What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

slow computer part two

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer often slows down to a near stand still. CPU load becomes 100 %. It often occurs when running iTunes or/and Bearshare, but also when running other applications. copy of my log :

Logfile of HijackThis v1.99.1
Scan saved at 10:45:09, on 21/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hitman Pro\srhelper.exe
C:\Program Files\USR WLAN\USR 22Mbps Adapter\USRWLAN.EXE
D:\Download\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Hitman Pro SurfRight Helper] "C:\Program Files\Hitman Pro\srhelper.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB0_0_0 -reboot 1
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: U.S.Robotics Wireless LAN Configuration Utility.lnk = ?
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.mediamarkt.com/
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://gw.belgocontrol.be/iNotes6.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/27fb831bca85e3…ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106782601481
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127981657251
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express2.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game17.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O18 - Protocol: cdefs - {B5F329B4-2BBD-48F5-ADAF-9EAF2AFE37B3} - C:\Program Files\Easy Computing\3D Modeltreinen\monki.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #2
Hello alverman, Welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.


Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
– Click the Gear wheel at the top of the Ad-Aware window
– Click General > Safety & Settings: Check (Green) all three.
– Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Please download the trial version of ewido anti-malware 3.5 here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Also please describe how your computer behaves at the moment.
Post #3
I did as suggested. I ran ewido in safe mode and hijack this in normal mode. Log files :

Logfile of HijackThis v1.99.1
Scan saved at 18:21:46, on 25/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hitman Pro\srhelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\USR WLAN\USR 22Mbps Adapter\USRWLAN.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
D:\Download\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Hitman Pro SurfRight Helper] "C:\Program Files\Hitman Pro\srhelper.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB0_0_0 -reboot 1
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: U.S.Robotics Wireless LAN Configuration Utility.lnk = ?
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.mediamarkt.com/
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://gw.belgocontrol.be/iNotes6.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/27fb831bca85e3…ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106782601481
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127981657251
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express2.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game17.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O18 - Protocol: cdefs - {B5F329B4-2BBD-48F5-ADAF-9EAF2AFE37B3} - C:\Program Files\Easy Computing\3D Modeltreinen\monki.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

———————————————————
ewido anti-malware - Scan rapport
———————————————————

+ Gemaakt op: 18:10:43, 25/02/2006
+ Rapport samenvatting: CD7E9F10

+ Scan resultaten:

C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Addcontrol : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\dirk@ivwbox[2].txt -> TrackingCookie.Ivwbox : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\dirk@komtrack[1].txt -> TrackingCookie.Komtrack : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\dirk@oewabox[1].txt -> TrackingCookie.Oewabox : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\dirk@statcounter[1].txt -> TrackingCookie.Statcounter : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\dirk@tacoda[2].txt -> TrackingCookie.Tacoda : Schoongemaakt met een backup
C:\Documents and Settings\Dirk\Cookies\dirk@webstat[2].txt -> TrackingCookie.Web-stat : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\erika@casalemedia[2].txt -> TrackingCookie.Casalemedia : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\erika@com[2].txt -> TrackingCookie.Com : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\erika@ivwbox[1].txt -> TrackingCookie.Ivwbox : Schoongemaakt met een backup
C:\Documents and Settings\Erika\Cookies\erika@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Addynamix : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Starware : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Schoongemaakt met een backup
C:\Documents and Settings\Vincent\Cookies\[removed][1].txt -> TrackingCookie.Starware : Schoongemaakt met een backup


::Einde rapport
Post #4 last edited
I'm looking at you log now. Please don't start a new Topic.
Please use the [external image: Posted Image] Button below to reply. Thanks


Also please describe how your computer behaves at the moment.
Post #5
Computer seems to behaving better. I just ran iTunes, Bearshare and MP3gain at the same time. CPU went up to 100 % (MP3gain mainly), but switching between programs was possible without noticeable delay. So a substantial improvement, it would seem. Many thanks, Dirk.
Post #6
I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

We can disable some that aren't needed at startup. They aren't bad, but are resource hogs and not needed at startup.


Please do not delete anything unless instructed to.

use Add/Remove Programs and remove Ewido. It's only a 14 day trial version.



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [Hitman Pro SurfRight Helper] "C:\Program Files\Hitman Pro\srhelper.exe"

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB0_0_0 -reboot 1

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O14 - IERESET.INF: START_PAGE_URL=http://www.mediamarkt.com/

O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://gw.belgocontrol.be/iNotes6.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/27fb831bca85e3…ip/RdxIE601.cab

O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express2.foto.com/activeX/newUploadFotoCom.CAB

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game17.zylomgames.com/activex/zylomgamesplayer.cab

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab

O18 - Protocol: cdefs - {B5F329B4-2BBD-48F5-ADAF-9EAF2AFE37B3} - C:\Program Files\Easy Computing\3D Modeltreinen\monki.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"



Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #7
I did what you asked. Computer still ok. Here's the log file :

Logfile of HijackThis v1.99.1
Scan saved at 18:58:21, on 27/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\USR WLAN\USR 22Mbps Adapter\USRWLAN.EXE
D:\Download\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: U.S.Robotics Wireless LAN Configuration Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106782601481
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127981657251
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #8
Good Job :thumbup:

use Add/Remove Programs and remove Ewido. It's only a 14 day trial version.


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #11
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI