What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HTL - Soooooow slow; can't do my work

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
OK found and deleted the file. I already had Ewido but I think my free trail period is up so I hope it worked; here is the log.
IF the logs below show clear, any idea what I have been doing wrong? I ran adaware and spypot once or twice a week and am running AVG and Zonealarm.

Thanks
Peter
———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 6:42:25 PM, 9/28/2005
+ Report-Checksum: C00364B8

+ Scan result:

:mozilla.106:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.208:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.294:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.300:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup
:mozilla.301:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup
:mozilla.365:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
:mozilla.377:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.389:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.390:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.395:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.396:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.397:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.398:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.399:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.400:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.401:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.432:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Counted : Cleaned with backup
:mozilla.450:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.451:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.452:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.453:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.454:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.455:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.456:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.468:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.469:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.470:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.471:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.472:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.481:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.628:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.629:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.633:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.718:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Trafic : Cleaned with backup
:mozilla.724:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.725:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.726:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.727:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.728:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.729:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.730:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.731:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.732:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.733:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.736:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.743:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.748:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.749:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.750:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.751:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.752:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.753:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.754:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.755:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.756:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.758:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.761:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.767:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.768:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.773:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.775:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.776:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.783:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.784:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.785:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.786:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.787:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.803:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.804:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.805:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.807:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.808:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.809:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.810:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.811:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.812:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.813:C:\Documents and Settings\Yosamite Sam\Application Data\Mozilla\Profiles\default\0r8mql5n.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
C:\Documents and Settings\Yosamite Sam\Cookies\yosamite sam@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup


::Report End


Here is my new HTL:

Logfile of HijackThis v1.99.1
Scan saved at 6:47:59 PM, on 9/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\hijackthis\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar9.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar9.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar9.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\windows\GoogleToolbar9.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar9.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar9.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar9.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\windows\GoogleToolbar9.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B70417CE-9E50-46BA-A66D-8139F286370C}: NameServer = 209.87.128.99,209.87.128.104
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #17
Copy and paste the contents of the quote box below into notepad.

Save it as file name: "fixme.reg" (not including the quotes). Save as file type: *All files* and save it on your Desktop.



REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66}]


Then, locate fixme.reg on your desktop and it.

You will receive a prompt similar to: "Do you wish to merge the information into the registry?".

Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".

Reboot and post a new HJT log.
Post #18
OK done and here is log

Logfile of HijackThis v1.99.1
Scan saved at 8:29:55 PM, on 9/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\hijackthis\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar9.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar9.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar9.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\windows\GoogleToolbar9.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar9.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar9.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar9.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\windows\GoogleToolbar9.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B70417CE-9E50-46BA-A66D-8139F286370C}: NameServer = 209.87.128.99,209.87.128.104
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #19
Looks like you are running 2 Anti-Virus programs:
AVPERSONAL and Grisoft. I suggest you remove one of them. Running 2 can cause conflicts and lockups.

Also delete this folder:
C:\!Submit
That is from Ewido scans and not needed anymore.


I suggest you do this:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - Startup: PowerReg SchedulerV2.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #20
Hi LDTATE: No recurrence of 100% cpu use and computer is now hibernating instead of continuing to function. Speed seems ok; sorts and pgm loading are ok for speed. If this log is ok, should I be doing anything differently? Couldnt find the ewido file you mentioned.

Thanks
Peter

Logfile of HijackThis v1.99.1
Scan saved at 2:27:49 PM, on 9/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\hijackthis\HijackThis1991.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar9.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar9.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar9.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\windows\GoogleToolbar9.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar9.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar9.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar9.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\windows\GoogleToolbar9.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B70417CE-9E50-46BA-A66D-8139F286370C}: NameServer = 209.87.128.99,209.87.128.104
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #21
Lets also do this:

click Start> Run> type in Cleanmgr. Tap enter and select C: to clean.


Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #22
Here is new log; couldnt find the ewido file C:\!Submit


Logfile of HijackThis v1.99.1
Scan saved at 2:27:49 PM, on 9/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\hijackthis\HijackThis1991.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar9.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar9.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar9.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\windows\GoogleToolbar9.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar9.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar9.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar9.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\windows\GoogleToolbar9.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B70417CE-9E50-46BA-A66D-8139F286370C}: NameServer = 209.87.128.99,209.87.128.104
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #23
Good Job :thumbup:


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #24
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI