What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Software

leftover from malware fix?

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi I've just been led through a very thorough (and much appreciated) process in the other forum to remove a malware infection. All the relevant scans are now showing malware free. However I now have a symptom which I don't remember having before the infection (or at least not as badly as now). The problem occurs only after first booting or re-booting the computer. The program icons in the tray take a while to settle down as they always have (avg free, zone alarm and a little update thingamy that I get because I must have downloaded sp2 but have chosen not to instal it. I also now have ewido but I've de-activated the 'scan programs on opening' function because I thought that might be the cause of the problem). Anyway all that has taken a while and the broadband connection appears to have been established but then when I try to open any program ( i think windows explorer doesn't always have the problem but internet explorer, photoshop, freerip etc certainly do) I get the eggtimer for a few seconds and then nothing for minutes…such a long wait that I usually try to open task manager to see whats going on and then that doesn't open either. Eventually they do all open at once …but the delay is annoying and wasn't present in the past. Once past this point all programs then open promptly from then on. Can anyone throw any light on what might be happening please? Regards Stillwill Logfile of HijackThis v1.99.0 Scan saved at 15:18:08, on 12/08/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Added 30mins later: I've just been to the zonealarm forum and it looks as though the latest zonealarm update may be responsible. Someone there has suggested deleting (in safe mode) RDB, LDB, and TMP files in windows/internet logs. I intend to try this but would still welcome any comments.
Post #2 last edited
Hi, I have waited a while before responding as I was hoping one of the forum's more experienced practitioners would provide the info you are seeking, but as you have had no reply so far, the following comments might be helpful. 1 Check to see if any Windows protected files have become corrupted or deleted by clicking on Start/Run and entering the following: sfc /scannow (the space between the c and the forward slash is essential) If there are any protected files which need replacing Windows will ask you for your Windows XP CD 2 Check to make sure that your computer is not performing a scheduled activity on bootup. I'm thinking here of anti-virus/spyware scans or loading up the prefetch or loading a large number of fonts. 3 Check that your BIOS has not been altered so that time wasting actions are being performed. 4 If you still have no improvement then it's time to bring out the heavy artillery and if you post back I will provide you with a suitable link Regards paws
Post #3 last edited
Paws, Thank you for inviting me to look in on this thread. I do hope that some of the Expert Members will also take the opportunity to contribute as well.
__________

Hi Stillwill,

Do you have an IRC/Unix application titled DarkBot
here's a reference to RDB file extension
http://filext.com/detaillist.php?extdetail=RDB

Do you use Microsoft Access (part of MS Office) or an OpenSource application called WorkBench?
LDB file extension is used in both for temporary mirroring of activity while you use the application, and then should be closed and deleted automatically when you exit Access or Workbench.

TMP's are used frequently by Windows and other applications.
If you haven't cleaned up your Temporary files and run a hard drive Defrag for a while, that could be a part of the reason for your slow down. (Ooops. You just ran AFT Cleaner, so the temps are probably all gone already)

How much "Free Space" do you have on your Hard Drive(s)? Recommend that you try to keep about 25% Free Space on each of your drives/partitions. When drives start getting overly full, Windows and other applications start complaining since they no longer have the "wiggle room" they need when in operation. Thus this "could" be contributing to your slow-down.

But you say that this problem generally occurs in the first minutes of operation (up to 30 minutes?) and then things begin operating as expected.

I wonder if you have many application programs that attempt to access the Internet at boot time to check for updated versions. It's easy to accumulate a ton of programs that operate that way, and there is very little reason to let it continue, except for your antivirus.

I also wonder if you have antivirus and antispyware programs that are "always on" running in the background consuming CPU cycles and RAM.

I think you may have established a new broadband connection? If so, there may be some steps to take to maximize the configuration of that connection.

Before you take any of these above recommended steps, I'd like to get a good overall picture of how your machine is "currently" running after your session with Malware removal, especially since you think things have slowed down significantly. I've followed your malware removal work that you did with Micah, and am convinced that none of that work would "cause" a slow down, with the possible temporary exception of AFT Cleaner as your machine rebuilds its Prefetch folder. However, running the tools you've run can possibly result in some Hard Drive fragmentation (stuff gets spread all over the drive in smaller than usual pieces, causing increased lag due to additional seek/read/write cycles).

So, I'd like you to consider running a Full Test over at http://www.pcpitstop.com
Click on Full Tests (in the left hand column)
You'll be asked to register with a valid email address and create a password. (it's free)
Then you'll get a confirmation email to activate your status with Full Tests.
Next - Click on Full Tests - Test this Machine
You'll be asked to accept an ActiveX that enables the test to be run on your machine. (it's safe)
When the test is complete, you'll get your Results.
On the Results Pages you'll find a "TechExpress Link" option in a brownish yellow box.
Please Highlight and Copy the entire TechExpress Link item, and Paste it back into your next reply here in this thread at Tom Coyote "other computer problems".

Best Regards
Post #4
Hi dough and paws

Thanks for responding to my enquiry.
I've just completed the full test at pcpitstop but am feeling slightly reluctant to post a link to all those details in a public forum.

However there are a few more details which may help to identify the problem.

Apparently windows/internet logs is a specific zonealarm folder and I've deleted the relevant files as recommended without solving the problem.

If I open task manager as my first program (once the tray icons are all up and running) I get a delay which seems like a long time (but which may have seemed longer to me than it really is….although its still longer than it used to be!!) The processes page shows that one of several svchost.exe processess is running for just over two and a half minutes. I've disabled ewido auto-updates and avg is sheduled to update at a specific time rather than at startup. Zonealarm is set to auto update…I'm not sure whether thats at startup or not but I'll disable it for a while and see if that makes a difference.

I've included a startuplist log in case that throws any light on things. Am still wavering on the pcpitstop report..maybe you can convince me its ok to post.

Regards
Stillwill




StartupList report, 20/08/2006, 20:12:08
StartupList version: 1.52
Started from : C:\Documents and Settings\Omni\My Documents\My Deliveries\SPYWARE TOOLS\StartupList.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Omni\My Documents\My Deliveries\SPYWARE TOOLS\StartupList.exe

————————————————–

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

TotalRecorderScheduler = C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
AVG7_CC = C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
!ewido = "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
Zone Labs Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - c:\program files\google\googletoolbar2.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

————————————————–

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://active.macromedia.com/director/cabs/sw.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\System32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/…7874.1941319444

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx
CODEBASE = http://fpdownload.macromedia.com/get/shock…ash/swflash.cab

[Yahoo! Photos Easy Upload Tool Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\YDropperUK.dll
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/…ropper1_6uk.cab

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

————————————————–
End of report, 5,535 bytes
Report generated in 0.031 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Post #5
Hi dough

Here is the link to the pcpitstop report.
http://www.pcpitstop.com/TechExpress.asp?id=MYDWPWPYQWJSSNBC

I have 'check for newer versions of stored pages' disabled in i.e. but I do wonder if the delay after boot isn't due to one of the installed programs waiting for the internet connection to be fully up and running and then holding things up while doing some kind of update/search. As I've said I'll try booting up next time with zonealarm update disabled and see if thats it.

I know I need to free up some disc space by back up and defragmenting and I've upped the ie cache to 10mb, but would be interested if pcpitstop suggests anything else.

Regards
Stillwill
Post #6
Hi stillwill,(sorry to intrude Dough), I believe pcpitstop scan is a great diagnostic tool and maybe you could pm link for Dough to look through… (sorry if thats a bad idea Dough) Regards pacman123
Post #7 last edited
Hi stillwill, click on the items in Blue and follow recommendations, i have my ie cache set to 80mb with no problems…….

I see you have 3 versions of Java these are taking a lot of space and are out of date you can uninstall these reboot and update to Java Runtime Environment Version 5.0 Update 8 here………

http://www.java.com/en/download/index.jsp






Regards pacman123
Post #8
Hi packman123 Thanks for the advice…I'll uninstall all three javas and save some space by starting again with the latest version. pcpitstop also suggests that the performance of my nvidio video card is quite poor. The nvidio site has a much newer driver available but suggests that the old driver should be uninstalled before downloading. Will my display remain ok through this?? Does the videocard only kick in for actual video or is it involved in creating all displays on the monitor? regards stillwill
Post #9
I have a bit more information from todays boot up. Disabling the zone alarm update has made no difference. However today, as the program icons in the tray had settled, I was able to open task manager before the problem started. I then watched as one of the system svchost.exe processes took 99% of the cpu for two and a half minutes (as usual) and then stopped. At this point I didn't try to open any other programs and soon it started again at 99% and was ongoing for a further couple of minutes until I did open a program, which immediately stopped it. (the problem is that opening a program during the first two and a half mins doesn't stop it….rather it delays the program opening until that time has lapsed). I'm coming to terms with two and a half minutes being bearable if I'm confident it will always be just that, although obviously I'd prefer to know what's going on and sort it if poss. Dough, I wonder if that indicates anything in particular or suggests the next investigation?? Regards Stillwill.
Post #10
:wavey:

You can fix these with HijackThis!:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Reboot and see if things are faster when you boot-up.
:)
Post #11
hi micah 6;8 thanks for the reply. unfortunately both the realplayer update and quick time update re-appear very soon after fixing them with hjt. However your reply has prompted me to look at the preferences for both these players and I've just found settings for both that will turn off automatic updates. I'll do the hjt fix again now that I've changed the preferences and hopefully they won't re-appear yet again. (and maybe they are also the cause of the delay problem too??) regards stillwill
Post #12 last edited
Stillwill, Go to Start - Run - (type) MSCONFIG - Select the StartUp (tab) Remove the checkmark from in front of each of those items. Note: Please note that if you run either QuickTime or RealPlayer, the simple act of running them will prompt that they be placed active again in your StartUp file. You can remedie the situation temporarily, each time you run either application, by unchecking in MSCONFIG StartUp menu. Since I don't like or use either application (with the exception of a rare use of Quicktime) I always thoroughly uninstall both applications from machines that I have to rely upon. You may use either/both utilities more often. Therefore, use the "per incident" repair change of unchecking the item in StartUp. I have other recommendations for you subsequent to your Full Test, but have not had time to post. I apologize. Please be patient. Best Regards
Post #13
Hi Stillwill,

You may already have taken many of these steps, but I'll include them to make sure.
Please forgive my tardiness in responding to you.
Since the problem is specific to the time during and immediately after Boot, I am giving attention to applications and processes that begin running active directly during the StartUp sequence. I am also limiting my recommendations to adjustments that can be made entirely in the windows environment.

First step in dealing with this boot problem: please disable the following items in your StartUp File.
(Disabling applications in StartUp leaves them available to you to run manually, if/when you want them.)
Start - Run - (type)msconfig - Select StartUp (tab)
StartUp list
TotalRecorderScheduler = C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
!ewido = "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" –atboottime
C:\WINDOWS\System32\drivers\CDAC11BA.EXE C-Dilla copy protection
C:\windows\system32\ssoftsrv.exe - cryptainer

I realize that you may have uninstalled JAVA and installed the newest version, per pacman123 instructions.
Please know that installing the newest version, will have inserted the “jushed.exe” update manager back into your StartUp File. Disable it again. JAVA updates 2 or 3 time annually, and you can do so manually.

I realize that you may have disabled either ewido updater and ewido as a background utility. However, each time you run ewido it may be placed back in your StartUp File. It’s a great protective utility, but manually remove it from loading at boot, via MSCONFIG after each use.

C-Dilla copy protection is thought by some to be “legitimate”. Others describe C-dilla as spyware, me amongst them. Even Spybot S&D now allows C-Dilla as an “optional ignore”. C-dilla is found on many computers, because of the popularity of Turbo Tax and QuickBooks, both of which use C-dilla as a “backdoor updater”. C-dilla may have come to you bundled with another software which you wanted, therefore one or more program that you’ve installed may stop functioning the way you have come to expect it. Solution: Reinstall the application, but know that C-dilla as a backdoor updater will come with it again.

Try to regain as much Hard Disk (free space) as possible by uninstalling applications that you never use, and by saving large data/media files to CD or DVD. The “minimum” recommended (free space for a machine’s hard drive is 25%) If you are often running photo image editing or processing video files, your machine will likely run much better with 50-55% Free Space.

Consider regaining a chunk of your Hard Drive space by reducing the amount of Hard Drive that System Restore claims. Use the System Restore settings “slider” to reduce the reserved space from 12%, down to 3%. (3% is plenty for any machine with a large Hard Drive like your machine, any more is just wasted space)

Defrag in SAFE Mode. Defrag has difficulty defragging areas of the Hard Drive that are currently active due to an application running. In SAFE Mode, only minimal routines and utilities are available, making it easier to Defrag.

Regarding nVidia. Your system has a “minimal set of Video Display” drivers (the same Video Display that is used during SAFE Mode) which will continue to be available to you as you use the nVidia “uninstall tool” from their Website. It is important to use that tool to completely uninstall the old nVidia drivers before installing the updated ones.

Adjust your IE cache size to 80mb.

If disabling the items above hasn’t given you a smooth and prompt boot time, consider disabling Windows auto-updater (C:\WINDOWS\System32\wuauclt.exe) to see if that utility is slowing you down. You’ll get a “warning” that you machine may not be safe, due to shutting off Windows auto-updater, but that is only precautionary of Windows. You can manually check for Windows updates any time you want to but you’ll have to re-enable the auto-updater each time.

Download and Run System Information for Windows, get it here: http://www.gtopala.com/siw_download.html
click the + beside hardware & then click Memory.
Copy and paste the information from that report into your next reply.
Here’s an example of what it will look like (different values for your machine though)
Property Value
Memory Summary
Capacity 1024 MBytes
Location System board or motherboard
Maximum Capacity 2048 MBytes
Memory Slots 2
Error Correction None
Error Correction Capabilities None
Name Physical Memory Array
Use System memory
Maximum Memory Module Size 1024 MBytes


Please keep us posted with your progress.

Best Regards
Post #14 last edited
Hi Dough

I've done most of the adjustments suggested but before I go into detail I must just say that the problem is fixed!!! Thanks

I've freed up a lot of disc space and defragged. I've uninstalled ewido (I've always had adaware installed anyway) and just used msconfig to turn off some startup items (java, realplayer and totalrec scheduler) and now have only avg, zlabs and adobe enabled under the startup tab. Quicktime was removed a few posts ago and hasn't reappeared but Nvcpl daemon, cdilla and cryptainer don't appear under that tab using msconfig. Maybe I should fix them using hijack this?? Anyway the problem seems to have gone away only after this last action….ie disabling three items under msconfig startup.

As I've fixed the Realsched with hjt before it seems to imply that either the java update or total recorder scheduler was the cause although they've both been around for a long time??? I guess I could try re-ticking them one at a time to see if the boot delay problem re-occurs.

Ooops …..I'd completely forgotten!!! I've disabled windows auto updates……thats more likely to be the culptrit. I think it might be time I installed sp2. I'd refrained cos I wanted to carry on using zonealarm. Maybe I can intall sp2 and disable the new firewall to avoid conflicts?? Once thats done the auto updates might work more smoothly??


Anyway many thanks. Here's the memory log.

Property Value
Memory Summary
Capacity 512 MBytes
Location System board or motherboard
Maximum Capacity 768 MBytes
Memory Slots 3
Error Correction None
Error Correction Capabilities None
Name Physical Memory Array
Use System memory
Maximum Memory Module Size 32 MBytes


Device Locator Slot 1
Part Number 32MX64U-33B
Serial Number 03050625
Capacity 256 MBytes
Memory Type SDRAM DDR
Speed PC2700 (166 MHz)
Data Width 64 bits
Voltage SSTL 2.5V
Error Correction None
Refresh Reduced (.5x)…7.8 µs
Manufacturing Date N/A
EPP SPD Support No


Device Locator Slot 2
Part Number 32MX64U-33B
Serial Number 03050625
Capacity 256 MBytes
Memory Type SDRAM DDR
Speed PC2700 (166 MHz)
Data Width 64 bits
Voltage SSTL 2.5V
Error Correction None
Refresh Reduced (.5x)…7.8 µs
Manufacturing Date N/A
EPP SPD Support No

Warning! Accuracy of DMI data cannot be guaranteed
Post #15 last edited
Good work Stillwill, Glad you got the problem sorted! As to – Nvcpl daemon, cdilla and cryptainer, please hold off on any action at this time. as to Adobe – to the best of my knowledge it is not needed in StartUp and the Adobe utility will be started by your browser if you access a .pdf (portable document file) which is the document type that Adobe has grown famous for. (just a note for your future consideration, but not to act on at this time, and at least until you have good functioning for a few days/weeks to assure that everything is working as you prefer. The suggestion: There is an alternate to Adobe reader called "Foxit" which has a much smaller "footprint" in your machine but still provides full .pdf reading/printing ability without having the huge burden that Adobe places on the machine.) Will you please Run a fresh PCPitstop Full Test and Post the TechExpress? I am still puzzled about the Maximum Memory Module Size 32 MBytes Which is "counter-intuitive" to the fact that you are able to run two sticks of 256mb each. I've inquired with some experts about this and will follow up. In the meantime……. Happy Computing. Keep us posted if other symptoms or problems crop up. I will post back into this thread after reviewing your Pit Test, and when I receive further information about the 32mb module size puzzle. Best Regards Edit: Yes, I support the plan of installing SP2. SP2 has a utility called Security Center, where you can turn-off the XP firewall and allow your ZoneAlarm to do its work.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI