What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow Start Up iwinapp.exe

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My system is taking too long to start up. I seem to have an application called iwinapp which is trying to access the internet, but my Bitdefender firewall is stopping it. However, I think it is this that is slowing things down. Any help would be much appreciated.

Here's my log file:

Logfile of HijackThis v1.99.1
Scan saved at 13:37:14, on 30/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\cFosSpeed\spd.exe
C:\WINDOWS\system32\iwinapp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\edward mckinney\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IWin service - Unknown owner - C:\WINDOWS\system32\iwinapp.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #2
Welcome to the forum

That's malware - lets see if this gets it……

Clean out temp files:

Download and run ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then click "empty selected" That will clear out all the temp files on the system.

—————-

Next:

Please download SUPERAntiSpyware Home Edition (free)

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click "Yes",
Let it through your firewall!
Under "Configuration and Preferences", click the "Preferences" button.
Click the "Scanning Control" tab.
Under "Scanner Options" make sure the following are checked:
1>> Close browsers before scanning
2>> Scan for tracking cookies
3>> Terminate memory threats before quarantining.
4>> Ignore System Restore/Volume Information on ME and XP
5>> Please leave the others unchecked.
6>> Click the Close button to leave the control center screen.

On the main screen, under "Scan for Harmful Software" click "Scan your
computer".
On the left check "C:\Fixed Drive".
On the right, under "Complete Scan", choose "Perform Complete Scan".
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click "OK".
Make sure everything in the white box has a check next to it, then click "Next".
It will quarantine what it found and if it asks if you want to reboot, click
"Yes".

To retrieve the removal information - please do the following:
1>> After reboot, double-click the "SUPERAntispyware icon" on your desktop.
2>> Click "Preferences". Click the "Statistics/Logs tab".
3>> Under "Scanner Logs", double-click "SUPERAntiSpyware Scan Log".
4>> It will open in your default text editor (such as Notepad/Wordpad).
5>> Please highlight everything , then right-click and choose copy.
6>> Click close and close again to exit the program.

Now please paste the "removal information" along with a fresh "HijackThis log" in your reply. If it's a large log, you may need several replies to post it.
Good Luck, MrC
Post #3
Thanks Charlie

Here's the SAS log…
followed by the Hijack This Scan:

SUPERAntiSpyware Scan Log
Generated 01/02/2007 at 11:19 PM

Application Version : 3.4.1000

Core Rules Database Version : 3158
Trace Rules Database Version: 1171

Scan type : Complete Scan
Total Scan Time : 02:49:04

Memory items scanned : 475
Memory threats detected : 1
Registry items scanned : 6589
Registry threats detected : 3
File items scanned : 68085
File threats detected : 70

Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\IWINAPP.EXE
C:\WINDOWS\SYSTEM32\IWINAPP.EXE
HKLM\System\ControlSet001\Services\IWin service
HKLM\System\ControlSet003\Services\IWin service
HKLM\System\CurrentControlSet\Services\IWin service

Adware.Tracking Cookie
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@adrevolver[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@clicktorrent[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@edge.ru4[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@tribalfusion[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@overture[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@advertising[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@112.2o7[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@list[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@statcounter[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@cneteurope.122.2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@manairport[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@zedo[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@mediaplex[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@manairport[2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@msnportal.112.2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@adbrite[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@interclick[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@sexintheuk[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@tradedoubler[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@questionmarket[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@sextracker[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@doubleclick[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@xxxcounter[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@1071432424[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@marksandspencer.122.2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@revsci[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@122.2o7[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@roiservice[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@indextools[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@qksrv[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@cgi-bin[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@hitbox[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@63496319[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@28781733[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@atdmt[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@xiti[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@dealtime[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@fastclick[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@apmebf[2].txt
SUPERAntiSpyware Scan Log
Generated 01/02/2007 at 11:19 PM

Application Version : 3.4.1000

Core Rules Database Version : 3158
Trace Rules Database Version: 1171

Scan type : Complete Scan
Total Scan Time : 02:49:04

Memory items scanned : 475
Memory threats detected : 1
Registry items scanned : 6589
Registry threats detected : 3
File items scanned : 68085
File threats detected : 70

Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\IWINAPP.EXE
C:\WINDOWS\SYSTEM32\IWINAPP.EXE
HKLM\System\ControlSet001\Services\IWin service
HKLM\System\ControlSet003\Services\IWin service
HKLM\System\CurrentControlSet\Services\IWin service

Adware.Tracking Cookie
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@adrevolver[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@clicktorrent[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@edge.ru4[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@tribalfusion[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@overture[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@advertising[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@112.2o7[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@list[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@statcounter[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@cneteurope.122.2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@manairport[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@zedo[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@mediaplex[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@manairport[2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@msnportal.112.2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@adbrite[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@interclick[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@sexintheuk[1].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@tradedoubler[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@questionmarket[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@sextracker[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@doubleclick[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@xxxcounter[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@1071432424[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@marksandspencer.122.2o7[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@revsci[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@122.2o7[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@roiservice[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@indextools[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@qksrv[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@cgi-bin[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\[removed][2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@hitbox[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward [removed][1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@63496319[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@28781733[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@atdmt[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@xiti[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward mckinney@dealtime[1].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@fastclick[2].txt
C:\Documents and Settings\edward mckinney\Cookies\edward_mckinney@apmebf[2].txt



Logfile of HijackThis v1.99.1
Scan saved at 23:57:40, on 02/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\edward mckinney\Desktop\HijackThis.exe
C:\Program Files\uTorrent\utorrent.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #4 last edited
Looks like we got it :thumbup:

Please find this file and upload it
HERE for a free scan - let me know the results. Do you recognize it - right click on it and choose properties - see what it belongs to if possible.

C:\WINDOWS\system32\drivers\Icon.exe

————————–

These services from BitDefender and cFosSpeed show "file missing".
This may or may not be true.
Do you still have and use these two programs?

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)

O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)

O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)

O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Let me know, MrC
Post #5
Thanks MrC Icon.exe got through the scan no problem, properties doesn't show what is is. Its description is "Icon Application For Wireless", and the Icon appears in my notification area and is described as "Wireless LAN Connection Indicator". I'm not sure what it does or if I need it. I do still use bitdefender and cFosSpeed, but I didn't know files were missing - maybe this is what's slowing bitdefender down? Do I need to re-install? Thanks for a cool service. Steve
Post #6
OK, good news about Icon.exe - I didn't think it was malware but it does have a name like some know malware - just wanted to make sure!

—————————

I do still use bitdefender and cFosSpeed, but I didn't know files were missing - maybe this is what's slowing bitdefender down? Do I need to re-install?

No you're OK, I went back and carefully looked at your log and found that the files are indeed there - so those are OK!

—————–

Open up SuperAntiSpyware > Preferences > General and Start-up > Start-up Options > Uncheck > Start SAS when Windows Starts.
"SAS free" provides no real time protection so there's no need for it to be running, I suggest you keep the program and update regularly - you can use it to scan for malware. It's an excellent program. When you want to start it - just double click on the SAS icon.

——————–

You're "Good To Go" :thumbup:

If you have any questions - please post back

I'll leave you with……..

Some preventive maintenance:

——————Must have or do:—————–

Now that you're clean: <—-Important Step!!!!
Delete your system restore files and create a new restore point:
(ME and XP users only)

XP system restore

ME system restore

Visit Windows Update and install all the lastest critical updates.

Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked.

SpywareBlaster Check for updates weekly.

SpywareGuard

IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
or try the new ZonedOut

Blocking Unwanted Parasites with a Hosts File
Direct Download - MVPS HOSTS <==> MVPS HOSTS Tutorial

Need a free anti virus?
AVG*free
Avast free
AntiVir® PersonalEdition Classic
–>Check for updates - daily<—

How about a firewall? The front door to your computer.
ZoneAlarm*free

Other free firewalls

Keep those temp files off your system use
CCleaner
Uncheck "Cookies" under "Internet Explorer".
or
ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then "empty selected" That will clear out all the temp files on the system.


IMPORTANT!!
Keep your Sun Java up-to-date JRE 6 <–newest version
Download page JRE 6
Java Tutorial
Delete ALL old versions from add/remove programs if listed first!

Keep the registry backed up - use ERUNT
Print this out and save it
ERUNT Tutorial

———-Free malware removal programs:———-

SpyBot
AD-Aware
CW-Shredder
SUPERAntiSpyware (free edition)

AVG Anti-Spyware<—VERY GOOD! (XP and 2K only)

Please consider using FireFox instead of Internet Explorer. A more secure browser! Easy to make the change!
FireFox Tutorial


Pop-up stoppers:
GoogleToolBar
Pop-upStopperFree

Disable Windows MessengerXP - 2K (stops pop-up ads -etc):
Disabling Messenger Service in Windows XP
How to Remove Windows Messenger on Windows XP
How to Remove Windows Messenger on Windows XP
Shoot The Messenger

Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.

Good luck and thanks for using the forum - MrC
Post #7
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI