What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer Is Generally Sluggish And Cranky

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am using windows 2000 . I have a 1.7 Ghzt processor on an MSI board. My machine does strange things. When I first start up it takes my browser two or minutes to open. When I get online some pages are very slow to load. Often when I check my task manager there is something running called "scanning Process" The task manager will not close it and says access denied. I have 512 MEGS of RAM. When online if a page or email has lots of graphics the page is slow to open and sometimes the browser crashes. I try to run Sypbot and Adaware on a regular basis and my zone Lab suite scans once a week. I am posting my Hijackthis log to see if there is anything I cna do to improve performance some.

Logfile of HijackThis v1.99.1
Scan saved at 7:18:57 PM, on 7/10/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\VTTimer.exe
C:\WINNT\system32\VTtrayp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\TimeLeft3\TimeLeft.exe
C:\WINNT\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINNT\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Documents and Settings\Edward Edwards\Desktop\Utilities\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE…lKX/eE/D7ENHbeS
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: TimeLeft.lnk = C:\Program Files\TimeLeft3\TimeLeft.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161452017703
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B24FBB73-7173-4C4B-8FD7-ADBD6D090552}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LXCFCustomerConnect - Unknown owner - C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXCFserv.exe
O23 - Service: lxcf_device - Unknown owner - C:\WINNT\system32\lxcfcoms.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #2
Howdy emt3920,


A much belated welcome to Tom Coyote. The log shows at least a Starware search hijacking there, so likely more not yet seen. Let's start repairs on this now.


Download : HostsXpert, and have it ready for use.

Run HostsXpert. Press the Restore MS Hosts File button and then press the OK button.

—————————————

Next you need to move HijackThis to a permanent location, so backups will be saved. Just create/select a permanent folder (not temp or desktop) and move the HijackThis.exe file there to click/run from that location.


Once you have done that close Internet Explorer and all running programs and run a scan in HijackThis. Place a check next to all of the following lines, then select “Fix Checked” and close HijackThis.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE…lKX/eE/D7ENHbeS
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

————————————————


Then Download ComboFix.exe from here to your desktop, and click the downloaded file to run the repair.

When the command window opens, select 1 (and Enter). Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

————————————————–


Go here and download the free version of SUPERAntiSpyware and install it.

After installation accept any prompts to allow SUPERAntiSpyware to install the latest infection definition files. Next follow the prompts to complete the installation. For now, uncheck the option to have SUPERAntiSpyware "Automatically check for program and definition updates". Providing an email address and allowing the software to send diagnostic reports to it's research center are up to you. Do NOT allow SUPERAntiSpyware to Protect your Home Page settings.

Once the installation is complete open SUPERAntiSpyware and press the Preferences button. Under the General and Startup tab, uncheck the following (leaving all other settings as is).

Start-up Options:
*Start SUPERAntiSpyware when Windows starts

Automatic Updates:
*Check for program updates when the application starts.

Start-up Scanning:
*Check for updates before scanning on startup.

Then select Close. Don't scan just yet though.


——————————-

Go Here and download ATF cleaner. Click on the downloaded file to run it, and select "Select All", then click Empty Selected (and close ATF).

If you have them, also click on Firefox/Opera at the top and repeat the steps (and close ATF). Firefox/Opera will need to be closed first for the cleaning to be effective.

===============================================

Reboot into Safe Mode (at startup tap the F8 key and select Safe Mode).


Open SUPERAntiSpyware and click the Scan your Computer button. Making sure that Fixed Drive (NTFS) is checked (typically the C Drive), check "Perform Complete Scan", then click Next. SUPERAntiSpyware will now complete a system scan.


SUPERAntiSpyware will now scan your computer and when its finished it will list all the infections it has found. Make sure that they all have a check next to them and click next. If prompted allow the reboot (or manually reboot at this time), and after the reboot open SUPERAntiSpyware again (double click the bug-shaped Taskbar icon).

Click Preferences, then under the Statistics/Logs tab, click to select the most recent Scan Log, then click View Log. Save the log to your desktop, and copy/paste the text from the log back here.

And post back that log along with a new HijackThis and the combofix.txt log please.
Post #3
These are the logs I was told to post after running the apps:
"Edward Edwards" - 07/14/2007 10:32:57 - ComboFix 07-07-14.6 - Service Pack 4 NTFS


((((((((((((((((((((((((( Files Created from 2007-06-14 to 2007-07-14 )))))))))))))))))))))))))))))))


2007-07-14 09:16 d——– C:\Program Files\SUPERAntiSpyware
2007-07-14 09:16 d——– C:\DOCUME~1\EDWARD~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-14 09:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-14 09:14 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 09:02 51,200 –a—— C:\WINNT\nircmd.exe
2007-07-10 06:23 d——– C:\Program Files\The KMPlayer
2007-07-03 15:12 d——– C:\Program Files\RegistryFix
2007-07-03 13:51 d——– C:\DOCUME~1\EDWARD~1\APPLIC~1\DAEMON Tools Pro
2007-07-03 13:34 d——– C:\Program Files\DAEMON Tools Pro
2007-06-30 03:51 d——– C:\Program Files\Real
2007-06-30 03:51 d——– C:\Program Files\Common Files\xing shared
2007-06-30 03:51 d——– C:\Program Files\Common Files\Real
2007-06-22 01:08 d——– C:\WINNT\winsxs
2007-06-22 00:46 d——– C:\Program Files\AusLogics Disk Defrag
2007-06-22 00:35 d——– C:\DOCUME~1\EDWARD~1\APPLIC~1\Smart PC Solutions
2007-06-22 00:34 d——– C:\Program Files\Smart PC Solutions
2007-06-19 21:28 d——– C:\WINNT\system32\SoftwareDistribution
2007-06-16 03:02 d——– C:\Program Files\Amadis Software
2007-06-14 03:24 d——– C:\Program Files\Alcohol Soft
2007-06-14 03:21 685,816 –a—— C:\WINNT\system32\drivers\sptd.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-14 15:36:21 12,685,600 –sha-w C:\WINNT\system32\drivers\fidbox.dat
2007-07-14 15:32:03 1,007,904 –sha-w C:\WINNT\system32\drivers\fidbox2.dat
2007-07-14 15:18:01 4,212 —h–w C:\WINNT\system32\zllictbl.dat
2007-07-14 14:25:19 95,516 –sha-w C:\WINNT\system32\drivers\fidbox2.idx
2007-07-14 14:25:19 170,804 –sha-w C:\WINNT\system32\drivers\fidbox.idx
2007-07-14 13:33:09 ——– d—–w C:\Program Files\Lx_cats
2007-07-14 13:16:46 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\Free Download Manager
2007-07-13 05:19:20 ——– d—–w C:\Program Files\Mozilla Thunderbird
2007-07-09 04:46:01 512 —-a-w C:\ScanSectorLog.dat
2007-07-08 05:57:45 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\DVD Flick
2007-07-06 04:53:06 ——– d—–w C:\Program Files\Winamp
2007-07-01 08:27:50 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\foobar2000
2007-06-30 08:52:56 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\Real
2007-06-23 09:37:31 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\OpenOffice.org2
2007-06-22 10:13:15 ——– d—–w C:\Program Files\Opera
2007-06-14 07:16:24 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\dvdcss
2007-06-08 08:14:43 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\RipIt4Me
2007-05-24 05:48:15 ——– d—–w C:\Program Files\Foxit Software
2007-05-21 17:23:47 ——– d—–w C:\DOCUME~1\EDWARD~1\APPLIC~1\Paltalk
2007-05-19 10:30:43 ——– d—–w C:\Program Files\Paltalk Messenger
2007-04-25 07:52:16 147,216 —-a-w C:\WINNT\system32\SCHANNEL.DLL
2007-04-23 06:22:01 939,280 —-a-w C:\WINNT\system32\ntdsa.dll
2007-04-19 05:06:31 6,239,232 —-a-w C:\WINNT\system32\sp3res.dll
2007-04-17 03:47:36 33,624 —-a-w C:\WINNT\system32\wups.dll
2007-04-17 03:45:54 1,710,936 —-a-w C:\WINNT\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 —-a-w C:\WINNT\system32\wuapi.dll
2007-04-17 03:45:42 325,976 —-a-w C:\WINNT\system32\wucltui.dll
2007-04-17 03:45:36 203,096 —-a-w C:\WINNT\system32\wuweb.dll
2007-04-17 03:45:28 92,504 —-a-w C:\WINNT\system32\cdm.dll
2007-04-17 03:45:20 53,080 —-a-w C:\WINNT\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 —-a-w C:\WINNT\system32\wups2.dll
2007-04-17 03:44:20 271,224 —-a-w C:\WINNT\system32\mucltui.dll
2007-04-17 03:44:18 208,248 —-a-w C:\WINNT\system32\muweb.dll
2007-04-16 12:44:08 54,032 —-a-w C:\WINNT\system32\mpr.dll
2007-03-10 16:38:17 81,920 —-a-w C:\DOCUME~1\EDWARD~1\APPLIC~1\ezpinst.exe
2007-03-10 16:38:17 47,360 —-a-w C:\DOCUME~1\EDWARD~1\APPLIC~1\pcouffin.sys
2006-10-20 10:49:22 271 —h–w C:\Program Files\desktop.ini
2006-10-20 10:49:22 21,952 —h–w C:\Program Files\folder.htt
2005-05-13 23:12:00 217,073 –sha-r C:\WINNT\meta4.exe
2005-10-24 17:13:58 66,560 –sha-r C:\WINNT\MOTA113.exe
2005-07-14 18:31:20 27,648 –sha-r C:\WINNT\system32\AVSredirect.dll
2005-06-26 21:32:28 616,448 –sha-r C:\WINNT\system32\cygwin1.dll
2005-06-22 04:37:42 45,568 –sha-r C:\WINNT\system32\cygz.dll
2006-11-02 10:46:11 56 –sh–r C:\WINNT\system32\E09CD39D4C.sys
2006-05-03 10:06:54 163,328 –sh–r C:\WINNT\system32\flvDX.dll
2004-01-25 06:00:00 70,656 –sha-r C:\WINNT\system32\i420vfw.dll
2006-11-02 10:46:11 1,682 –sha-w C:\WINNT\system32\KGyGaAvL.sys
2005-02-28 19:16:22 240,128 –sha-r C:\WINNT\system32\x.264.exe
2004-01-25 06:00:00 70,656 –sha-r C:\WINNT\system32\yv12vfw.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
05/30/07 04:18p 808472 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
10/22/06 11:08p 62080 –a—— C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
05/31/05 01:04a 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
10/31/06 04:29p 198136 –a—— C:\Program Files\Yahoo!\Common\yiesrvc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
03/14/07 03:43a 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
08/20/06 07:55p 81920 –a—— C:\Program Files\Free Download Manager\iefdmcks.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [06/19/03 12:05p C:\WINNT\system32\mobsync.exe]
"VTTimer"="VTTimer.exe" [03/07/05 02:33p C:\WINNT\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [10/31/05 03:15p C:\WINNT\system32\VTTrayp.exe]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/07 12:02a]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/07 12:02a]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [03/14/07 03:43a]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [09/07/06 12:19p]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [12/20/06 01:55p]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll –a—— 04/19/07 01:41p 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=secuload.dll


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-14 10:36:25
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 07/14/2007 10:37:46
C:\ComboFix-quarantined-files.txt … 07/14/07 10:37a
C:\ComboFix2.txt … 07/14/07 09:10a

— E O F —
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/14/2007 at 10:15 AM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type : Complete Scan
Total Scan Time : 00:39:12

Memory items scanned : 164
Memory threats detected : 0
Registry items scanned : 4885
Registry threats detected : 1
File items scanned : 26546
File threats detected : 5

Unclassified.PC MightyMax
HKU\S-1-5-21-1085031214-688789844-682003330-1000\Software\PC MightyMax
C:\Program Files\PC MightyMax\lic.conf
C:\Program Files\PC MightyMax\lic.dat
C:\Program Files\PC MightyMax\pcdocrx.conf
C:\Program Files\PC MightyMax\undo
C:\Program Files\PC MightyMax
Logfile of HijackThis v1.99.1
Scan saved at 10:25:33 AM, on 7/14/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\VTTimer.exe
C:\WINNT\system32\VTtrayp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\TimeLeft3\TimeLeft.exe
C:\WINNT\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINNT\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: TimeLeft.lnk = C:\Program Files\TimeLeft3\TimeLeft.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161452017703
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B24FBB73-7173-4C4B-8FD7-ADBD6D090552}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)
O20 - AppInit_DLLs: secuload.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LXCFCustomerConnect - Unknown owner - C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXCFserv.exe
O23 - Service: lxcf_device - Unknown owner - C:\WINNT\system32\lxcfcoms.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #4
PC MightyMax - a rogue software I hadn't seen before now. Likely pushes registration of it's program and does not provide an easy means of uninstalling. But it was picked up by Super so not new to some malware removal scans looks like. Looks good at this point. A new startup load method is showing now that is known to be set by SpyCatcher - did you just add this since running that first HijackThis log you posted here?


Run ATF Cleaner again, and Go here for an online AV scan (requires IE to run). If your AV alerts you while the scan installs ignore this - Panda's Active Scan method is often mistaken for infection activity.

Scan "Local Disks" and when finished save the scan log and then post the log here. To save the log first select the See Report button, then select the Save report button, and post that log back here.
Post #5
I did download "spyCatcher" and started to install it, but for some reason I aborted the install because it is not installed on my machine. I ran the ATF cleaner but did not delete the cookies because I use several storage sites and if I erase all the cookies I cannot access those sites without logging in. Some of the log in info I have forgotten. If it is absolutely necessary to clean all the cookies I will do it but would rather not unless absolutely necessary. I am posting the Panda Active Scan log I was told to post. Incident Status Location Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.advertising.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.2o7.net/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.atwola.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.bluestreak.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.atdmt.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.statcounter.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.fastclick.net/] Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.ads.pointroll.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.com.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.adrevolver.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.serving-sys.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.bs.serving-sys.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.serving-sys.com/] Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.www.myaffiliateprogram.com/] Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[www.myaffiliateprogram.com/] Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.www.myaffiliateprogram.com/] Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.overture.com/] Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[server.iad.liveperson.net/hc/17283262] Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[server.iad.liveperson.net/] Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.adtech.de/] Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.adultfriendfinder.com/] Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.burstnet.com/] Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.cs.sexcounter.com/] Spyware:Cookie/E-eliminator Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.evidence-eliminator.com/] Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.perf.overture.com/] Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.toplist.cz/] Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Edward Edwards\Application Data\Mozilla\Firefox\Profiles\h4h47yt6.default\cookies.txt[.xiti.com/] Virus:Generic Trojan Disinfected C:\Documents and Settings\Edward Edwards\Desktop\Audio Video Apps\no1dvdrip\keygen.exe Virus:Generic Trojan Disinfected C:\Documents and Settings\Edward Edwards\Desktop\Install files\convertxtodvd.2.1.x.xxx-patch.zip[convertxtodvd.2.1.x.xxx-patch.exe] Virus:Generic Malware Disinfected C:\Program Files\Innovative Solutions\Advanced Uninstaller PRO 2006 version 7\LoderRunOnce.exe Virus:Generic Trojan Disinfected C:\Program Files\vso\ConvertXtoDVD\convertxtodvd.2.1.x.xxx-patch.exe Thanks for your help with this!
Post #6
Have you been not removing cookies all along to keep this method of saving forgotten passwords/access codes? Every time nearly anything shows on your browser window, before it can do that IE has to search through every cookie stored there, to make sure it has the latest or is not repeating any existing cookies. Larger list, longer time searching. What would these accesses be for? Bummer is by the looks of the Panda results some of the infection here may have come from trying to rip off the authors of that ConvertXtoDVD software (about $40 USD) by downloading a patch for that. Some software's Keygen here as well. Lot of grief for 40 bucks. But Panda did disinfect them. You may as well go ahead and install SpyCatcher, then uninstall it correctly to remove any remnants you left by aborting the earlier install.
Post #7
For what it is worth, i was not aware I was "ripping anybody off". That software was posted by a person in one of my google groups. I thought it was interesting and I tried it out. Have never even gotten to use it. They regularly post software and I honestly thought it was OK. I installed that spycather and uninstalled it. What do I need to do now? Thanks again for your help!
Post #8
Probably the one called keygen may not have been so much as surprise though, ey? If you resolve that SpyCatcher issue like I mentioned the Panda scan showed only the illegal software it went ahead and deleted, so no infection showing now. Be well.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI