Operating problems have developed on a system upgraded from Windows 98 to XP. All ISP connections are via dialup at 56 Kbps.
1. Internet Explorer 6.0 operation is painfully slow, dictating the use of alternate browsers.
2. Every attempt to upgrade the system to Windows XP SP2 has failed.
3. System routinely locks up in mid-application, forcing a reboot and creating a nuisance.
4. Earthlink Accelerator will not run without creating serious conflicts in other programs.
Remedies pursued to this point:
1. Run HijackThis and save a baseline scan log.
2. Run Panda online scan and post results. [ 18 threats found ]
3. Reboot to SAFEMODE.
4. Run Ad-Aware SE and post results. [ no threats found ]
5. Run Spybot S&D and post results. [ no threats found ]
6. Run Ewido and post results. [ 4 infected objects found and cleaned ]
7. Reboot to NORMAL mode.
8. Run Spy Sweeper and post results. [ no threats found ]
9. Run Kaspersky online scan and post results. [ no threats found ]
10. Run HijackThis and save a progress scan log
Please offer suggestions on a remedy to restore normal system operation. Thanks.
- Paolo283
---------------------------------------------------------
Panda OnLine Scan Results
16 March 2006
---------------------------------------------------------
Incident Status Location
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt[.realmedia.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.2o7.net/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.adtech.de/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\T\Application
Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.ath.belnk.com/]
Spyware:Cookie/Belnk Not disinfected
C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.belnk.com/]
Spyware:Cookie/Com.com Not disinfected
C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.com.com/]
Spyware:Cookie/Belnk Not disinfected
C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.dist.belnk.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.maxserving.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.overture.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Tucows Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[.tucows.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[www.burstbeacon.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt[]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt[]
Virus:Eicar.Mod Not disinfected C:\Program Files\PestPatrol\Help.chm[HowCanITestDetection.html]
Potentially unwanted tool:Application/Processor Not disinfected C:\Recycled\Dc1.exe[Process.exe]
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 12:01:07 PM, 3/22/2006
+ Report-Checksum: 92FCC529
+ Scan result:
:mozilla.13:C:\Documents and Settings\T\Application Data\Mozilla\Firefox\Profiles\1vqokw8x.T\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.17:C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.25:C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
::Report End
---------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 4:40:44 PM, on 3/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\EARTHL~2\PROTEC~1\ADSSER~1.EXE
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Netscape\Netscape72\Netscp.exe
C:\Program Files\Tracks Eraser Pro\te.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\T\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webcrawler.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.webcrawler.com"); (C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\T\Application Data\Mozilla\Profiles\default\z718lzfl.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\ProtctIE.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - blank (file missing)
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\uninsttb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - blank (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Protection Control Center\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape72\Netscp.exe" -turbo
O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Tracks Eraser Pro\te.exe min
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .dll: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Protocol: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - C:\Program Files\Common Files\G7PS\Shared Files\G7PSDLL\G7PS.dll
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ADSService - Copyright© Aluria Software, LLC - C:\PROGRA~1\EARTHL~2\PROTEC~1\ADSSER~1.EXE
O23 - Service: DM1Service - Unknown owner - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Aluria Software, LLC. - C:\PROGRA~1\EARTHL~2\PROTEC~1\EFWPPS~1.EXE
O23 - Service: EarthLink Protection Control Center Service (ELNKService) - Aluria Software, LLC. - C:\PROGRA~1\EARTHL~2\PROTEC~1\ELNKServ.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe