What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC starts slowly

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer Is slowlier than before: starts slowlier, ie - connection seems to be slowlier, and programs are also slowlier than before. Is there something wrong:

StartupList report, 2005-10-12, 10:10:35
StartupList version: 1.52.2
Started from : C:\Documents and Settings\sussie\Skrivbord\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Winamp\winampa.exe
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\QuickTime\qttask.exe
C:\Program\D-Tools\daemon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Documents and Settings\sussie\Skrivbord\HijackThis.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

WinampAgent = C:\Program\Winamp\winampa.exe
avast! = C:\Program\ALWILS~1\Avast4\ashDisp.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Zone Labs Client = C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
QuickTime Task = "C:\Program\QuickTime\qttask.exe" -atboottime
DAEMON Tools-1033 = "C:\Program\D-Tools\daemon.exe" -lang 1033

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

————————————————–

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwa…director/sw.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://www.pandasoftware.com/activescan/as5/asinst.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/…8168.9946759259

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa…ash/swflash.cab

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll

————————————————–
End of report, 4 431 bytes
Report generated in 0,016 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Post #2
We are sorry for the delay in replying to you.

In your previous post you pasted a StartupList log while we need to see a Hijackthis log. Open Hijackthis, click None of the above, just start the program, then click Scan. After the scan is complete, the Scan button will turn into a Save Log button. Click it and the log will open up in Notepad. Post the contents of that log as a reply to this thread.

I'll receive an e-mail notification of your reply and will respond as soon as possible.

Thank you for your patience.
Post #3
I hope this is a right one, I am not very familiar whith these machines. Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 18:45:14, on 2005-10-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\QuickTime\qttask.exe
C:\Program\D-Tools\daemon.exe
C:\Program\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program\TextBridge Classic 2.0\Ereg\REMIND32.EXE
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Documents and Settings\sussie\Skrivbord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telia.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [InstantAccess] C:\Program\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\Program\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Program\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program\TextBridge Classic 2.0\Ereg\REMIND32.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Telias säkerhetstjänster (BackWeb Client - 7836882) - Unknown owner - C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #4
Hello futuric and welcome to TomCoyote. :wavey:

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com


Optional items to check with HijackThis.
Registration reminder for ScanSoft products.
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program\TextBridge Classic 2.0\Ereg\REMIND32.EXE

With all other programs and browsers closed, click fix checked.


Step 2
Download CCleaner to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.


Step 3
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.
Post #5
I Have unistalled "telias säkerhetstjänster" what is this one "O23 - Service: Telias säkerhetstjänster (BackWeb Client - 7836882) - Unknown owner - C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE" Can I take it away. PC is still slowlier than before, but it is not very bad. Mayby it is little better now (after doing as you said). When starts, comes warning: "Virtualmemory is too little or it doesnt exist" (I translated this from swedish). Problem was there before I wrote to you first time.

Here is the the last logfile:



Logfile of HijackThis v1.99.1
Scan saved at 17:08:57, on 2005-10-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\QuickTime\qttask.exe
C:\Program\D-Tools\daemon.exe
C:\Program\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Documents and Settings\sussie\Skrivbord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telia.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [InstantAccess] C:\Program\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\Program\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Program\TEXTBR~1.0\Bin\REGIST~1.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Telias säkerhetstjänster (BackWeb Client - 7836882) - Unknown owner - C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #6

I Have unistalled "telias säkerhetstjänster" what is this one "O23 - Service: Telias säkerhetstjänster (BackWeb Client - 7836882) - Unknown owner - C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE" Can I take it away.

This is a left over entry from the uninstall of the program. We'll remove it now. :thumbup:

Disable the leftover Service
  • Click Start < Run and type services.msc.
  • Scroll down to Telias säkerhetstjänster and right click on it.
  • Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.
    It may already be stopped, but make sure to Disable it still.

Delete the leftover Service
  • Open HijackThis and click Config -> Misc Tools -> Delete an NT service.
  • In the Delete window, type BackWeb Client - 7836882 and press OK.
  • OK any prompts, close HijackThis, and restart your computer.


Delete the following folder:

C:\Program\Telia

————————————————-

Article found here.

You can increase the size of the paging file. When you start , it automatically creates a paging file (Pagefile.sys) on the disk where you installed the operating system. uses the paging file to provide virtual memory. The recommended size for the paging file is equivalent to 1.5 times the amount of RAM available on your system. However, the size of the file also depends on the amount of free space available on your hard disk when the file is created. You can find out how large your system's paging file is by looking at the file size shown for Pagefile.sys in Windows Explorer.

Assuming you are not already short of disk space, you can increase the size of the paging file. If your users tend to run several programs simultaneously, they might find that increasing the size of the paging file will enable programs to start faster.

Although you can reset both the initial and the maximum sizes for the paging file, it is more efficient to expand initial paging file size, rather than force the operating system to allocate more paging file space as programs start, which fragments the disk.

If the paging file reaches its maximum size, a warning is displayed and the system may halt. To see whether your paging file is approaching its upper limit before it reaches the upper limit, check the actual file size and compare it to the maximum paging file size setting in the System utility in Control Panel. If these two numbers are close in value, consider increasing initial paging file size or running fewer programs.

Paging file counters offer another way to see whether the size of the Pagefile.sys file is appropriate:


Paging File\% Usage

Paging File\% Usage Peak (bytes)

If the % Usage Peak value approaches the maximum paging file setting, or if % Usage nears 100 percent, consider increasing the initial file size.

If multiple paging files are spread across multiple disk drives, the path name of each file appears as an instance of the Paging File object type. You can either add a counter for each paging file or select the _Total instance to look at combined usage data for all your paging files.


Now we'll see if we can fix the Virtual Memory problem. First, you will need to check how much memory is on your computer. Go to Start and right-click My Computer and select Properties. On the 'General Tab' the amount of RAM installed on your computer should show at the bottom along with the speed of your processor. I will assume you have 512MB of RAM for this fix. You will need to adjust these numbers (more are listed below) if you have a different amount of RAM.
Click on the 'Advanced' tab and select Settings under the 'Performance' section. Click on the Advanced tab and choose the Change button under 'Virtual memory'. Highlight the C: drive then click the circle next to Custom size:. Enter the value for Initial size (MB): and Maximum size to 1280. Click OK at the prompts. You will need to reboot the computer for the settings to take effect.

For 256MB of RAM enter 640 as both values.
For 768MB of RAM enter 1152 as both values.
For 1024MB of RAM enter 1536 as both values.



After the reboot, play around with the computer for a little while to see if the problems still exists. Post a fresh HijackThis log here when done.
Also, post how much free space is on your hard drive. Find this by right-clicking on (C:) and choosing properties. On the 'General' tab, there will be a pie chart with the Capacity, amount of Used Space and amount of Free Space just above it. Post the amount of these three items in your next post:
Capacity
Used Space
Free Space

Post #7
Virtualmemory proplem is still there. I have done this (many times) :
"Click on the 'Advanced' tab and select Settings under the 'Performance' section. Click on the Advanced tab and choose the Change button under 'Virtual memory'. Highlight the C: drive then click the circle next to Custom size:. Enter the value for Initial size (MB): and Maximum size to 1280."

It is always the same after that. When I restart comes warning: "there is no virtualmemory or…". When I try to change values and press the button "Advanced" comes warning: "Temporary virtualmemory have been created because there was problems when starts whith configurering virtualmemories. Whole size of every units can be higher than you marked." sorry my bad english, I hope you can find right english version of that warning.

When PC starts, it take long time (about minute or two) before I can see Windows logo (almost whole time screen is black), when I have clicked VM warning starts Windows quickly.

Sometimes, maybe one time in a week, PC shut down on her(?) own. Now I am away about week so I write then again.

Capacity: 76,3 Gb
Used Space: 72,1 Gb
Free Space: 4,18 Gb

And the Logfile:



Logfile of HijackThis v1.99.1
Scan saved at 11:09:10, on 2005-10-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\QuickTime\qttask.exe
C:\Program\D-Tools\daemon.exe
C:\Program\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Documents and Settings\sussie\Skrivbord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telia.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [InstantAccess] C:\Program\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\Program\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Program\TEXTBR~1.0\Bin\REGIST~1.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #8

Capacity: 76,3 Gb
Used Space: 72,1 Gb
Free Space: 4,18 Gb

This shows that you are very low on hard-drive space as there is only 5% remaining. It is recommended to at least have 15% of memory empty for the computer to function properly. You should either invest in a second hard-drive (slave) for the computer and move some of the stuff to it or remove any un-used or un-necessary programs from this computer. After doing this, run the Disk Cleanup and Disk Defragmenter features built into Windows.


To run Disk Cleanup : Go > Start > Run and type cleanmgr and click OK.
Scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
Click OK to remove those files.
Click Yes to confirm deletion.


To run Disk Defragmenter : Go to Start < All Programs < Accessories < Sytem Tools < Disk Defragment. Click on your hard-drive and select Defragment.




Since your computer appears to be clean of malware, I'll give you my security recommendations now.

Your new log appears clean. :)

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you download these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Here are two very good and free malware scanners:

Spybot Search and Destroy 1.4
AdAware SE v1.06
Set-up Instructions for Spybot S&D; and Adaware SE

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read the following posts to learn how to better secure your computer.
"So how did I get infected in the first place"
"Securing Your PC After An Attack"

Be sure to keep Windows and your Anti-virus updated.
Post #9
Thank you very much, You are great guys helping me and others whith proplems. I still have VM proplem but thats not so big problem. futuric
Post #11
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI