What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC has become RIDICULOUSLY slow, even after I doubled wireless speed&#

39 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi shannonhills ;)

I was surprised to find that I didn't already have Malwarebytes installed on my computer, because I've used it regularly for years and years

Surely you've uninstalled it.

Anyway, I tried to download it from the link, no joy.

The link work fine. :)

I'm afraid I might have downloaded more malware or … who knows what, since I could never get a bona fi Nde Malwarebytes download

No problem I'm here ;)

Shannon, you miss eset scan result, please run the scan and post the report for me.

Next let me know how your machine is running ^_^
Post #17
No threats were found by the ESET Online Scanner. I will turn Microsoft Security Essentials back on and try my browser today. should I uninstall any of the scanners you had me install? Shannon
Post #18
Hi shannonhills ;)

I uninstall any of the scanners you had me install?

Not yet.

Re-Run OTL

  • Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
  • Post the OTL.txt log it produces in your next reply.
Post #19
OK, here's the OTL log:

OTL logfile created on: 5/12/2013 7:45:04 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Shannon.HHCA\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.11 Mb Total Physical Memory | 379.57 Mb Available Physical Memory | 37.43% Memory free
2.38 Gb Paging File | 1.81 Gb Available in Paging File | 75.75% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.73 Gb Total Space | 51.31 Gb Free Space | 45.93% Space Free | Partition Type: NTFS

Computer Name: SHANNON-DELL | User Name: shannon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Shannon.HHCA\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (rpcapd) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (WLANKEEPER) – C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (NICCONFIGSVC) – C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
SRV - (ASFIPmon) – C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (WaveFDE) – system32\DRIVERS\WaveFDE.sys File not found
DRV - (USBAAPL) – System32\Drivers\usbaapl.sys File not found
DRV - (UIUSys) – system32\DRIVERS\UIUSYS.SYS File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\RaInfo.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (guardian2) – System32\Drivers\oz776.sys File not found
DRV - (cpuz134) – C:\DOCUME~1\SHANNO~1.HHC\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys File not found
DRV - (Changer) – File not found
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (WFMC_VAD) – C:\WINDOWS\system32\drivers\wfmcvad.sys (WiFi Media Connect)
DRV - (NETw5x32) – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (LMIRfsClientNP) – C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (LMIRfsDriver) – C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (NvtSp50) – C:\WINDOWS\system32\drivers\NvtSp50.sys (Printing Novatel Wireless Inc.)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWDellPort) – C:\WINDOWS\system32\drivers\nwdelser.sys (Novatel Wireless Inc.)
DRV - (NWDellModem) – C:\WINDOWS\system32\drivers\nwdelmdm.sys (Novatel Wireless Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (APPDRV) – C:\WINDOWS\system32\drivers\APPDRV.SYS (Dell Inc)
DRV - (USBCCID) – C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (BASFND) – C:\Program Files\Broadcom\ASFIPMon\BASFND.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FC 22 27 4D 39 EE CA 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {5F89AEEC-D6E8-4378-9F20-6E8009087D95}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{5F89AEEC-D6E8-4378-9F20-6E8009087D95}: "URL" = http://www.google.com/search?q={searchTerm…1I7WZPC_enUS378
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Shannon.HHCA\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/05/07 22:13:01 | 000,000,000 | —D | M]


O1 HOSTS File: ([2004/08/04 03:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = HiddenHills.org
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{87FE965E-1596-4ACA-A8FA-B51FD9E87A23}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Shannon.HHCA\My Documents\My Pictures\personalpics\mom, dad, andy boat early key west.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Shannon.HHCA\My Documents\My Pictures\personalpics\mom, dad, andy boat early key west.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/05 23:32:42 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/10 00:16:03 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2013/05/09 23:55:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/09 23:55:33 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2013/05/09 23:51:19 | 010,285,040 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Shannon.HHCA\Desktop\mbam-setup-1.75.0.1300.exe
[2013/05/09 12:35:39 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/05/09 12:35:35 | 000,000,000 | —D | C] – C:\JRT
[2013/05/09 12:33:59 | 000,545,954 | —- | C] (Oleg N. Scherbakov) – C:\Documents and Settings\Shannon.HHCA\Desktop\JRT.exe
[2013/05/08 01:24:00 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Shannon.HHCA\Desktop\aswMBR.exe
[2013/05/08 00:47:14 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Shannon.HHCA\Desktop\OTL.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/10 06:59:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/10 04:59:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/09 23:55:37 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/09 23:51:27 | 010,285,040 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Shannon.HHCA\Desktop\mbam-setup-1.75.0.1300.exe
[2013/05/09 23:50:11 | 000,000,384 | -H– | M] () – C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/09 23:40:37 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/09 23:40:02 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/09 12:54:28 | 000,816,128 | —- | M] () – C:\Documents and Settings\Shannon.HHCA\Desktop\RogueKiller.exe
[2013/05/09 12:45:59 | 000,628,743 | —- | M] () – C:\Documents and Settings\Shannon.HHCA\Desktop\adwcleaner.exe
[2013/05/09 12:34:24 | 000,545,954 | —- | M] (Oleg N. Scherbakov) – C:\Documents and Settings\Shannon.HHCA\Desktop\JRT.exe
[2013/05/08 07:07:17 | 000,000,512 | —- | M] () – C:\Documents and Settings\Shannon.HHCA\Desktop\MBR.dat
[2013/05/08 01:24:09 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Shannon.HHCA\Desktop\aswMBR.exe
[2013/05/08 00:47:24 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Shannon.HHCA\Desktop\OTL.exe
[2013/05/08 00:44:36 | 000,890,825 | —- | M] () – C:\Documents and Settings\Shannon.HHCA\Desktop\SecurityCheck.exe
[2013/05/06 22:03:35 | 000,514,882 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/05/06 22:03:35 | 000,093,240 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/05/03 21:38:18 | 000,000,004 | —- | M] () – C:\Documents and Settings\Shannon.HHCA\Local Settings\Application Data\~wmrg
[2013/05/02 08:28:50 | 000,238,872 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2013/04/28 23:00:22 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2013/04/26 23:42:55 | 009,097,384 | —- | M] (SurfRight B.V.) – C:\Documents and Settings\Shannon.HHCA\Desktop\HitmanPro.exe
[2013/04/26 23:37:03 | 000,001,211 | —- | M] () – C:\Documents and Settings\Shannon.HHCA\Desktop\HijackThis Logfileauswertung.url
[2013/04/23 00:03:37 | 000,691,592 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/04/23 00:03:36 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/04/22 21:52:39 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/04/22 21:43:04 | 000,225,616 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/10 04:54:17 | 000,000,886 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/10 04:54:16 | 000,000,882 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/09 23:55:37 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/09 12:45:53 | 000,628,743 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Desktop\adwcleaner.exe
[2013/05/08 07:07:17 | 000,000,512 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Desktop\MBR.dat
[2013/05/08 00:44:11 | 000,890,825 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Desktop\SecurityCheck.exe
[2013/04/02 01:29:08 | 000,138,480 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2013/03/01 00:11:40 | 000,000,162 | —- | C] () – C:\WINDOWS\reimage.ini
[2013/02/28 23:31:27 | 000,000,000 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\defogger_reenable
[2012/09/05 19:18:47 | 000,003,303 | —- | C] () – C:\WINDOWS\BRPARAM.INI
[2012/09/05 19:18:18 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2012/09/05 19:18:11 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2012/08/12 22:30:17 | 000,000,004 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Local Settings\Application Data\~wmrg
[2012/02/18 22:23:09 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/10/18 12:02:59 | 000,002,412 | R-S- | C] () – C:\Documents and Settings\All Users\ntuser.pol
[2011/10/07 20:03:13 | 000,023,624 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/09/16 12:14:29 | 000,072,080 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\g2mdlhlpx.exe
[2011/07/01 16:19:13 | 000,110,456 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\g2ax_customer_downloadhelper_win32_x86.exe
[2011/01/24 12:22:58 | 000,000,131 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Application Data\DMNetworkViewer.INI
[2010/05/27 11:14:59 | 000,079,360 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/17 11:48:24 | 000,061,678 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Application Data\PFP100JPR.{PB
[2010/05/17 11:48:24 | 000,012,358 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Application Data\PFP100JCM.{PB
[2010/05/07 15:46:40 | 000,000,000 | —- | C] () – C:\Documents and Settings\Shannon.HHCA\Local Settings\Application Data\WavXMapDrive.bat

========== ZeroAccess Check ==========

[2010/05/06 01:59:11 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/03/09 21:33:41 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 05:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 17:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\SIXFOUR.TIF:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\logo_address.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\logo.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\logo address.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\logo address adobe.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\hhlogo.TIF:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Shannon.HHCA\My Documents\4-BT-4.jpg:Roxio EMC Stream

< End of report >
Post #21
It's MUCH faster. Thank you so much. Do you know what it was that was slowing it down so much? So that I can avoid doing whatever it was that I did to make it so slow?
Post #22
Hi shannonhills :)

Do you know what it was that was slowing it down so much? So that I can avoid doing whatever it was that I did to make it so slow?

I think that the main cause, were, registry keys, related to your yahoo

Ok Go ahead :)

Please read through these instructions to familarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications

====================================================


Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.
Post #23
Sorry for the delay in responding. I had a busy couple of days. Here's the ComboFix log:

ComboFix 13-05-14.01 - shannon 05/14/2013 18:29:57.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.487 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Shannon.HHCA\g2ax_customer_downloadhelper_win32_x86.exe
c:\documents and settings\Shannon.HHCA\g2mdlhlpx.exe
c:\windows\Downloaded Program Files\ODCTOOLS
c:\windows\Downloaded Program Files\ODCTOOLS\ef6b26db-344d-4ad3-ba24-aca0bdaa999a.cab
c:\windows\Downloaded Program Files\ODCTOOLS\f04d289f-c60a-422b-8396-6c372047042e.cab
c:\windows\jestertb.dll
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\test
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-04-15 to 2013-05-15 )))))))))))))))))))))))))))))))
.
.
2013-05-15 01:19 . 2013-05-13 06:19 7016152 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{56D6A47C-9720-48C2-AF40-1910EFE512FC}\mpengine.dll
2013-05-13 02:40 . 2013-04-10 03:08 6906960 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-10 07:16 . 2013-05-10 07:16 ——– d—–w- c:\program files\ESET
2013-05-10 06:55 . 2013-04-04 21:50 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2013-05-09 19:35 . 2013-05-09 19:35 ——– d—–w- c:\windows\ERUNT
2013-05-09 19:35 . 2013-05-09 19:35 ——– d—–w- C:\JRT
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 15:28 . 2013-04-07 05:43 238872 ——w- c:\windows\system32\MpSigStub.exe
2013-04-23 07:03 . 2012-09-26 16:17 691592 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-23 07:03 . 2011-09-02 17:36 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-14 04:58 . 2013-03-14 04:58 15859416 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-03-08 08:36 . 2004-08-04 10:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32 . 2005-03-30 01:21 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50 . 2005-03-30 01:01 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-05 08:25 . 2013-03-05 08:25 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-05 08:25 . 2013-03-05 08:26 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-03-05 08:25 . 2013-03-05 08:26 143872 —-a-w- c:\windows\system32\javacpl.cpl
2013-03-05 08:25 . 2013-03-05 08:26 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-02 02:06 . 2006-03-04 03:33 916480 —-a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06 . 2004-08-04 10:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06 . 2004-08-04 10:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25 . 2004-08-04 10:00 1867264 —-a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08 . 2004-08-04 10:00 385024 —-a-w- c:\windows\system32\html.iec
2013-02-27 07:56 . 2010-05-06 06:25 2067456 —-a-w- c:\windows\system32\mstscax.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-11-18 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-11-03 1372160]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-29 02:34 87352 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2011-11-18 01:01 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R1 NvtSp50;Novatel Wireless NDIS 5 Single-Packet Read Protocol Driver;c:\windows\system32\drivers\NvtSp50.sys [6/10/2008 1:32 PM 22016]
R2 ASFIPmon;Broadcom ASF IP Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [10/18/2005 5:11 PM 61440]
R3 NWDellModem;Dell Wireless Mobile Broadband Modem Driver;c:\windows\system32\drivers\nwdelmdm.sys [11/2/2007 3:41 PM 166144]
R3 NWDellPort;Dell Wireless Mobile Broadband Status Port Driver;c:\windows\system32\drivers\nwdelser.sys [11/2/2007 3:41 PM 166144]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys –> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 cpuz134;cpuz134;\??\c:\docume~1\SHANNO~1.HHC\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys –> c:\docume~1\SHANNO~1.HHC\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/25/2010 10:07 AM 35088]
S3 WFMC_VAD;WFMC Virtual Audio Device (WDM);c:\windows\system32\drivers\wfmcvad.sys [9/28/2012 9:41 PM 19328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 04:45]
.
2013-05-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 04:45]
.
2013-05-15 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 18:11]
.
.
——- Supplementary Scan ——-
.
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-14 18:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\LMIinit.dll
c:\windows\system32\netprovcredman.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2013-05-14 18:46:14
ComboFix-quarantined-files.txt 2013-05-15 01:46
.
Pre-Run: 55,460,896,768 bytes free
Post-Run: 55,691,902,976 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - DE6DCE8290B99CFDB9BD1AE4A6361919
Post #25
Hi shannonhills ;)

By the way, I get an error yellow triangle with an apostrophe in it on the bottom left side of the browser window. Here's the error:

Webpage error details

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Timestamp: Wed, 15 May 2013 02:40:32 UTC


Message: Object required
Line: 1591
Char: 1
Code: 0
URI: http://forums.whatthetech.com/index.php?sh…pid=821790&

Ok follow this steps

[external image: Posted Image] Tweaking.com Registry Backup
  • Download the tool found here to your Desktop so it is easy to find.
  • Double click on the file you just downloaded to install it to your system.
  • Once the tool is installed, double-click on the Tweaking.com Registry Backup icon
    **Note** The tool should automatically open to the Backup Registry tab.

    [external image: Posted Image]
  • Press Backup Now
  • When the back up is complete, the tool will tell you that Successful */* Files Backed Up
  • You have now successfully backed up your Registry.

Next

Go here and scroll down to the Problem: Nested UA String section. Then follow the instructions listed there.

After that close and restart Internet Explorer then test to see if you have the same problem.
Post #26
I followed all of the steps. The instructions told me to look for this string: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; I did not find that string, but I found this one: User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) Should I remove the string with MSIE 8.0?
Post #27 last edited
Hi shannonhills :)

I found this one: User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Ok Very good.

Should I remove the string with MSIE 8.0?

No!

Click START > RUN > REGEDIT.EXE Using RegEdit, navigate to these four keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

Remove any elements from the "Name/Type/Value" list that contain Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

You must to click on Post Platform subkey and find in right panel the elements
Post #28
I did click on the Post Platform subkey last night, but just to make sure, I checked all of those locations again tonight. I could not find that MSIE 6.0 file. When I clicked on User Agent and Post Platform in all of the locations, there was just a little square icon with the letters "ab" on the left, with the title "Default." To the right of that was REG_SZ and something else. When I clicked on "Default," I was asked to type in a string. Can I search the registry for that string? Do you think that's what's slowing my browser?
Post #29
Hi Shannonhills ;)

Sorry I was wrong to give instructions.

Follow this

Remove any elements from the "Name/Type/Value" list that contain User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)


Do you think that's what's slowing my browser?

This fix, only serves to eliminate your error warning.
Post #30
OK, looking for User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

in the following locations, here's what I found:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform

No files

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

There is no folder in Internet Settings called User Agent, so no subfolder called Post Platform.

There IS, however, a file in Internet Settings called User Agent. It has a little red "ab" in a white box on the left of the file name (which is User Agent).

It's identified as File Type: REG_SZ, and it's data is: Mozilla/4.0 (compatible; MSIE 8.0; Win 32).. i probably didn't notice before that this file said Win32 instead of Windows NT,

Again, it's not a folder, and there is no Internet Settings/User Agent/Post Platform file.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform

No files

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

No files


I'm guessing I should delete that one User Agent file, but since it isn't a folder like it's supposed to be, I'll wait for you to verify. In the meantime, I'll keep looking in the registry for the MSIE 8.0 Windows NT file.

- - - - - - - - - - - - - -

I'm sorry to be such a pain, but the current whatthetech page is showing the following error:

Webpage error details

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Timestamp: Wed, 22 May 2013 04:20:48 UTC


Message: Object required
Line: 2380
Char: 1
Code: 0
URI: http://forums.whatthetech.com/index.php?sh…pid=822078&


Ay, Dios mio!

Shannon

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI