What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Computer Running Awfully Slow!

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello! Lately my computer has been running awfully slow. The problem became very apparent when my music from iTunes wouldn't play without skipping and coming out distorted. While trying to reset my computer, the startup screen would take upwards of five minutes before going to the login screen, and in my Performance tab of Windows Task Manager I am constantly spiking up to 90-100%!!! My first action was to run multiple Spy-ware and virus programs, all of which had no success. Disk defragment didn't help either. I noticed that there was a process called DoScan.exe and Rtvscan.exe running that would constantly take up much of my cpu power. I suspected it was this process that was bogging down my computer; research led me to find that they are both processes of Symantec Antivirus and that with the new patch those 2 hefty processes are fixed. I uninstalled symantec in attempts to free up some processing power and return my computer to its normal quick speed, but it did not help! As of now, I am still not able to play music without it skipping and bogging down, or run multiple programs without SERIOUS lag! PLEASE HELP, I am thoroughly lost and have reached the very end of my tech abilities (or lack there of :unsure: ) THANKS!



Logfile of HijackThis v1.99.1
Scan saved at 10:27:35 PM, on 8/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?

TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.up.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?

TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0

\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11

\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth

Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program

Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?

TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32

\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth

Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-

Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program

Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Post #2
Hi Jace,

I can't yet say whether the problems you are experiencing are caused by malware, if they are we will get to the bottom of it, if not then I'll advise you on getting further help.

I understand your frustration with the slowness of your computer, but without an antivirus program running is your computer is very vulnerable and can easily be infected at any time so it it is essential you have one active at all times.

There are several free packages available, two of the most popular are here:
Antivir: http://www.free-av.com/
AVG Antivirus: http://free.grisoft.com/doc/1

Please download and install an antivirus program immediately, update the definitions and set it to update automatically. Then do a full system scan and quarantine/delete anything it finds, and make a note of where the logfile is stored so you can post a copy in your next response.

Now open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your deskop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.

Before posting your HijackThis log, select Format from the top menu and make sure Word Wrap is not selected - this will make your HijackThis log readable.

Once complete, please post the antivirus scan log, the uninstall list and a new HijackThis log.
Post #3
Thankyou. I downloaded the AVG free anti-virus and scanned my laptop with the latest updated addition. The search gave no hits and said my computer was clean. I'm still having the issue of not being able to hear music without it coming out skipping and distorted, and the boot time takes a LONG time. ARRR… below are my logs! thankyou!

Logfile of HijackThis v1.99.1
Scan saved at 8:37:24 PM, on 8/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.up.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe





2Wire Wireless Manager
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.0
Adobe Shockwave Player
Adobe Stock Photos 1.0
America's Army
AOL Uninstaller (Choose which Products to Remove)
Apple Mobile Device Support
Apple Software Update
Atajo
Athlon 64 Processor Driver
ATI Control Panel
ATI Display Driver
AVG 7.5
Battlefield 1942
Battlefield 1942: Secret Weapons of WWII
CCleaner (remove only)
Cisco Clean Access Agent
Conexant AC-Link Audio
Customer Experience Enhancement
DC++ 0.698
DesertCombat 0.7
ElectricSheep 2.6.6
Google Earth
Hijackthis 1.99.1
HijackThis 1.99.1
HP Help and Support
HP Imaging Device Functions 6.0
HP Integrated Module with Bluetooth wireless technology
HP Photosmart Premier Software 6.0
HP QuickPlay 2.0
HP Software Update
HP User Guides 0025
HP User Guides–System Recovery
HP Wireless Assistant 2.00 C1
iTunes
J2SE Runtime Environment 5.0 Update 6
LimeWire 4.12.11
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Money 2006
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0 (Beta2)
Microsoft Works
Mozilla Firefox (1.5.0.12)
MSXML 4.0 SP2 (KB927978)
muvee autoProducer 4.5
Office 2003 Trial Assistant
Otto
Quick Launch Buttons 5.20 F2
QuickTime
Qwest QuickNetworking
Soft Data Fax Modem with SmartCP
Sonic Audio Module
Sonic Copy Module
Sonic Data Module
Sonic Express Labeler
Sonic MyDVD Plus
Sonic Update Manager
SonicAC3Encoder
SonicMPEGEncoder
Spybot - Search & Destroy 1.4
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515/xx12 drivers.
TourSetup
Trillian
VideoLAN VLC media player 0.8.5
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Media Player Firefox Plugin
WinRAR archiver
Wireless Home Network Setup



thanks!
Post #4
Hi Jace,

Some uninstalls to consider:

Please open Start->Control Panel->Add/Remove Programs, look down the list for this item and remove it:
J2SE Runtime Environment 5.0 Update 6
This out of date and now a security risk, you can get the latest update (version 6 update 2) from here

You have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using safe and free alternatives such as VLC Player or Media Player Classic.
You can remove this by finding and removing these via Add/Remove Programs:
Viewpoint Manager (Remove Only)
Viewpoint Media Player

You have LimeWire, a P2P file sharing program installed on your computer. This program does not come bundled with malware as some similar programs do, but peer-to-peer file sharing networks are one of the biggest sources of malware we see. Anything downloaded from them cannot be trusted to be clean, because even if the file appears to be what it claims to be, it can have malware embedded in it.
I recommend you remove it, but of course the choice is yours.
You can remove Limewire via Add/Remove Programs.

Some parts of Norton antivirus have not been removed, to complete the uninstall go to
http://service1.symantec.com/SUPPORT/tsgen…005033108162039
and follow the instructions for Step 2 - Download and run the Norton Removal Tool
You will download a tool and run it from your Desktop, this will clean up the Norton installation.

Next, please download F-Secure Blacklight
  • Click I ACCEPT and download the graphical user interface version to your Desktop
  • Double click the file to run it, choose I accept the agreement then press Scan
  • It will create the fsbl-xxxxxxx.log on your desktop.
  • The log will have a list of all items found.
  • Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
  • Exit Blacklight and post the contents of the log in your next reply.
Download Deckard's System Scanner (DSS)
  • Close all applications and windows.
  • Double-click on dss.exe to run it, and follow the prompts.
  • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
  • Make sure Format->Word Wrap is unchecked
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply
Once complete, please post the Blacklight log and both DSS logs, you won't need to produce a new HijackThis log as DSS produces one for you.
Post #5
Thankyou for your reccomendations, i took them to heart and deleted the programs that you had reccomended, including limewire.


Deckard's System Scanner v20070809.63
Run by [removed] on 2007-08-12 at 23:09:04
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
87: 2007-08-13 06:09:45 UTC - RP327 - Deckard's System Scanner Restore Point
86: 2007-08-12 21:58:20 UTC - RP326 - Removed J2SE Runtime Environment 5.0 Update 6
85: 2007-08-11 22:17:45 UTC - RP325 - Installed AVG 7.5
84: 2007-08-06 05:00:33 UTC - RP324 - Installed iTunes
83: 2007-08-06 04:01:36 UTC - RP323 - Removed Full Tilt Poker


– First Restore Point –
1: 2007-05-16 00:38:32 UTC - RP241 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as Jason Pennell.exe) —————————————

Logfile of HijackThis v1.99.1
Scan saved at 11:12:07 PM, on 8/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\2Wire Wireless Manager\2Wire.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Documents and Settings\Jason Pennell\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Jason Pennell.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.up.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth; - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=Q106&bd;=pavilion&pf;=laptop
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R3 PCTINDIS5 (PCTINDIS5 NDIS Protocol Driver) - c:\windows\system32\pctindis5.sys
Post #6
Hi Jace,

The Event Log is showing some errors:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Submitted/Written: 08/12/2007 09:03:07 PM
Event Submitted/Written: 08/12/2007 06:02:11 PM
Event Submitted/Written: 08/12/2007 04:49:05 PM
Event Submitted/Written: 08/12/2007 04:19:01 PM
Event Submitted/Written: 08/12/2007 04:01:40 PM

Please let me know if you were using peer-to-peer filesharing software at these times.


Your Symantec/Norton antivirus program may not have uninstalled cleanly.
To complete the uninstall, go to:
http://service1.symantec.com/SUPPORT/tsgen…005033108162039
and follow the instructions for Step 2 - Download and run the Norton Removal Tool
You will download a tool and run it from your Desktop, this will clean up the Norton installation.

Then please do an online scan with Kaspersky:

Open Kaspersky Online Scanner in Internet Explorer

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT and then Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • The program will start to scan your system.
  • Once the scan is complete, click on the Save as Text button and save the file to your desktop
Once complete please post the Kaspersky log and a new HijackThis log.
Post #8
sorry for the late reply!

thats odd that it shows errors because i WAS NOT using p2p filesharing at the time! i believe i had already deleted limewire too. i again tried to use the norton removal tool, and i hope that this time it removed the parts left of norton. below is my kaspersky and hijack info! thanks!!


Logfile of HijackThis v1.99.1
Scan saved at 12:41:36 PM, on 8/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\2Wire Wireless Manager\2Wire.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.up.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe




Friday, August 17, 2007 3:40:14 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 17/08/2007
Kaspersky Anti-Virus database records: 383013
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
Scan Statistics
Total number of scanned objects 71538
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0
Duration of the scan process 06:35:37

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies30625102314\values Object is locked skipped
C:\Documents and Settings\Jason Pennell\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Temp\~DFFA75.tmp Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Jason Pennell\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{BFAA719B-281F-45B6-9E39-9D4BB578C2A4}\RP330\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{375C5D97-BBAA-4191-85B9-3AA5F1289828}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.



with the kaspersky scan results, i'm not sure if i did something wrong but it saved the results as a .html file on my desktop. when i open it it appears in firefox the firefox browser and in the web address window is file:///C:/Documents%20and%20Settings/Jason%20Pennell/Desktop/kaspersky%20scan.html. i don't know what the best way to write the results would be so i'll try to copy and paste what it says into this window. please let me know if there is a better way to do so so that it might be more easily read! thanks


Friday, August 17, 2007 3:40:14 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 17/08/2007
Kaspersky Anti-Virus database records: 383013
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
Scan Statistics
Total number of scanned objects 71538
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0
Duration of the scan process 06:35:37

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies30625102314\values Object is locked skipped
C:\Documents and Settings\Jason Pennell\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Temp\~DFFA75.tmp Object is locked skipped
C:\Documents and Settings\Jason Pennell\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jason Pennell\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Jason Pennell\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{BFAA719B-281F-45B6-9E39-9D4BB578C2A4}\RP330\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{375C5D97-BBAA-4191-85B9-3AA5F1289828}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
Post #9
Hi Jace,

We'll remove that Norton entry with HijackThis:

Then, open HijackThis, choose Do a system scan only and place a checkmark next to the following line:

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\


Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Those TCP/IP errors are concerning however there's no sign of malware on your computer, are you still experiencing the boot and media playback problems?

Please check the System Event log again:
  • Press Start->Run, type eventvwr.msc into the box and press OK
  • Export the System log as follows:
    • Right-click the word System in the left-hand pane
    • Select Save Log File As…, change Save as type: to Text
    • Choose a filename and save the log to your Desktop
  • Please post all the most recent events in the log, starting with the errors I posted above.
Once complete, please post the System Log information along with another HijackThis log and let me know if there has been any change in the symptoms.
Post #10
arrr… yea, the startup is still very slow and itunes especially is slow! music and the sound from videos still comes out skipping as well… the event log is posted below but when i copied and pasted it, it appears to have been put on pretty distorted…

Logfile of HijackThis v1.99.1
Scan saved at 8:19:20 PM, on 8/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\2Wire Wireless Manager\2Wire.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.up.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


it stated that my entry was too long to include the logfile… is there a better way to include the logfile without going over the limit?
Post #11
Hi Jace,

Your HijackThis log looks good :)

You only need to post the Event Log entries between this one:

Event Submitted/Written: 08/12/2007 09:03:07 PM

and today - if you can do so without it being too long then do so.

If it's still too long, then please just post the last few days and we should be able to see what's going on from that.
Post #12
8/18/2007 5:48:01 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/17/2007 3:40:06 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/17/2007 3:39:37 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/17/2007 6:33:22 AM Tcpip Information None 4202 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers. 8/17/2007 6:33:21 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/17/2007 6:33:13 AM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/17/2007 6:33:14 AM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/17/2007 3:09:06 AM W32Time Warning None 36 N/A JPNOTEBOOK The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. 8/17/2007 1:14:19 AM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/16/2007 1:34:03 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The AVG E-mail Scanner service entered the running state. 8/16/2007 1:33:55 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The AVG E-mail Scanner service was successfully sent a start control. 8/16/2007 1:33:53 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The AVG7 Alert Manager Server service entered the running state. 8/16/2007 1:33:52 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The AVG7 Alert Manager Server service was successfully sent a start control. 8/16/2007 1:33:33 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The AVG7 Kernel service was successfully sent a start control. 8/16/2007 1:32:56 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The AVG7 Alert Manager Server service entered the stopped state. 8/16/2007 1:32:53 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The AVG7 Alert Manager Server service was successfully sent a stop control. 8/16/2007 1:32:48 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The AVG E-mail Scanner service entered the stopped state. 8/16/2007 1:32:46 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The AVG E-mail Scanner service was successfully sent a stop control. 8/16/2007 1:29:53 PM W32Time Information None 35 N/A JPNOTEBOOK The time service is now synchronizing the system time with the time source time.windows.com (ntp.m|0x1|192.168.0.66:123->207.46.130.100:123). 8/16/2007 1:29:33 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/16/2007 1:28:58 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/16/2007 7:24:32 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/16/2007 7:24:26 AM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/16/2007 7:24:26 AM Tcpip Information None 4202 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers. 8/16/2007 2:15:21 AM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/16/2007 12:09:06 AM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/16/2007 12:08:34 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/15/2007 9:03:03 PM Tcpip Information None 4202 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers. 8/15/2007 9:03:02 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/15/2007 9:02:58 PM ipnathlp Error None 32003 N/A JPNOTEBOOK The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code. 8/15/2007 9:02:57 PM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/15/2007 9:02:54 PM Dhcp Warning None 1003 N/A JPNOTEBOOK Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0014A57DA1CC. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 8/15/2007 9:02:54 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/15/2007 4:16:06 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Universal Plug and Play Device Host service entered the running state. 8/15/2007 4:16:03 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Universal Plug and Play Device Host service was successfully sent a start control. 8/15/2007 4:00:50 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/15/2007 4:00:19 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/15/2007 4:34:00 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/15/2007 4:33:54 AM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/15/2007 12:19:03 AM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/14/2007 8:35:34 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/14/2007 4:18:18 PM W32Time Information None 35 N/A JPNOTEBOOK The time service is now synchronizing the system time with the time source time.windows.com (ntp.m|0x1|192.168.0.66:123->207.46.130.100:123). 8/14/2007 1:50:35 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/14/2007 12:52:57 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/14/2007 12:22:53 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/14/2007 12:08:46 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/14/2007 11:22:10 AM Dhcp Error None 1002 N/A JPNOTEBOOK The IP address lease 0.0.0.0 for the Network Card with network address 0014A57DA1CC has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message). 8/14/2007 11:22:10 AM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/14/2007 11:21:42 AM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The PCTINDIS5 NDIS Protocol Driver service was successfully sent a start control. 8/14/2007 11:21:17 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Wireless Zero Configuration service entered the stopped state. 8/14/2007 11:21:16 AM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Wireless Zero Configuration service was successfully sent a stop control. 8/14/2007 11:20:53 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The iPod Service service entered the running state. 8/14/2007 11:20:53 AM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The iPod Service service was successfully sent a start control. 8/14/2007 11:19:00 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Remote Access Connection Manager service entered the running state. 8/14/2007 11:18:29 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The IMAPI CD-Burning COM Service service entered the stopped state. 8/14/2007 11:18:23 AM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Remote Access Connection Manager service was successfully sent a start control. 8/14/2007 11:18:23 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Telephony service entered the running state. 8/14/2007 11:18:21 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The IMAPI CD-Burning COM Service service entered the running state. 8/14/2007 11:18:21 AM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The IMAPI CD-Burning COM Service service was successfully sent a start control. 8/14/2007 11:18:11 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Application Layer Gateway Service service entered the running state. 8/14/2007 11:18:11 AM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Application Layer Gateway Service service was successfully sent a start control. 8/14/2007 11:18:11 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Fast User Switching Compatibility service entered the running state. 8/14/2007 11:18:11 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Network Location Awareness (NLA) service entered the running state. 8/14/2007 11:18:11 AM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Network Location Awareness (NLA) service was successfully sent a start control. 8/14/2007 11:18:11 AM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Fast User Switching Compatibility service was successfully sent a start control. 8/14/2007 11:18:11 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Terminal Services service entered the running state. 8/14/2007 11:18:11 AM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Terminal Services service was successfully sent a start control. 8/14/2007 11:18:11 AM Service Control Manager Error None 7000 N/A JPNOTEBOOK The PfModNT service failed to start due to the following error: The system cannot find the file specified. 8/14/2007 11:15:54 AM EventLog Information None 6005 N/A JPNOTEBOOK The Event log service was started. 8/14/2007 11:15:54 AM EventLog Information None 6009 N/A JPNOTEBOOK Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Uniprocessor Free. 8/14/2007 11:12:32 AM EventLog Information None 6006 N/A JPNOTEBOOK The Event log service was stopped. 8/14/2007 11:12:09 AM Tcpip Information None 4202 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers. 8/14/2007 11:12:01 AM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/14/2007 11:11:57 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Ati HotKey Poller service entered the stopped state. 8/14/2007 5:58:58 AM W32Time Warning None 36 N/A JPNOTEBOOK The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. 8/14/2007 4:40:25 AM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/13/2007 4:19:46 PM W32Time Information None 35 N/A JPNOTEBOOK The time service is now synchronizing the system time with the time source time.windows.com (ntp.m|0x1|192.168.0.66:123->207.46.130.100:123). 8/13/2007 4:19:27 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/13/2007 4:18:53 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/13/2007 12:20:10 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/13/2007 12:20:05 PM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/13/2007 8:08:11 AM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/13/2007 4:58:55 AM W32Time Warning None 36 N/A JPNOTEBOOK The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. 8/13/2007 12:49:49 AM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/12/2007 10:56:04 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The F-Secure BlackLight Beta Engine Driver service was successfully sent a start control. 8/12/2007 10:52:05 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Universal Plug and Play Device Host service entered the running state. 8/12/2007 10:52:03 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Universal Plug and Play Device Host service was successfully sent a start control. 8/12/2007 9:03:07 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/12/2007 6:02:11 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/12/2007 4:49:05 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/12/2007 4:19:01 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/12/2007 4:01:40 PM Tcpip Warning None 4226 N/A JPNOTEBOOK TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. 8/12/2007 3:19:40 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/12/2007 3:19:08 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The PCTINDIS5 NDIS Protocol Driver service was successfully sent a start control. 8/12/2007 3:18:45 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Wireless Zero Configuration service entered the stopped state. 8/12/2007 3:18:43 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Wireless Zero Configuration service was successfully sent a stop control. 8/12/2007 3:18:16 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The iPod Service service entered the running state. 8/12/2007 3:18:15 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The iPod Service service was successfully sent a start control. 8/12/2007 3:18:15 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Remote Access Connection Manager service entered the running state. 8/12/2007 3:17:36 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Remote Access Connection Manager service was successfully sent a start control. 8/12/2007 3:17:36 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Telephony service entered the running state. 8/12/2007 3:17:33 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The IMAPI CD-Burning COM Service service entered the stopped state. 8/12/2007 3:17:33 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Application Layer Gateway Service service entered the running state. 8/12/2007 3:17:32 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Application Layer Gateway Service service was successfully sent a start control. 8/12/2007 3:17:25 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The IMAPI CD-Burning COM Service service entered the running state. 8/12/2007 3:17:25 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Network Location Awareness (NLA) service entered the running state. 8/12/2007 3:17:25 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Network Location Awareness (NLA) service was successfully sent a start control. 8/12/2007 3:17:25 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The IMAPI CD-Burning COM Service service was successfully sent a start control. 8/12/2007 3:17:23 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Fast User Switching Compatibility service was successfully sent a start control. 8/12/2007 3:17:06 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Fast User Switching Compatibility service entered the running state. 8/12/2007 3:17:06 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Terminal Services service entered the running state. 8/12/2007 3:17:06 PM Service Control Manager Error None 7000 N/A JPNOTEBOOK The PfModNT service failed to start due to the following error: The system cannot find the file specified. 8/12/2007 3:13:45 PM EventLog Information None 6005 N/A JPNOTEBOOK The Event log service was started. 8/12/2007 3:13:45 PM EventLog Information None 6009 N/A JPNOTEBOOK Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Uniprocessor Free. 8/12/2007 3:10:44 PM EventLog Information None 6006 N/A JPNOTEBOOK The Event log service was stopped. 8/12/2007 3:10:25 PM Tcpip Information None 4202 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers. 8/12/2007 3:10:17 PM BROWSER Information None 8033 N/A JPNOTEBOOK The browser has forced an election on network \Device\NetBT_Tcpip_{DC5C893E-A55A-4DF6-9363-5A4CD1328DBC} because a master browser was stopped. 8/12/2007 3:10:09 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Ati HotKey Poller service entered the stopped state. 8/12/2007 3:09:11 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Installer service entered the stopped state. 8/12/2007 3:01:02 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Viewpoint Manager Service service entered the stopped state. 8/12/2007 3:01:02 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Viewpoint Manager Service service was successfully sent a stop control. 8/12/2007 2:59:11 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Application Management service entered the running state. 8/12/2007 2:59:11 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Application Management service was successfully sent a start control. 8/12/2007 2:57:05 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Installer service entered the running state. 8/12/2007 2:57:05 PM Service Control Manager Information None 7035 NT AUTHORITY\SYSTEM JPNOTEBOOK The Windows Installer service was successfully sent a start control. 8/12/2007 2:53:29 PM W32Time Information None 35 N/A JPNOTEBOOK The time service is now synchronizing the system time with the time source time.windows.com (ntp.m|0x1|192.168.0.66:123->207.46.130.100:123). 8/12/2007 2:53:10 PM Tcpip Information None 4201 N/A JPNOTEBOOK The system detected that network adapter Broadcom 802.11a/b/g WLAN - Packet Scheduler Miniport was connected to the network, and has initiated normal operation over the network adapter. 8/12/2007 2:52:42 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The PCTINDIS5 NDIS Protocol Driver service was successfully sent a start control. 8/12/2007 2:52:40 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Wireless Zero Configuration service entered the stopped state. 8/12/2007 2:52:39 PM Service Control Manager Information None 7035 JPNOTEBOOK\Jason Pennell JPNOTEBOOK The Wireless Zero Configuration service was successfully sent a stop control. 8/12/2007 2:51:24 PM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/12/2007 5:45:52 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state. 8/12/2007 3:44:43 AM Service Control Manager Information None 7036 N/A JPNOTEBOOK The Windows Image Acquisition (WIA) service entered the running state.
Post #13
Hi Jace,

I can't see anything indicating a problem in there, the TCP/IP errors are a little concerning but they could have any number of causes and aren't necessarily related to the symptoms you are experiencing. However, I recommend you keep an eye on the System log and try to note or recall what was happening at the time of the errors to see if you can figure out the cause.

We've had a pretty thorough look at your computer and at this stage it looks clean of malware, so I'd say the slowdown has other causes.
Some suggestions for pinning it down:
  • Uninstall unnecessary applications via Start->Control Panel->Add/Remove Programs
  • Turn off unnecessary auto-starting applications. Look at your HijackThis log for programs which automatically start - many are listed in the O4 section of the log, and turn of the automatic starting functionality from within the program. Note: Please do not use HijackThis to remove the entries.
  • Use Process Explorer to monitor resources on your system. Run Process Explorer minimized and when a slowdown occurs, switch to the Process Explorer window to see which process is using a high percentage of CPU.
  • Post in the Other computer problems forum here at Tom Coyote to get more help.
Here are some tips to help you keep your computer clean:

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

You have a good antivirus program installed, however I recommend you also install antispyware software with real-time capabilities - this will protect you from a wider range of malware and also that it will protect you from system changes and spyware while you are working, not just removing malware after it has been installed. There are a range of paid-for and free packages available, a free one I can recommend is Windows Defender, available here:
http://www.microsoft.com/athome/security/s…re/default.mspx

You should consider installing a Personal Firewall program. Even if you are behind a NAT router, I recommend you use firewall software as it will improve the security of your computer by monitoring and controlling outbound connections to the internet as well as inbound. There are various free packages available, such as Sunbelt Personal Firewall and Zone Alarm:
http://www.sunbelt-software.com/Home-Home-…sonal-Firewall/
http://www.zonelabs.com/

Spywareblaster is a free program which prevents the download and installation of Internet Explorer ActiveX based malware by immunizing your system against it. You can download Spywareblaster from here and a tutorial to help you get started is available here.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware - this includes allowing websites to install browser plug-ins orActiveX controls. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out more about how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know that you have read this, and if there are any further issues.
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI