8 replies to this topic

[Paolo283]

Hello -

Operating problems have developed on a system upgraded from Windows 98 to XP. All ISP connections are via dialup at 56 Kbps.

1. Internet Explorer 6.0 operation is painfully slow, dictating the use of alternate browsers.
2. Every attempt to upgrade the system to Windows XP SP2 has failed.
3. System routinely locks up in mid-application, forcing a reboot and creating a nuisance.
4. Earthlink Accelerator will not run without creating serious conflicts in other programs.

Remedies pursued to this point:

1. Run HijackThis and save a baseline scan log.
2. Run Panda online scan and post results. [ 18 threats found ]
3. Reboot to SAFEMODE.
4. Run Ad-Aware SE and post results. [ no threats found ]
5. Run Spybot S&D and post results. [ no threats found ]
6. Run Ewido and post results. [ 4 infected objects found and cleaned ]
7. Reboot to NORMAL mode.
8. Run Spy Sweeper and post results. [ no threats found ]
9. Run Kaspersky online scan and post results. [ no threats found ]
10. Run HijackThis and save a progress scan log

Please offer suggestions on a remedy to restore normal system operation. Thanks.

- Paolo283


---------------------------------------------------------
Panda OnLine Scan Results
16 March 2006
---------------------------------------------------------

Incident Status Location

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt[.realmedia.com/]

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.2o7.net/]

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.adtech.de/]

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\T\Application
Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.ath.belnk.com/]

Spyware:Cookie/Belnk Not disinfected
C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.belnk.com/]

Spyware:Cookie/Com.com Not disinfected
C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.com.com/]

Spyware:Cookie/Belnk Not disinfected
C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.dist.belnk.com/]

Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.maxserving.com/]

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.overture.com/]

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.questionmarket.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Tucows Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.tucows.com/]

Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[www.burstbeacon.com/]

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt[]

Virus:Eicar.Mod Not disinfected C:\Program Files\PestPatrol\Help.chm[HowCanITestDetection.html]

Potentially unwanted tool:Application/Processor Not disinfected C:\Recycled\Dc1.exe[Process.exe]


---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 12:01:07 PM, 3/22/2006
+ Report-Checksum: 92FCC529

+ Scan result:

:mozilla.13:C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.17:C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.25:C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup

::Report End

---------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 4:40:44 PM, on 3/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\EARTHL~2\PROTEC~1\ADSSER~1.EXE
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Netscape\Netscape72\Netscp.exe
C:\Program Files\Tracks Eraser Pro\te.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\T\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webcrawler.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.webcrawler.com"); (C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\ProtctIE.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - blank (file missing)
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\uninsttb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - blank (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape72\Netscp.exe" -turbo
O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Tracks Eraser Pro\te.exe min
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .dll: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Protocol: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - C:\Program Files\Common Files\G7PS\Shared Files\G7PSDLL\G7PS.dll
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ADSService - Copyright© Aluria Software, LLC - C:\PROGRA~1\EARTHL~2\PROTEC~1\ADSSER~1.EXE
O23 - Service: DM1Service - Unknown owner - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Aluria Software, LLC. - C:\PROGRA~1\EARTHL~2\PROTEC~1\EFWPPS~1.EXE
O23 - Service: EarthLink Protection Control Center Service (ELNKService) - Aluria Software, LLC. - C:\PROGRA~1\EARTHL~2\PROTEC~1\ELNKServ.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

[LDTate]

Does your system meet the requirements for SP2?
http://www.microsoft...p2/sysreqs.mspx

[Paolo283]

Thanks for addressing my issues. In the last several days, I managed to successfully upgrade to SP2. Furthermore, I am current with all critical updates installed and running. The problems experienced with my system locking up seem to have eased, however IE 6.0 is still woefully slow. Also, I notice that a significant portion of hard disk space is taken up with file archives. Any ideas? - Paolo283

[LDTate]

lets see if this will help speed it up.

Backup your Registry...
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run...)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

NOTE: To be extra safe you can choose to only remove the items in RED.

[Paolo283]

I'm back on line after three days out of pocket. I ran RegSeeker and observed that it eliminated a lot of dead wood in the registry. IE 6.0 "feels" snappier now, however Netscape continues to outperform it by a wide margin in terms of painting the screen and exhibiting a crisper response. Is there any dead wood in the several hundred megabytes of files in the System Volume Information that could safely be eliminated? - Paolo283

[LDTate]

Good Job

use Add/Remove Programs and remove Ewido unless you want to keep it. It's only a 14 day trial version.


Log looks good How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.





If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

[Paolo283]

LDTate - Thanks for the fine assist. Computing at this end should definitely be "happier" now. Cordially, - Paolo283

[LDTate]

Great job You're more then welcome. Glad we were able to help Peace be with you

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php