What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slowdown, Virtual Memory Loss, and Explorer not loading

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hey all, looking for some help. For the past few weeks, my computer has been telling me that theres a lack of virtual memory… now I can understand this when I'm running Magic the Gathering Online, which has a memory leak, despite what the company says, however if I walk away from the computer without any applications up, and come back an hour later, I'll get the notice that Windows is allocating more space, and my computer will run significantly slower. Also, if I restart, which often returns the computer to normal speed, I'll log in, and explorer won't load. I've checked the task manager, and the process is there, but even if I end it, then run "explorer" none of my desktop will show up. There was also a notice at one time when I restarted that windows couldn't find a drive, but I know little-nothing about hardware, and just continuing with the load seemed to have no ill effects. Any advice/help will be greatly appreciated.

Thanks much,
Squeaks

And the log:

Logfile of HijackThis v1.99.1
Scan saved at 7:00:03 PM, on 1/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Documents and Settings\Spencer\My Documents\Games\Security Suite\ewidoctrl.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Linksys\Wireless-B USB Network Adapter\NICServ.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\DOCUME~1\spencer\MYDOCU~1\games\WINPAT~1\winpatrol.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
C:\Program Files\Linksys\Wireless-B USB Network Adapter\WUSB11Cfg.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Spencer\My Documents\Games\Firefox\firefox.exe
C:\Documents and Settings\Spencer\My Documents\Games\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [WinPatrol] c:\DOCUME~1\spencer\MYDOCU~1\games\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [EVEMon] C:\Program Files\EVEMon\EVEMon.exe -startMinimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
O4 - Global Startup: Wireless-B USB Network Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B USB Network Adapter\WUSB11Cfg.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - http://guard.gunbound.net/nProtect/keyCrypt/npkcx.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Spencer\My Documents\Games\Security Suite\ewidoctrl.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WUSB11 - Unknown owner - C:\Program Files\Linksys\Wireless-B USB Network Adapter\NICServ.exe
O23 - Service: NNSvc - Unknown owner - C:\Program Files\Net Nanny\nnsvc.exe (file missing)
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2 last edited
Squeaks :D

Welcome to Tom Coyote . Sorry about the delay in responding but we are as most times just overwhelmed with logs.

This may be a windows or a software problem, what we can do is clean you up a bit, run a few programs to make sure its not a virus or malware , and if nothing come up I can recommend some windows support sites that deal with this sort of thing. I an not looking at anything real bad on your HJT log, but I am trying to figure out why you installed some programs in the games folder instead of Program Files, whatever works for you .


Lets run this cleaner.

Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up

How much memory do you have installed on this system? You can right click on My Computer and go to Properties and it will tell you.

You might want to try uninstalling that offending program that has the memory leak and see if your problem goes away.


Go to Start> All Programs> Assessories > System Tools> Disk Defragmenter. This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.


Do you have enough hard disk space for your Paging file?? Click on My Computer and right click on your C: drive and go to Properties and let me know how much free space you have.

If you have enough free space, we can try expanding your Paging File.
Go to Start> Control Panel ( Change to Classic View ) System> Advanced> Performance>Settings> Advanced> Virtual Memory> Change and set the Min at 768 and the Max at 1500


You have Ewido installed, Ewido has been bought by AVG and is now new and updated, so what I need you to do is go to your Add-Remove Programs in the Control Panel and uninstall Ewido.


Download and install the 30 day trial of AVG Anti-Spyware 7.5 to your desktop.
  • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG Anti-Spyware 7.5
Post the AVG report, its important that I see it and post a new HJT log please.
Post #3
Hey Ken, I've no problem waiting, since, hey, you guys are helping me for free.

I followed all your advice, I've got about 11 gig free on my drive right now, and my virtual memory was already allocated 768-2536, so it seems large enough.

Also, just so you know, after I restarted from the scan, windows gave me the blue screen saying it was inspecting my file system on c:/ and that the volume is dirty, a message I've seen before, but never undstood much of besides the fact Windows is fixing something.

Scan log: (I think its lying, it quarnting downloader.istbar.ja and downloader.inservice.ja, and deleted two trackers)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

A V G A n t i - S p y w a r e - S c a n R e p o r t

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



+ C r e a t e d a t : 5 : 4 4 : 5 8 P M 1 / 1 7 / 2 0 0 7



+ S c a n r e s u l t :







C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ M y D o c u m e n t s \ G a m e s \ E x i l e I I I \ c r a c k _ 1 1 0 2 2 0 8 6 8 1 8 4 3 8 4 \ E x i l e I I I R u i n e d W o r l d v 1 . 0 \ I n s t a l l _ 8 9 4 1 . e x e - > D o w n l o a d e r . I N S e r v i c e . j a : N o a c t i o n t a k e n .

C : \ d a t a - > D o w n l o a d e r . I s t B a r . j a : N o a c t i o n t a k e n .

: m o z i l l a . 2 4 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s - 1 . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 5 1 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s n e w . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 5 2 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s n e w . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 5 3 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s n e w . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 5 5 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 5 6 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 5 7 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . A d b r i t e : N o a c t i o n t a k e n .

: m o z i l l a . 1 0 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 1 3 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s - 1 . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 1 4 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s - 1 . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 1 5 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s - 1 . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 1 6 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s - 1 . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 7 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 8 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .

: m o z i l l a . 9 : C : \ D o c u m e n t s a n d S e t t i n g s \ S p e n c e r \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ c e 1 h k k 4 s . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . H i t b o x : N o a c t i o n t a k e n .





: : R e p o r t e n d

Hijack this:Logfile of HijackThis v1.99.1
Scan saved at 6:02:08 PM, on 1/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Linksys\Wireless-B USB Network Adapter\NICServ.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\DOCUME~1\spencer\MYDOCU~1\games\WINPAT~1\winpatrol.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
C:\Program Files\Linksys\Wireless-B USB Network Adapter\WUSB11Cfg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Spencer\My Documents\Games\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [WinPatrol] c:\DOCUME~1\spencer\MYDOCU~1\games\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [EVEMon] C:\Program Files\EVEMon\EVEMon.exe -startMinimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
O4 - Global Startup: Wireless-B USB Network Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B USB Network Adapter\WUSB11Cfg.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - http://guard.gunbound.net/nProtect/keyCrypt/npkcx.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WUSB11 - Unknown owner - C:\Program Files\Linksys\Wireless-B USB Network Adapter\NICServ.exe
O23 - Service: NNSvc - Unknown owner - C:\Program Files\Net Nanny\nnsvc.exe (file missing)
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Any more advice would be wonderful, even if its directing me somewhere else.

Thanks so much,
Squeaks
Post #4
Squeaks,

You did not follow my instructions for AVG, I needed you to have it set to either Quarantine or Delete and you had it set for Take No Action. I would suggest running it again and this time have it Delete it all.


Open HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

You can remove this with HJT unless its something you know about and use.
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - http://guard.gunbound.net/nProtect/keyCrypt/npkcx.cab




AVG showed signs of a 1st Bar infection, dont know if you have the full blown infection or not. You can download the free tool from Symantec to your desktop and run it. If 1st Bar is present it will remove it.

FxIstbar

Then do this
* Start Internet Explorer.
* Click Tools > Internet Options.
* In the Temporary Internet Files section, then click the Delete Files button.
* Check Delete all offline content, and then click OK.


Then
* Click Start > Settings > Control Panel
* Select Internet Options
* Select the Programs tab
* Click Reset Web Settings
* Click OK
* Exit Control Panel



Run this cleaner

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main - choose: Select All
Click the Empty Selected button.




Have you run the CHKDISK utility, this sometimes fixes loads of disk problems. Depending on your system, this could take and hour or two, if will fix and corrupted clusters on your hard disk, if you have a lot of bad clusters, it could make your system unstable and this will fix it.

Turn off your screensaver
Right click on the WinPatrol icon in your system tray and disable.

Click on My Computer and right click on your C:\ Drive and go to Properties > Tools > Error Checking > Check Now > Tick both boxes and go to start, it may prompt you to reboot to start the scan.


Let me know if this helped, if not I can direct you to some windows support sites.
Post #5
Hey again, The first time I ran AVG it did indeed quarantine the istbars, and deleted some trackers it found, and I was confused as to why it didn't show in the log, but I am running through the istbar removal just to make sure. I'm sorry, I had forgotten to mention I ran ATF Cleaner in the last post, and I attempted to run chkdisk today, and it had run itself the time I rebooted after AVG scanning, so it didn't find anything. Seems like this isn't malware then, so any places you could reccomend me to go would be great, I really do appreciate the help Thanks again, Squeaks
Post #6
OK Squeeks, here ya go.

Windows Tech Support Forums
IE Freezes Speedup Windows Windows Tips



How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • Tom Coyote
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • Geeks To Go
  • Dslreports



Here are some free programs to install, don't leave home without them
  • Spybot Search and Destroy 1.4
    Check for Updates/ Immunize and run a Full System Scan on a regular basis.
  • Ad-Aware SE Personal 1.06
    Check for Updates and run a Full System Scan on a regular basis.
  • Spyware Blaster It will prevent most spyware from ever being installed.
  • Spyware Guard It offers realtime protection from spyware installation attempts.
  • Win Patrol This program will warn you when any changes are being made to your system and give you the option to deny the change.
  • IE-Spyad
    IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 2.0 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
  • Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.
Thanks for stopping by Tom Coyote , I'm glad I was able to help you. :D
Post #7
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI