kevino
Topic Starter
My Windows 2000 machine has slowed to almost a standstill. In searching for answers, I came across this site and was impressed with the quality of the advice. I'll appreciate any guidance you can share about solving my problem.
Symptoms: Machine boots fine in regular mode, moving at normal speed through my login. Then, from the moment my personal settings are being loaded, the machine slows waaaaaaaay down. It takes ten-plus minutes for my desktop to come up. The Active Desktop comes up disabled. I can browse my computer, but it takes minutes for each step. I can install software, but it takes forever. I can shut down the computer, and in ten minutes or so it will eventually close.
The machine runs fine when starting in safe mode, operating at regular speed.
Steps I've taken:
I've scanned with:
Panda (no viruses found)
Housecall
found ADW Scanportall A in C:\program files\common files\SLMSS\SLMSS.exe
Trojan SC Thought.C in C:\winnt\downloaded program files\install026.exe
ADW SC Thought.C in C:\winnt\mwsvm.exe
ADW SC Thought.C in C:\winnt\mwsvm.ocx
ADW SC Thought.C in C:\winnt\nnmgr.ocx
The above were all listed as “non-cleanable”. I’ve scanned all these files with Norton AntiVirus, and they all came up clean. I’ve deleted them all anyway.
e-Trust (no viruses)
BitDefender
found Adware.WhenU.A in C:\program files\whenusearch\search.dll
Adware.serchentry.A in C:\winnt\preinstt.exe
Trojan.secondthought.AG in C:\winnt\system32\2ndsearch.dll=>(UPX)
Trojan.spy.lazy.c in C:\winnt\system32\idleUI.dll
Adware.B.Spy.C in C:\winnt\twaintec.dll
I’ve scanned each of these files with Nortin AntiVirus and they all came up clean. I’ve deleted them all anyway.
The above files are actually in the recycle bin. I haven’t yet deleted them.
I did these scans in sequence without rebooting in between. Some of the above found several files that led to "open error" or that were password protected.
I ran a full scan with Norton AntiVirus, using a fresh set of definitions. The machine came up 100% clean. I haven't done a DOS scan.
I ran Stinger, which found no problems.
Spybot S&D found no problems.
I ran Hijact This after a reboot in regular mode. Here is the log file:
Logfile of HijackThis v1.97.7
Scan saved at 2:01:39 PM, on 10/1/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ScsiAccess.EXE
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Google\ggviewer67-84.exe
C:\WINNT\system32\tp4mon.exe
C:\WINNT\MS\SMS\clicomp\sinv\sinv32.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
G:\HijackThis.exe
G:\HijackThis.exe
G:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dogpile.com/info.dogpl.toolbar/…orms/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dogpile.com/info.dogpl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://infonet.inspinc.ad/default.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.dogpile.com/info.dogpl.toolbar/…orms/search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dogpile.com/info.dogpl.toolbar/…orms/search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dogpile.com/info.dogpl/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.dogpile.com/info.dogpl.toolbar/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Atomica BHO - {3392BD0A-A851-4AA4-86E0-4651006F9EA8} - C:\Program Files\Common Files\Atomica Shared\agtbho.dll
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINNT\System32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\winnt\googletoolbar_en_2.0.108-big.dll
O2 - BHO: (no name) - {ba727652-f90e-4d82-9ce4-98766dffc375} - C:\Program Files\Onfolio\onfoliox.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E8C0F153-B768-4e68-B14F-40F0E8531675} - C:\WINNT\System32\BhoCiti.dll
O3 - Toolbar: Amplify - {FA6D230B-173A-49D1-ABFA-34392994EC7A} - C:\Program Files\Amplify\AmplifyToolbar.dll
O3 - Toolbar: Dogpile Toolbar - {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - C:\Program Files\DogpileToolbar\ultrabar.dll
O3 - Toolbar: HotBot Desktop - {bbff9532-5340-11d8-b39a-000d5610942e} - C:\Program Files\Lycos\HotBot Desktop\Toolbar\ArgoToolbar1046.dll
O3 - Toolbar: superpagescom - {630FDD08-3035-4880-B2FE-E67F514319FB} - C:\WINNT\Downloaded Program Files\superpagescom.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Optimum Online Toolbar - {720B3C59-7EDE-44d1-AD9C-71106A7550AF} - C:\Program Files\OptimumOnline\insptbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\InoculateIT\realmon.exe"
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Global Startup: Amplify.lnk.disabled
O4 - Global Startup: GuruNet.lnk.disabled
O4 - Global Startup: Kodak EasyShare software.lnk.disabled
O4 - Global Startup: Kodak software updater.lnk.disabled
O4 - Global Startup: Live Menu.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk.disabled
O4 - Global Startup: Screen Saver Control.lnk.disabled
O4 - Global Startup: XTool.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: A&dd To Amp - res://C:\Program Files\Amplify\resources.dll/contextmenuaddto.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmcache.html
O8 - Extra context menu item: Capture &Image To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Capture &Page To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddLinkEntryFromDocument.html
O8 - Extra context menu item: Capture &Snippet To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentSelection.html
O8 - Extra context menu item: Capture &Target To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res:///3000
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O8 - Extra context menu item: Optimum Online Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\OptimumOnline\contextsearch.htm
O8 - Extra context menu item: RoboForm &2 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmsimilar.html
O8 - Extra context menu item: Teoma Search - javascript:external.menuArguments.location.href="javascript:TeomaBarcommand='cmd-search-selection'"
O8 - Extra context menu item: Translate into English - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmtrans.html
O9 - Extra button: Browser Pal Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: Launch Copernic Agent (HKLM)
O9 - Extra 'Tools' menuitem: Onfolio Capture… (HKLM)
O9 - Extra 'Tools' menuitem: Onfolio Collection Explorer (HKLM)
O9 - Extra button: Citi (HKLM)
O9 - Extra button: Copernic Agent (HKLM)
O9 - Extra button: RoboForm (HKLM)
O9 - Extra 'Tools' menuitem: RoboForm &2 (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (eAssist NetAgent Customer ActiveX Control version 3) - https://quicken.ehosts.net/netagent/objects/custappx3.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {470A6E01-15A3-49B3-B8B9-8EDF4AC1A480} (Teoma Installer Control) - http://sp.ask.com/docs/teoma/toolbar/downl…teomab-inst.cab
O16 - DPF: {4855C21B-E452-4661-A702-ED3493CE74DF} - http://sp.ask.com/docs/toolbar/download/askbar-inst.cab
O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/hbdt/en_US/hotbot/hbdt.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18cdf38c64fa59…ip/RdxIE601.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} (Dogpile Toolbar) - http://a1040.g.akamai.net/f/1040/759/1h/pi…wnload/tbar.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - ftp://adeskftp.autodesk.com/WebPub/mapgui…en/mgaxctrl.cab
O16 - DPF: {630FDD08-3035-4880-B2FE-E67F514319FB} (superpagescom) - http://www.superpages.com/toolbar/superpagescom.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www-3.ibm.com/pc/support/access/asl…nt/IbmEgath.cab
O16 - DPF: {7704D8D8-9EFE-4D82-9C89-0ECBA8434EEE} (PSSetup Class) - http://www.fast-finder.com/downloads/FFOCX2.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7B49A2A6-B45F-46F3-AC60-2578477671EE} - http://www.ultrabar.com/user_data/v/p/vpop…st/ultrabar.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {862FB893-B24B-4FAD-80D3-A1158EB34DB4} (CNET SearchBar) - http://www.search.com/cnetsearchbar.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7951.9348726852
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.com/players/english/5.2…yer5.2AxWin.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/hitthepros0…orts/wtinst.cab
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - http://www.amplifytheweb.com/install/setup.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.cab
O16 - DPF: {D14D6793-9B65-11D3-80B6-00500487BDBA} - http://files.cc.cometsystems.com/cc2/relea…-3-333-ccct.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {DF042E4A-5577-4D32-9305-442923D7838B} (RemoveDS Class) - http://www.fast-finder.com/uninstall/uninstall_nn.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://premconf.webex.com/client/v_premcon…bex/ieatgpc.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-3.ibm.com/pc/support/access/asl…/AcpControl.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {EC0DA586-8F4F-4112-AEA4-2110592C8FF4} (RemovePSFull Class) - http://www.fast-finder.com/uninstall/FFUninstaller.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_0_2_7.cab
O16 - DPF: {FEE7FD53-3356-4D4D-8978-2C4AE3A7E109} (WhenuDownload Class) - http://download.whenu.com/WUDownld1.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = inspinc.ad
I installed msconfig and deselected ALL items that launch at startup. I also deselected all of those items in Spybot S&D. After rebooting, Spybot and msconig show the synchronization manager, mobsync.exe /logon as an item that is checked.
My drives are pretty full. C drive has 600MB available out of 5.3GB. D drive has about 3GB available out of 22GB.
None of the above actions have had any effect on the speed problem that occurs from the moment personal settings begin to load.
I can't say I've been 100% systematic in running the above (e.g. didn't reboot between doing the various online scans, didn't download all the latest definitions for Spybot S&D).
I have a lot of toolbars on my machine, including some with adware. I have to keep most of those on the machine as part of my job. The machine has run fine for months with toolbars from Dogpile, Google, Copernic, Amplify, GuruNet, RoboForm, HotBox and a few others. I haven't knowingly added any other downloadable applications.
I probably have to start over, doing it right. Where do I begin?
Symptoms: Machine boots fine in regular mode, moving at normal speed through my login. Then, from the moment my personal settings are being loaded, the machine slows waaaaaaaay down. It takes ten-plus minutes for my desktop to come up. The Active Desktop comes up disabled. I can browse my computer, but it takes minutes for each step. I can install software, but it takes forever. I can shut down the computer, and in ten minutes or so it will eventually close.
The machine runs fine when starting in safe mode, operating at regular speed.
Steps I've taken:
I've scanned with:
Panda (no viruses found)
Housecall
found ADW Scanportall A in C:\program files\common files\SLMSS\SLMSS.exe
Trojan SC Thought.C in C:\winnt\downloaded program files\install026.exe
ADW SC Thought.C in C:\winnt\mwsvm.exe
ADW SC Thought.C in C:\winnt\mwsvm.ocx
ADW SC Thought.C in C:\winnt\nnmgr.ocx
The above were all listed as “non-cleanable”. I’ve scanned all these files with Norton AntiVirus, and they all came up clean. I’ve deleted them all anyway.
e-Trust (no viruses)
BitDefender
found Adware.WhenU.A in C:\program files\whenusearch\search.dll
Adware.serchentry.A in C:\winnt\preinstt.exe
Trojan.secondthought.AG in C:\winnt\system32\2ndsearch.dll=>(UPX)
Trojan.spy.lazy.c in C:\winnt\system32\idleUI.dll
Adware.B.Spy.C in C:\winnt\twaintec.dll
I’ve scanned each of these files with Nortin AntiVirus and they all came up clean. I’ve deleted them all anyway.
The above files are actually in the recycle bin. I haven’t yet deleted them.
I did these scans in sequence without rebooting in between. Some of the above found several files that led to "open error" or that were password protected.
I ran a full scan with Norton AntiVirus, using a fresh set of definitions. The machine came up 100% clean. I haven't done a DOS scan.
I ran Stinger, which found no problems.
Spybot S&D found no problems.
I ran Hijact This after a reboot in regular mode. Here is the log file:
Logfile of HijackThis v1.97.7
Scan saved at 2:01:39 PM, on 10/1/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ScsiAccess.EXE
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Google\ggviewer67-84.exe
C:\WINNT\system32\tp4mon.exe
C:\WINNT\MS\SMS\clicomp\sinv\sinv32.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
G:\HijackThis.exe
G:\HijackThis.exe
G:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dogpile.com/info.dogpl.toolbar/…orms/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dogpile.com/info.dogpl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://infonet.inspinc.ad/default.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.dogpile.com/info.dogpl.toolbar/…orms/search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dogpile.com/info.dogpl.toolbar/…orms/search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dogpile.com/info.dogpl/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.dogpile.com/info.dogpl.toolbar/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Atomica BHO - {3392BD0A-A851-4AA4-86E0-4651006F9EA8} - C:\Program Files\Common Files\Atomica Shared\agtbho.dll
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINNT\System32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\winnt\googletoolbar_en_2.0.108-big.dll
O2 - BHO: (no name) - {ba727652-f90e-4d82-9ce4-98766dffc375} - C:\Program Files\Onfolio\onfoliox.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E8C0F153-B768-4e68-B14F-40F0E8531675} - C:\WINNT\System32\BhoCiti.dll
O3 - Toolbar: Amplify - {FA6D230B-173A-49D1-ABFA-34392994EC7A} - C:\Program Files\Amplify\AmplifyToolbar.dll
O3 - Toolbar: Dogpile Toolbar - {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - C:\Program Files\DogpileToolbar\ultrabar.dll
O3 - Toolbar: HotBot Desktop - {bbff9532-5340-11d8-b39a-000d5610942e} - C:\Program Files\Lycos\HotBot Desktop\Toolbar\ArgoToolbar1046.dll
O3 - Toolbar: superpagescom - {630FDD08-3035-4880-B2FE-E67F514319FB} - C:\WINNT\Downloaded Program Files\superpagescom.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Optimum Online Toolbar - {720B3C59-7EDE-44d1-AD9C-71106A7550AF} - C:\Program Files\OptimumOnline\insptbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\InoculateIT\realmon.exe"
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Global Startup: Amplify.lnk.disabled
O4 - Global Startup: GuruNet.lnk.disabled
O4 - Global Startup: Kodak EasyShare software.lnk.disabled
O4 - Global Startup: Kodak software updater.lnk.disabled
O4 - Global Startup: Live Menu.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk.disabled
O4 - Global Startup: Screen Saver Control.lnk.disabled
O4 - Global Startup: XTool.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: A&dd To Amp - res://C:\Program Files\Amplify\resources.dll/contextmenuaddto.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmcache.html
O8 - Extra context menu item: Capture &Image To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Capture &Page To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddLinkEntryFromDocument.html
O8 - Extra context menu item: Capture &Snippet To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentSelection.html
O8 - Extra context menu item: Capture &Target To Onfolio… - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res:///3000
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O8 - Extra context menu item: Optimum Online Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\OptimumOnline\contextsearch.htm
O8 - Extra context menu item: RoboForm &2 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmsimilar.html
O8 - Extra context menu item: Teoma Search - javascript:external.menuArguments.location.href="javascript:TeomaBarcommand='cmd-search-selection'"
O8 - Extra context menu item: Translate into English - res://c:\winnt\GoogleToolbar_en_2.0.108-big.dll/cmtrans.html
O9 - Extra button: Browser Pal Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: Launch Copernic Agent (HKLM)
O9 - Extra 'Tools' menuitem: Onfolio Capture… (HKLM)
O9 - Extra 'Tools' menuitem: Onfolio Collection Explorer (HKLM)
O9 - Extra button: Citi (HKLM)
O9 - Extra button: Copernic Agent (HKLM)
O9 - Extra button: RoboForm (HKLM)
O9 - Extra 'Tools' menuitem: RoboForm &2 (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (eAssist NetAgent Customer ActiveX Control version 3) - https://quicken.ehosts.net/netagent/objects/custappx3.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {470A6E01-15A3-49B3-B8B9-8EDF4AC1A480} (Teoma Installer Control) - http://sp.ask.com/docs/teoma/toolbar/downl…teomab-inst.cab
O16 - DPF: {4855C21B-E452-4661-A702-ED3493CE74DF} - http://sp.ask.com/docs/toolbar/download/askbar-inst.cab
O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/hbdt/en_US/hotbot/hbdt.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18cdf38c64fa59…ip/RdxIE601.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} (Dogpile Toolbar) - http://a1040.g.akamai.net/f/1040/759/1h/pi…wnload/tbar.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - ftp://adeskftp.autodesk.com/WebPub/mapgui…en/mgaxctrl.cab
O16 - DPF: {630FDD08-3035-4880-B2FE-E67F514319FB} (superpagescom) - http://www.superpages.com/toolbar/superpagescom.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www-3.ibm.com/pc/support/access/asl…nt/IbmEgath.cab
O16 - DPF: {7704D8D8-9EFE-4D82-9C89-0ECBA8434EEE} (PSSetup Class) - http://www.fast-finder.com/downloads/FFOCX2.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7B49A2A6-B45F-46F3-AC60-2578477671EE} - http://www.ultrabar.com/user_data/v/p/vpop…st/ultrabar.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {862FB893-B24B-4FAD-80D3-A1158EB34DB4} (CNET SearchBar) - http://www.search.com/cnetsearchbar.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7951.9348726852
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.com/players/english/5.2…yer5.2AxWin.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/hitthepros0…orts/wtinst.cab
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - http://www.amplifytheweb.com/install/setup.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.cab
O16 - DPF: {D14D6793-9B65-11D3-80B6-00500487BDBA} - http://files.cc.cometsystems.com/cc2/relea…-3-333-ccct.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {DF042E4A-5577-4D32-9305-442923D7838B} (RemoveDS Class) - http://www.fast-finder.com/uninstall/uninstall_nn.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://premconf.webex.com/client/v_premcon…bex/ieatgpc.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-3.ibm.com/pc/support/access/asl…/AcpControl.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {EC0DA586-8F4F-4112-AEA4-2110592C8FF4} (RemovePSFull Class) - http://www.fast-finder.com/uninstall/FFUninstaller.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_0_2_7.cab
O16 - DPF: {FEE7FD53-3356-4D4D-8978-2C4AE3A7E109} (WhenuDownload Class) - http://download.whenu.com/WUDownld1.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = inspinc.ad
I installed msconfig and deselected ALL items that launch at startup. I also deselected all of those items in Spybot S&D. After rebooting, Spybot and msconig show the synchronization manager, mobsync.exe /logon as an item that is checked.
My drives are pretty full. C drive has 600MB available out of 5.3GB. D drive has about 3GB available out of 22GB.
None of the above actions have had any effect on the speed problem that occurs from the moment personal settings begin to load.
I can't say I've been 100% systematic in running the above (e.g. didn't reboot between doing the various online scans, didn't download all the latest definitions for Spybot S&D).
I have a lot of toolbars on my machine, including some with adware. I have to keep most of those on the machine as part of my job. The machine has run fine for months with toolbars from Dogpile, Google, Copernic, Amplify, GuruNet, RoboForm, HotBox and a few others. I haven't knowingly added any other downloadable applications.
I probably have to start over, doing it right. Where do I begin?
