\drivers\msrpc.sys 0x86BBE000 \SystemRoot\system32\drivers\NETIO.SYS 0x86C01000 \SystemRoot\System32\drivers\tcpip.sys 0x86CEB000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x86E08000 \SystemRoot\System32\Drivers\Ntfs.sys 0x86F18000 \SystemRoot\system32\drivers\volsnap.sys 0x86F51000 \SystemRoot\System32\Drivers\spldr.sys 0x86F59000 \SystemRoot\System32\Drivers\mup.sys 0x86F68000 \SystemRoot\System32\drivers\ecache.sys 0x86F8F000 \SystemRoot\system32\drivers\disk.sys 0x86FA0000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x86FC1000 \SystemRoot\system32\drivers\crcdisk.sys 0x86FCA000 \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys 0x86FF0000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x86D06000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x8B209000 \SystemRoot\system32\DRIVERS\igdkmd32.sys 0x8BB26000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8BBC6000 \SystemRoot\System32\drivers\watchdog.sys 0x8BBD2000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x86D0F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8BBDD000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x86D4D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8AA0D000 \SystemRoot\system32\DRIVERS\b57nd60x.sys 0x8AA44000 \SystemRoot\system32\DRIVERS\athr.sys 0x8AB33000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x8AB37000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8AB4A000 \SystemRoot\system32\DRIVERS\DKbFltr.sys 0x8AB54000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x8AB5F000 \SystemRoot\system32\DRIVERS\SynTP.sys 0x8AB8E000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x8AB90000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8AB9B000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8ABB3000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys 0x8ABBB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x8ABC1000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x8ABCA000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x8AC03000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x8AC32000 \SystemRoot\system32\DRIVERS\storport.sys 0x8AC73000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8AC7E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x8AC95000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8ACA0000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8ACC3000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8ACD2000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8ACE6000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8ACFB000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0x8AD84000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8AD94000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8AD96000 \SystemRoot\system32\DRIVERS\ks.sys 0x8ADC0000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8ADCA000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8AE06000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8AE3B000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x8BC0E000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x8BE18000 \SystemRoot\system32\drivers\portcls.sys 0x8BE45000 \SystemRoot\system32\drivers\drmk.sys 0x8BE6A000 \SystemRoot\system32\drivers\IntcHdmi.sys 0x8BE8B000 \SystemRoot\system32\DRIVERS\avgmfx86.sys 0x8BE98000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x8BEA1000 \SystemRoot\System32\Drivers\Null.SYS 0x8BEA8000 \SystemRoot\System32\Drivers\Beep.SYS 0x8BEAF000 \SystemRoot\System32\drivers\vga.sys 0x8BEBB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8BEDC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x8BEE4000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8BEEC000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8BEF7000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8BF05000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x8BF0E000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8BF24000 \SystemRoot\system32\DRIVERS\smb.sys 0x8BF38000 \SystemRoot\system32\DRIVERS\avgtdix.sys 0x8BF7F000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8BFB1000 \SystemRoot\system32\drivers\afd.sys 0x8AE4C000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8BC00000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8AE62000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x8AE75000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8AEB1000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8AEBB000 \SystemRoot\System32\Drivers\dfsc.sys 0x8AED2000 \SystemRoot\system32\DRIVERS\avgldx86.sys 0x8AF09000 \SystemRoot\System32\Drivers\fastfat.SYS 0x8AF31000 \SystemRoot\System32\Drivers\crashdmp.sys 0x8AF3E000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x8AF49000 \SystemRoot\System32\Drivers\dump_msahci.sys 0x93860000 \SystemRoot\System32\win32k.sys 0x8AF53000 \SystemRoot\System32\drivers\Dxapi.sys 0x8AF5D000 \SystemRoot\system32\DRIVERS\monitor.sys 0x93A80000 \SystemRoot\System32\TSDDD.dll 0x93AA0000 \SystemRoot\System32\cdd.dll 0x8AF6C000 \SystemRoot\system32\drivers\luafv.sys 0xA7003000 \SystemRoot\system32\drivers\spsys.sys 0xA70B3000 \SystemRoot\system32\DRIVERS\irda.sys 0xA70D1000 \SystemRoot\system32\DRIVERS\RMCAST.sys 0xA7101000 \SystemRoot\system32\DRIVERS\lltdio.sys 0xA7111000 \SystemRoot\system32\DRIVERS\nwifi.sys 0xA713B000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xA7145000 \SystemRoot\system32\DRIVERS\rspndr.sys 0xA7158000 \SystemRoot\system32\drivers\HTTP.sys 0xA71C5000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xA71E2000 \SystemRoot\system32\DRIVERS\bowser.sys 0x8AF87000 \SystemRoot\System32\drivers\mpsdrv.sys 0x8AF9C000 \SystemRoot\system32\drivers\mrxdav.sys 0x8AFBD000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xA8001000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xA803A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xA8052000 \SystemRoot\System32\DRIVERS\srv2.sys 0xA807A000 \SystemRoot\System32\DRIVERS\srv.sys 0xA80E1000 \??\C:\Windows\system32\drivers\int15.sys 0xA80E8000 \SystemRoot\system32\drivers\peauth.sys 0xA81C6000 \SystemRoot\system32\drivers\regi.sys 0xA81C8000 \SystemRoot\System32\Drivers\secdrv.SYS 0xA81D2000 \SystemRoot\System32\drivers\tcpipreg.sys 0x8ADD7000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xA81DE000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x77560000 \Windows\System32\ntdll.dll Processes (total 88): 0 System Idle Process 4 System 440 C:\Windows\System32\smss.exe 472 C:\PROGRA~1\AVG\AVG2012\avgrsx.exe 504 C:\Program Files\AVG\AVG2012\avgcsrvx.exe 728 csrss.exe 780 C:\Windows\System32\wininit.exe 788 csrss.exe 840 C:\Windows\System32\winlogon.exe 864 C:\Windows\System32\services.exe 876 C:\Windows\System32\lsass.exe 884 C:\Windows\System32\lsm.exe 1064 C:\Windows\System32\svchost.exe 1160 C:\Windows\System32\svchost.exe 1332 C:\Windows\System32\svchost.exe 1376 C:\Windows\System32\svchost.exe 1396 C:\Windows\System32\svchost.exe 1480 C:\Windows\System32\audiodg.exe 1500 C:\Windows\System32\svchost.exe 1524 C:\Windows\System32\SLsvc.exe 1552 C:\Windows\System32\svchost.exe 1744 C:\Windows\System32\svchost.exe 1976 C:\Windows\System32\spoolsv.exe 2008 C:\Windows\System32\svchost.exe 672 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 704 C:\Program Files\AVG\AVG2012\avgwdsvc.exe 800 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe 908 C:\Program Files\Bonjour\mDNSResponder.exe 432 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe 1076 C:\Program Files\Acer\Empowering Technology\Service\ETService.exe 1764 C:\Program Files\AVG\AVG2012\avgnsx.exe 1800 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe 700 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 1596 C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE 2064 C:\Acer\Mobility Center\MobilityService.exe 2128 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe 2220 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe 2272 C:\Windows\System32\svchost.exe 2292 C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe 2332 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 2356 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 2396 C:\Windows\System32\svchost.exe 2440 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe 2524 C:\Windows\System32\svchost.exe 2548 C:\Windows\System32\SearchIndexer.exe 2924 WmiPrvSE.exe 3068 C:\Windows\System32\dwm.exe 3132 C:\Windows\explorer.exe 3140 C:\Windows\System32\taskeng.exe 3256 C:\Windows\System32\taskeng.exe 3324 C:\Windows\System32\taskeng.exe 3344 C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe 3668 C:\Windows\System32\alg.exe 3892 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe 3920 C:\Windows\RtHDVCpl.exe 3928 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 1668 C:\Windows\System32\igfxsrvc.exe 2620 C:\Program Files\Launch Manager\LManager.exe 2648 C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe 2636 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 2968 C:\Program Files\iTunes\iTunesHelper.exe 3016 C:\Windows\System32\igfxtray.exe 3012 C:\Windows\System32\hkcmd.exe 3100 C:\Windows\System32\igfxpers.exe 3152 C:\Program Files\AVG\AVG2012\avgtray.exe 3264 C:\Program Files\AVG Secure Search\vprot.exe 2988 C:\Program Files\Windows Live\Messenger\msnmsgr.exe 1948 C:\Windows\System32\igfxext.exe 3552 C:\Windows\System32\igfxsrvc.exe 3312 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 3320 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 2696 C:\Users\Martin\AppData\Local\Temp\RtkBtMnt.exe 3864 C:\Program Files\iPod\bin\iPodService.exe 4240 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe 4304 C:\Windows\System32\wbem\unsecapp.exe 4596 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 5468 C:\Windows\System32\svchost.exe 4848 C:\Program Files\AVG\AVG2012\avgscanx.exe 4576 C:\Program Files\AVG\AVG2012\avgcsrvx.exe 3284 C:\Windows\System32\rundll32.exe 5704 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 2920 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 5064 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 4652 6128 4432 C:\Users\Martin\AppData\Local\Google\Chrome\Application\chrome.exe 2468 C:\Users\Martin\Downloads\MBRCheck.exe 2228 C:\Windows\System32\conime.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000002`71100000 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000013`da600000 (NTFS) PhysicalDrive0 Model Number: HitachiHTS543216L9A300, Rev: FB2OC40C Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: DA67949D8E80AE4B877B861155C27C0550D2F7A3 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done! Farbar Service Scanner Version: 08-02-2012 Ran by [removed] (administrator) on 10-02-2012 at 18:48:58 Running from "C:\Users\Martin\Downloads" Microsoft® Windows Vista™ Business Service Pack 2 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Yahoo IP is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: =========== File Check: ======== C:\Windows\system32\nsisvc.dll => MD5 is legit C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit C:\Windows\system32\dhcpcsvc.dll => MD5 is legit C:\Windows\system32\Drivers\afd.sys => MD5 is legit C:\Windows\system32\Drivers\tdx.sys => MD5 is legit C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit C:\Windows\system32\dnsrslvr.dll => MD5 is legit C:\Windows\system32\mpssvc.dll => MD5 is legit C:\Windows\system32\bfe.dll => MD5 is legit C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit C:\Windows\system32\SDRSVC.dll => MD5 is legit C:\Windows\system32\vssvc.exe => MD5 is legit C:\Windows\system32\wscsvc.dll => MD5 is legit C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\system32\wuaueng.dll => MD5 is legit C:\Windows\system32\qmgr.dll => MD5 is legit C:\Windows\system32\es.dll => MD5 is legit C:\Windows\system32\cryptsvc.dll => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit **** End of log ****
Post #7
Although there is no direct sign of malware, there are a couple of entries need to be checked further. Two of them concern your System Restore and Firewll settings.

These two scans should answer some questions.

Run OTL

download OTL and save it to your desktop.
  • double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted
  • when the window appears, underneath Output at the top change it to Minimal Output
  • check the boxes beside LOP Check and Purity Check
  • click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long
  • when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply. You may need two posts to fit them both in.

===================================================

Run TDSSKiller

Please download TDSSKiller.zip
  • extract it to your desktop
  • double click TDSSKiller.exe
  • press Start Scan

    only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.

  • click Continue > Reboot now

  • copy and paste the log in your next reply
  • a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)
Logs to include with next post:

OTL.txt
Extras.txt
TDSSKiller log

Thanks

Satchfan
Post #8
Hello mushey It has been several days since I posted instructions to help with your computer problem. Please let me know if you are having problems and still need help. Thanks Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI