What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help with slow laptop please? [Solved]

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have a Toshiba Sattelite Laptop that was slow at times and Ok other times. It has now slowed so much and become virtually unuseable and I need help to fix it please. The Hijack log is below.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:30:10 PM, on 9/21/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
E:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dll?MyEb…h=1&guest=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…mp;n=2010122913
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 5288 bytes
Post #2
Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.
  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.



Scan with DDS

Download DDS and save it to your desktop from here or here or
here.

Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs

DDS.txt: save to your desktop then post its contents in your topic
Attach.txt: save to your desktop then attach it to your next reply



Scan with aswMBR

Please download aswMBR ( 4.5MB ) to your desktop.
  • Double click the aswMBR.exe icon, and click Run.
  • There will be a short delay before the next dialog box comes up. Please just wait a minute or two.
  • When asked if you'd like to "download the latest Avast! virus definitions", click Yes.
  • Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready.
  • Click the Scan button to start the scan once the update has finished downloading
  • On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.
Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record).
Post #3 last edited
Thanks. The laptop is so slow that I have to download tools to a flash drive and save logs to it. It would not run dss, I left it for over an hour, so I ran the cleaner. Then I thought to run dss in safe mode and it did so the logs are below. I could not download the avast as when I connect to the internet the computer hangs.
DDS (Ver_2012-11-20.01) - NTFS_x86 MINIMAL
Internet Explorer: 8.0.6001.18702
Run by [removed] at 19:07:16 on 2013-09-25
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.843 [GMT 1:00]
.
AV: AVG Internet Security *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Enabled*
.
============== Running Processes ================
.
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.ebay.co.uk/ws/eBayISAPI.dll?MyEbayBeta&MyEbay=&CurrentPage=MyeBaySummary&ssPageName=STRK%3AME%3ALNLK%3AMESUMX&gbh=1&guest=1
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://uk.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = iexplore
BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…mp;n=2010122913
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
============= SERVICES / DRIVERS ===============
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-1-16 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-16 335240]
S1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-16 27784]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-16 108552]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-4-29 908056]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-27 297752]
S2 avgfws8;AVG8 Firewall;c:\progra~1\avg\avg8\avgfws8.exe [2009-4-29 1370488]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-1-16 29208]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-1-16 29208]
S3 cpuz132;cpuz132;\??\c:\docume~1\home\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\home\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
.
=============== Created Last 30 ================
.
2013-09-19 11:35:14 ——– d—–w- c:\windows\system32\MRT
2013-09-19 11:21:13 12928 -c—-w- c:\windows\system32\dllcache\usb8023.sys
2013-09-19 11:21:12 12928 -c—-w- c:\windows\system32\dllcache\usb8023x.sys
2013-09-19 11:13:30 ——– d—–w- c:\documents and settings\all users\application data\Chat Republic Games
2013-09-19 10:54:00 ——– d—–w- c:\windows\system32\wbem\repository\FS
2013-09-19 10:54:00 ——– d—–w- c:\windows\system32\wbem\Repository
2013-09-19 10:30:13 ——– d—–w- c:\windows\system32\drivers\Avg
.
==================== Find3M ====================
.
2013-08-09 01:56:45 386560 —-a-w- c:\windows\system32\themeui.dll
2013-08-08 06:05:59 920064 —-a-w- c:\windows\system32\wininet.dll
2013-08-08 06:05:59 43520 ——w- c:\windows\system32\licmgr10.dll
2013-08-08 06:05:59 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-08-08 06:05:58 18944 —-a-w- c:\windows\system32\corpol.dll
2013-08-08 01:27:48 1877760 —-a-w- c:\windows\system32\win32k.sys
2013-08-08 00:02:34 385024 ——w- c:\windows\system32\html.iec
2013-08-05 13:30:32 1289728 —-a-w- c:\windows\system32\ole32.dll
2013-07-31 14:11:22 810496 —-a-w- c:\windows\system32\wmvdmod.dll
2013-07-10 10:37:53 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-04 02:59:11 2193536 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08:30 2070144 —-a-w- c:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 19:09:12.40 ===============

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-09-25 17:33:20
—————————–
17:33:20.387 OS Version: Windows 5.1.2600 Service Pack 3
17:33:20.387 Number of processors: 1 586 0x905
17:33:23.392 ComputerName: HOME-FA1C3E21C3 UserName: Home
17:34:52.600 Initialze error C000010E - driver not loaded
17:35:13.550 write error "aswCmnB.dll". The process cannot access the file because it is being used by another process.
17:35:53.608 Service scanning
18:01:01.406 Modules scanning
18:01:05.782 Disk 0 trace - called modules:
18:01:09.788
18:01:09.808 Scan finished successfully
18:22:02.629 The log file has been saved successfully to "E:\aswMBR.txt"



.

Attachments:

Post #4
Scan with Malwarebytes Anti-Rootkit

Please download Malwarebytes Anti-Rootkit from here Malwarebytes : Malwarebytes Anti-Rootkit and save it to your desktop.

Be sure to print out and follow the instructions provided on that same page.

Caution: This is a beta version so please be sure to read the disclaimer and back up any important data before using.

  • Double click the mbar.zip file to open it, then 'Extract all files'.
  • Double click the mbar folder to open it, then double click mbar.exe to start the tool.
Check for Updates, then Scan your system for malware

If malware is found, do NOT press the Cleanup button yet. Click EXIT.

I'd like to see the log first so I can see what it sees. You'll find the log in that mbar folder as MBAR-log-[date and time]***.txt . Please attach that to your next reply.
Post #5
Hi Marius. Well I started the scan and it ran for over 10 hours and still did not complete. I had to stop it as I did not want to leave it on overnight because of fire risk. However it did find two malwares. Here is the log. Please let me know what to do next. Thanks. Sue. ————————————— Malwarebytes Anti-Rootkit BETA 1.07.0.1005 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 Java version: 1.6.0_23 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 1.296000 GHz Memory total: 1073070080, free: 829472768 ======================================= Initializing… ———— Kernel report ———— 09/26/2013 13:42:56 ———— Loaded modules ———– \WINDOWS\system32\ntoskrnl.exe \WINDOWS\system32\hal.dll \WINDOWS\system32\KDCOM.DLL \WINDOWS\system32\BOOTVID.dll ACPI.sys \WINDOWS\system32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys ohci1394.sys \WINDOWS\system32\DRIVERS\1394BUS.SYS compbatt.sys \WINDOWS\system32\DRIVERS\BATTC.SYS PCIIde.sys \WINDOWS\System32\Drivers\PCIIDEX.SYS intelide.sys pcmcia.sys MountMgr.sys ftdisk.sys dmload.sys dmio.sys PartMgr.sys VolSnap.sys atapi.sys disk.sys \WINDOWS\system32\DRIVERS\CLASSPNP.SYS fltmgr.sys sr.sys KSecDD.sys Ntfs.sys NDIS.sys Mup.sys avgrkx86.sys agp440.sys \SystemRoot\system32\DRIVERS\usbuhci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\nic1394.sys \SystemRoot\system32\DRIVERS\e100b325.sys \SystemRoot\system32\DRIVERS\sdbus.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\smcirda.sys \SystemRoot\system32\DRIVERS\irenum.sys \SystemRoot\system32\DRIVERS\parport.sys \SystemRoot\system32\DRIVERS\serial.sys \SystemRoot\system32\DRIVERS\serenum.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\redbook.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\drivers\smwdm.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\aeaudio.sys \SystemRoot\system32\DRIVERS\LTSM.sys \SystemRoot\System32\Drivers\Modem.SYS \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\avgfwdx.sys \SystemRoot\system32\DRIVERS\serscan.sys \SystemRoot\system32\DRIVERS\audstub.sys \SystemRoot\system32\DRIVERS\rasirda.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\psched.sys \SystemRoot\system32\DRIVERS\msgpc.sys \SystemRoot\system32\DRIVERS\ptilink.sys \SystemRoot\system32\DRIVERS\raspti.sys \SystemRoot\system32\DRIVERS\rdpdr.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\update.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\ipsec.sys \SystemRoot\system32\DRIVERS\tcpip.sys \SystemRoot\System32\Drivers\avgtdix.sys \SystemRoot\system32\DRIVERS\netbt.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\system32\DRIVERS\ipnat.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\arp1394.sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\System32\Drivers\avgmfx86.sys \SystemRoot\System32\Drivers\Fastfat.SYS \SystemRoot\System32\Drivers\dump_atapi.sys \SystemRoot\System32\Drivers\dump_WMILIB.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\framebuf.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\DRIVERS\irda.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\mrxdav.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\System32\Drivers\ParVdm.SYS \SystemRoot\system32\DRIVERS\srv.sys \SystemRoot\System32\Drivers\HTTP.sys \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\system32\drivers\kmixer.sys \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys \WINDOWS\system32\ntdll.dll ———– End ———– Done! <<<1>>> Upper Device Name: \Device\Harddisk1\DR2 Upper Device Object: 0xffffffff86f99ab8 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000091\ Lower Device Object: 0xffffffff87050d08 Lower Device Driver Name: \Driver\USBSTOR\ <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff87344ab8 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\ Lower Device Object: 0xffffffff8734a940 Lower Device Driver Name: \Driver\atapi\ <<<2>>> Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff87344ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ ——— Disk Stack —— DevicePointer: 0xffffffff873a7e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff87344ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff87328220, DeviceName: \Device\00000082\, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8734a940, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\ ———— End ———- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0x0, 0x0, 0x0 Lower DeviceData: 0x0, 0x0, 0x0 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes <<<2>>> <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers… <<<2>>> <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0… Inspecting partition table: MBR Signature: 55AA Disk Signature: BC70BC70 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 58588992 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 30005821440 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-58585120-58605120)… Done! Physical Sector Size: 512 Drive: 1, DevicePointer: 0xffffffff86f99ab8, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ ——— Disk Stack —— DevicePointer: 0xffffffff86fcbbb0, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff86f99ab8, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff87050d08, DeviceName: \Device\00000091\, DriverName: \Driver\USBSTOR\ ———— End ———- Alternate DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ Upper DeviceData: 0x0, 0x0, 0x0 Lower DeviceData: 0x0, 0x0, 0x0 Drive 1 Scanning MBR on drive 1… Inspecting partition table: MBR Signature: 55AA Disk Signature: 833F9C Partition information: Partition 0 type is Other (0xe) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 249024 Partition file system is FAT Partition is not bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 127532544 bytes Sector size: 512 bytes Done! Infected: HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{56256A51-B582-467e-B8D4-7786EDA79AE0} –> [Trojan.Vundo] Infected: HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{56256A51-B582-467E-B8D4-7786EDA79AE0} –> [Trojan.Vundo] Scan Interrupted
Post #6
Combofix

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================


Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications


====================================================


Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.
Post #7
Hi. I could not disable AVG so I ran combofix but it did not produce a log. I uninstalled AVG and ran combofix again,still no log so I ran it again and watched it through. It extracted the files, backed up the registry and then flashed 'combofix completed' and closed. Still I have no log. Sorry for delay but each process took about 3 hours. Computer seems to run ok for about 2 mins then slows down until everything is not responding. Thanks.
Post #9 last edited
Done. Log below. Thanks.

ComboFix 13-09-28.02 - Administrator 10/01/2013 11:04:47.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.850 [GMT 1:00]
Running from: E:\ComboFix.exe
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Home\WINDOWS
.
.
((((((((((((((((((((((((( Files Created from 2013-09-01 to 2013-10-01 )))))))))))))))))))))))))))))))
.
.
2013-09-26 12:58 . 2013-09-26 12:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2013-09-26 12:43 . 2013-09-26 15:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-26 12:42 . 2013-09-26 12:42 105176 —-a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-09-26 12:29 . 2013-09-26 12:29 48728 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-09-19 11:35 . 2013-09-19 11:38 ——– d—–w- c:\windows\system32\MRT
2013-09-19 11:21 . 2013-02-12 00:32 12928 -c—-w- c:\windows\system32\dllcache\usb8023.sys
2013-09-19 11:21 . 2013-02-12 00:32 12928 -c—-w- c:\windows\system32\dllcache\usb8023x.sys
2013-09-19 11:13 . 2013-09-19 11:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Chat Republic Games
2013-09-19 11:11 . 2013-09-19 11:11 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2013-09-19 10:54 . 2013-09-19 10:54 ——– d—–w- c:\windows\system32\wbem\Repository
2013-09-18 19:04 . 2013-09-19 10:26 ——– d-s—w- c:\documents and settings\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-09 01:56 . 2004-08-04 12:00 386560 —-a-w- c:\windows\system32\themeui.dll
2013-08-08 06:05 . 2004-08-04 12:00 920064 —-a-w- c:\windows\system32\wininet.dll
2013-08-08 06:05 . 2004-08-04 12:00 43520 ——w- c:\windows\system32\licmgr10.dll
2013-08-08 06:05 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-08-08 06:05 . 2004-08-04 12:00 18944 —-a-w- c:\windows\system32\corpol.dll
2013-08-08 01:27 . 2004-08-04 12:00 1877760 —-a-w- c:\windows\system32\win32k.sys
2013-08-08 00:02 . 2004-08-04 12:00 385024 ——w- c:\windows\system32\html.iec
2013-08-05 13:30 . 2004-08-04 12:00 1289728 —-a-w- c:\windows\system32\ole32.dll
2013-07-31 14:11 . 2004-08-04 12:00 810496 —-a-w- c:\windows\system32\wmvdmod.dll
2013-07-10 10:37 . 2004-08-04 12:00 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-04 02:59 . 2004-08-04 12:00 2193536 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2004-08-03 22:59 2070144 —-a-w- c:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
NvQTwk [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 11:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [9/26/2013 1:29 PM 48728]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [9/26/2013 1:42 PM 105176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 03:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-30 c:\windows\Tasks\User_Feed_Synchronization-{70C0E6B8-A4D9-4140-BD42-BDB6A53151F3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe
MSConfigStartUp-nwiz - nwiz.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-10-01 11:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-789336058-2146746863-1343024091-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,56,b8,60,a4,2a,73,dc,4c,84,cb,b9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,56,b8,60,a4,2a,73,dc,4c,84,cb,b9,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1464)
c:\windows\system32\WININET.dll
.
Completion time: 2013-10-01 11:17:33
ComboFix-quarantined-files.txt 2013-10-01 10:17
.
Pre-Run: 15,682,883,584 bytes free
Post-Run: 17,609,072,640 bytes free
.
- - End Of File - - 0602D1216DC4BC608D99467AC95966BA
8F558EB6672622401DA993E1E865C861
Post #10
no malware here…

System File Check

For Windows XP:

  • Press the Windows- and the R-key simultanously.
  • Within the text box that jus opened, write cmd and hit Enter.

For Windows Vista/7:

  • Press the Windows key to open the start menu.
  • Don´t highlight anything, just write cmd.
  • The start menu will offer you an entry named cmd.
  • Right click it and select "run as administrator"


Within the opening window, write the following:

sfc /scannow
(See the blank within).


  • Hit enter. Your system will be checked for damaged system files.
  • Tell me the result of that scan in here (as the tool produces no log).
Post #11
HI. I could not run this scan because the Windows File Protection box came up and needed the CD Rom which I do not have. The LapTop does have the stickers on with the product key and Certificate of Authenticity. Is there anything else I can do ? Thanks.
Post #12 last edited
Windows Repair (all-in-one)

Please download Windows Repair (all in one) from here.

Install the program then run it.

Go to step 2 and allow it to run Disk check.

[external image: Posted Image]

On the Start Repairs tab, click Start.
Within the opening window, hit select all.

Then click on Start

DON'T use the computer while each scan is in progress.

Restart may be needed to finish the repair procedure.

Let me know how that worked out for you.
Post #13
Thanks. This ran ok the computer seems much more responsive Errors were found so it ran the disk check and then restarted. It found 37 repair jobs and created a log which is below. reset SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15\RegLocation old REG_MULTI_SZ = SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{83005D03-501A-4D43-B616-9F353A7480D2}\NameServerList old REG_MULTI_SZ = added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{83005D03-501A-4D43-B616-9F353A7480D2}\NetbiosOptions added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{9339C800-096C-4BF5-BB6F-A6A9BC608168}\NetbiosOptions added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{9442427E-0638-4846-910B-FE7CDA32D198}\NetbiosOptions added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{EFACD262-349D-49AA-B2C3-F47AE7600082}\NetbiosOptions deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhosts added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1D01F154-BFF9-47B1-9B17-190B1AA12C07}\AddressType added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1D01F154-BFF9-47B1-9B17-190B1AA12C07}\DisableDynamicUpdate reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1D01F154-BFF9-47B1-9B17-190B1AA12C07}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1D01F154-BFF9-47B1-9B17-190B1AA12C07}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1D01F154-BFF9-47B1-9B17-190B1AA12C07}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\DisableDynamicUpdate deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\IpAutoconfigurationAddress deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\IpAutoconfigurationMask deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\IpAutoconfigurationSeed reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{48725A22-C7AB-4BE8-88E4-50F43C5A4F4A}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\DisableDynamicUpdate deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\IpAutoconfigurationAddress deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\IpAutoconfigurationMask deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\IpAutoconfigurationSeed reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4928AAF6-99B4-4977-80F3-DBB7007244AD}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F979FBB-4306-4828-8FDC-86E0AD3735D9}\AddressType added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F979FBB-4306-4828-8FDC-86E0AD3735D9}\DisableDynamicUpdate reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F979FBB-4306-4828-8FDC-86E0AD3735D9}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F979FBB-4306-4828-8FDC-86E0AD3735D9}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F979FBB-4306-4828-8FDC-86E0AD3735D9}\UdpAllowedPorts old REG_MULTI_SZ = 0 deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{83005D03-501A-4D43-B616-9F353A7480D2}\NameServer added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{899F8432-9C8F-4B72-AB2D-164A7BF2FD0E}\AddressType added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{899F8432-9C8F-4B72-AB2D-164A7BF2FD0E}\DisableDynamicUpdate reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{899F8432-9C8F-4B72-AB2D-164A7BF2FD0E}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{899F8432-9C8F-4B72-AB2D-164A7BF2FD0E}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{899F8432-9C8F-4B72-AB2D-164A7BF2FD0E}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C70479DF-8705-4037-9388-CBD2FE66E74C}\AddressType added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C70479DF-8705-4037-9388-CBD2FE66E74C}\DisableDynamicUpdate reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C70479DF-8705-4037-9388-CBD2FE66E74C}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C70479DF-8705-4037-9388-CBD2FE66E74C}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C70479DF-8705-4037-9388-CBD2FE66E74C}\UdpAllowedPorts old REG_MULTI_SZ = 0 deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefault deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableIcmpRedirect added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolution reset Linkage\UpperBind for PCI\VEN_8086&DEV_1043&SUBSYS_25818086&REV_04\4&16793A72&0&50F0. bad value was: REG_MULTI_SZ = PSched reset Linkage\UpperBind for PCI\VEN_8086&DEV_103D&SUBSYS_00011179&REV_83\4&16793A72&0&40F0. bad value was: REG_MULTI_SZ = PSched reset Linkage\UpperBind for ROOT\MS_NDISWANIP\0000. bad value was: REG_MULTI_SZ = PSched
Post #14
Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file….
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
Post #15
Thanks. Just ran the ESET online scan and no threats were found. I tried to connect to the internet normally but it was hardly responding so I had to run it in safe mode with networking. Sue.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI