Spyware / Malware / Virus Removal

[Closed] computer very slow

24 min read

Looking for the outcome? Ask AI

tailight Topic Starter

Post #1October 11, 2007, 8:26 PM UTC

having probs with my comp.lately have run a hijackthis log but not sure how to post. wouldbe grateful for any help

tailight

Post #2October 11, 2007, 8:28 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 22:30:35, on 11/10/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\system32\ntvdm.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eircom.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8081
O1 - Hosts: 82.146.60.44 postbank.de
O1 - Hosts: 82.146.60.44 www.postbank.de
O1 - Hosts: 82.146.60.44 banking.postbank.de
O1 - Hosts: 82.146.60.44 direkt.postbank.de
O1 - Hosts: 82.146.60.44 citibank.de
O1 - Hosts: 82.146.60.44 www.citibank.de
O1 - Hosts: 82.146.60.44 www.smile.co.uk
O1 - Hosts: 82.146.60.44 smile.co.uk
O1 - Hosts: 82.146.60.44 cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.co.uk
O1 - Hosts: 82.146.60.44 cahoot.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.com
O1 - Hosts: 82.146.60.44 co-operativebank.com
O1 - Hosts: 82.146.60.44 personal.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.co.uk
O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk
O1 - Hosts: 82.146.60.44 www.barclays.co.uk
O1 - Hosts: 82.146.60.44 hsbc.co.uk
O1 - Hosts: 82.146.60.44 www.hsbc.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.com
O1 - Hosts: 82.146.60.44 www.lloydstsb.com
O1 - Hosts: 82.146.60.44 www.woolwich.co.uk
O1 - Hosts: 82.146.60.44 woolwich.co.uk
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [iamapp] "C:\Program Files\Norton Internet Security\IAMAPP.EXE"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINNT\system32\mmsvc32.exe
O4 - HKLM\..\Run: [Spools Service Controller] C:\WINNT\system32\spools.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\spysub.exe
O9 - Extra button: Paddy Power Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\PADDYP~1\client.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{83C0D946-4CE8-42AE-8183-5A7B11C1D3A3}: NameServer = 213.94.190.235 213.94.190.195
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

LDTate

Post #3October 11, 2007, 9:49 PM UTC

Hello and welcome to the forums

Are you located in Russia?

Did you put those entries in your Host File?
O1 - Hosts: 82.146.60.44

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.

tailight

Post #4October 13, 2007, 10:44 AM UTC

# version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=2590 (20071012) # vers_arch_module=1.058 (20070906) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=a1363cce1ecec246a2f98105edf1950d # end=finished # remove_checked=false # unwanted_checked=false # utc_time=2007-10-13 11:40:55 # local_time=2007-10-13 12:40:55 (+0000, GMT Daylight Time) # country="Ireland" # osver=5.0.2195 NT Service Pack 4 # scanned=45947 # found=7 # scan_time=2219 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5ATU4WF7\gate[1].exe probably a variant of Win32/Agent.NHJ trojan 88F3B49007FFC7D1E2697F883346C8AD C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4S2LNAN7\bbot[1].exe Win32/Nanspy.NAC trojan 00000000000000000000000000000000 C:\WINNT\system32\bbot.exe Win32/Nanspy.NAC trojan D2FFD50127531537A2780C8B4A8B6E89 C:\WINNT\system32\gate.exe probably a variant of Win32/Agent.NHJ trojan 88F3B49007FFC7D1E2697F883346C8AD C:\WINNT\system32\mmf32.exe probably a variant of Win32/Agent.NHJ trojan 75A3A0B4A27445C2321794C1D4E6901D C:\WINNT\system32\mmsvc32.exe probably a variant of Win32/Agent.NHJ trojan 75A3A0B4A27445C2321794C1D4E6901D C:\WINNT\system32\spools.exe Win32/Nanspy.NAC trojan D2FFD50127531537A2780C8B4A8B6E89

LDTate

Post #5October 13, 2007, 12:03 PM UTC

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick while its running. That may cause it to stall

tailight

Post #6October 15, 2007, 3:12 PM UTC

ComboFix 07-10-12.4 - Administrator 15/10/2007 17:12:03.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.24 [GMT 1:00]
Running Wrom: YLEJGDGVCJVTLBXFGGMEPYOQKEDOTWFAOBUZXUWLSZLKBRNVWWCUFPEGAUTF
.

((((((((((((((((((((((((( Files Created from 2007-09-15 to 2007-10-15 )))))))))))))))))))))))))))))))
.

2007-10-15 17:12 16,384 –a—-t- C:\WINNT\system32\Perflib_Perfdata_2e4.dat
2007-10-15 17:10 51,200 –a—— C:\WINNT\NirCmd.exe
2007-10-13 11:58 49,136 –a—— C:\WINNT\system32\bbot.exe
2007-10-12 21:18 d——– C:\Program Files\EsetOnlineScanner
2007-10-11 21:51 263,680 –a—— C:\WINNT\system32\spools.exe
2007-10-04 21:51 62,183 –a—— C:\WINNT\system32\gate.exe
2007-10-01 14:00 81,984 –a—— C:\WINNT\system32\bdod.bin
2007-10-01 13:55 d——– C:\Documents and Settings\Administrator\Application Data\Bitdefender
2007-10-01 13:55 d——– C:\Documents and Settings\Administrator\Application Data\Bitdefender
2007-10-01 13:54 d——– C:\Documents and Settings\All Users\Application Data\BitDefender
2007-09-29 16:12 13,312 –a—— C:\WINNT\system32\SYWnhBBn.exe
2007-09-29 15:52 d——– C:\Program Files\CyberLink
2007-09-29 15:52 d——– C:\MyWorks
2007-09-29 15:41 16,384 –a—-t- C:\WINNT\system32\Perflib_Perfdata_2ec.dat
2007-09-26 22:27 8,192 –a—— C:\WINNT\system32\psvc.exe
2007-09-26 22:24 79,872 –a—— C:\WINNT\system32\mmsvc32.exe
2007-09-26 22:24 79,872 –a—— C:\WINNT\system32\mmf32.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-15 15:41 ——— d—–w C:\Program Files\Norton Internet Security
2007-10-01 13:42 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-09-29 15:08 ——— d—–w C:\Program Files\QuickTime
2007-08-29 18:59 ——— d—–w C:\Program Files\eGames
2007-08-24 20:55 ——— d—–w C:\Program Files\Selectsoft
2007-08-08 15:30 19,456 —-a-w C:\WINNT\system32\OnlineScannerLang.dll
2007-08-02 17:11 253,952 —-a-w C:\WINNT\system32\OnlineScannerDLLA.dll
2007-08-02 17:11 241,664 —-a-w C:\WINNT\system32\OnlineScannerDLLW.dll
2007-07-27 14:49 225,355 —-a-w C:\WINNT\system32\lnod32apiW.dll
2007-07-27 14:49 196,683 —-a-w C:\WINNT\system32\lnod32apiA.dll
2005-10-13 19:48 271 —h–w C:\Program Files\desktop.ini
2005-10-13 19:48 21,952 —h–w C:\Program Files\folder.htt
1999-12-07 12:00 32,528 —-a-w C:\WINNT\inf\wbfirdma.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [19/06/03 12:05 C:\WINNT\system32\mobsync.exe]
"iamapp"="C:\Program Files\Norton Internet Security\IAMAPP.EXE" [30/08/01 01:32 ]
"NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [16/08/01 17:52 ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [24/06/05 15:16 ]
"CARPService"="carpserv.exe" [18/12/02 17:15 C:\WINNT\system32\carpserv.exe]
"Microsoft Network Services Controller"="C:\WINNT\system32\mmsvc32.exe" [26/09/07 22:24 ]
"Spools Service Controller"="C:\WINNT\system32\spools.exe" [13/10/07 12:00 ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [29/09/07 16:07 ]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [04/10/07 22:59 ]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [26/03/07 15:49 ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [07/12/99 13:00 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"=internat.exe

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Event Reminder.lnk - C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE [1997-08-06 15:36:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1997-08-01]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1997-08-01]
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\spysub.exe [2006-09-21 15:25:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

R2 NISSERV;Norton Internet Security Service;C:\Program Files\Norton Internet Security\NISSERV.EXE
R2 StreamDispatcher;StreamDispatcher;C:\WINNT\system32\DRIVERS\strmdisp.sys
R3 HSFHWCD2;HSFHWCD2;C:\WINNT\system32\DRIVERS\HSFHWCD2.sys
R3 trid3d;trid3d;C:\WINNT\system32\DRIVERS\trid3dm.sys
R3 Winacpci;Winacpci;C:\WINNT\system32\DRIVERS\winacpci.sys
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINNT\system32\DRIVERS\sscdbus.sys
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINNT\system32\DRIVERS\sscdmdfl.sys
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINNT\system32\DRIVERS\sscdmdm.sys
S3 viafilter;VIA USB Filter;C:\WINNT\system32\Drivers\viausb.sys

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2006-05-19 19:12:59 C:\WINNT\Tasks\Norton AntiVirus - Scan my computer.job"
"2005-10-14 14:51:06 C:\WINNT\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-15 17:14:38
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.Logfile of HijackThis v1.99.1
Scan saved at 17:20:42, on 15/10/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eircom.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8081
O1 - Hosts: 82.146.60.44 postbank.de
O1 - Hosts: 82.146.60.44 www.postbank.de
O1 - Hosts: 82.146.60.44 banking.postbank.de
O1 - Hosts: 82.146.60.44 direkt.postbank.de
O1 - Hosts: 82.146.60.44 citibank.de
O1 - Hosts: 82.146.60.44 www.citibank.de
O1 - Hosts: 82.146.60.44 www.smile.co.uk
O1 - Hosts: 82.146.60.44 smile.co.uk
O1 - Hosts: 82.146.60.44 cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.co.uk
O1 - Hosts: 82.146.60.44 cahoot.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.com
O1 - Hosts: 82.146.60.44 co-operativebank.com
O1 - Hosts: 82.146.60.44 personal.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.co.uk
O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk
O1 - Hosts: 82.146.60.44 www.barclays.co.uk
O1 - Hosts: 82.146.60.44 hsbc.co.uk
O1 - Hosts: 82.146.60.44 www.hsbc.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.com
O1 - Hosts: 82.146.60.44 www.lloydstsb.com
O1 - Hosts: 82.146.60.44 www.woolwich.co.uk
O1 - Hosts: 82.146.60.44 woolwich.co.uk
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [iamapp] "C:\Program Files\Norton Internet Security\IAMAPP.EXE"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINNT\system32\mmsvc32.exe
O4 - HKLM\..\Run: [Spools Service Controller] C:\WINNT\system32\spools.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\spysub.exe
O9 - Extra button: Paddy Power Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\PADDYP~1\client.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{83C0D946-4CE8-42AE-8183-5A7B11C1D3A3}: NameServer = 213.94.190.235 213.94.190.195
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Completion time: 15/10/2007 17:16:18
.
— E O F —

LDTate

Post #7October 15, 2007, 10:03 PM UTC

Please download HostsXpert from the link below.

http://www.funkytoad.com/download/HostsXpert.zip

Unzip HostsXpert.zip
Open HostsXpert.exe.

you have to click: ''make hosts writable'' in the top right corner, then press the ''restore'' option

Close program when complete.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINNT\system32\bbot.exe
C:\WINNT\system32\spools.exe
C:\WINNT\system32\gate.exe
C:\WINNT\system32\bdod.bin
C:\WINNT\system32\mmsvc32.exe
C:\WINNT\system32\mmf32.exe
C:\WINNT\system32\internat.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spools Service Controller"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"=-

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log

tailight

Post #8October 16, 2007, 6:28 PM UTC

i have downloaded hostsexpert but cannot open it . when i click open it says open with but i'm not sure what programme to open with . i've tried internet explorer but all that happens is a box flashes on screen then nothing happens. i have been getting error msgs such as iexplore stack overflow & also at startup a number of different websites have been tryin to access my comp such as crn.nnctx.com.ru

LDTate

Post #9October 17, 2007, 2:46 AM UTC

Did you unzip the file first?

Please download HostsXpert from Here
http://www.funkytoad.com/content/view/13/

Down load this to your desktop

Now I want you to open up HostsXpert the tool you down loaded to the desk top.
You will be presented with a screen to the left in which you will have a list of host files, if you haven't put any of them there click on restore microsofts original host file.
If there are some you want keeping just Hi -lite and click on delete selected line

Merge with or Replace your existing hosts file with either MVPs Hosts file or HpHosts file.
Both websites offer an email subscription service for notification of updates-
MVPsHosts can be found here: http://www.mvps.org/winhelp2002/hosts.htm
(Notification subscription info at bottom of page)
hpHosts found here: http://hosts-file.net/
(Notification subscription info on download page)

tailight

Post #10October 18, 2007, 7:33 PM UTC

hi, l'd like to thank LD Tate for your help so far. you asked if i unzipped the file first well the answer to that is i dont know how to unzip.not very computer literate but would like to learn so if u could tell me how i would appreciate it.thanks man

LDTate

Post #11October 18, 2007, 8:47 PM UTC

See if this helps explain it.
http://www.mvps.org/winhelp2002/hosts2.htm

LDTate

Post #12October 21, 2007, 1:19 AM UTC

You still ned help?

tailight

Post #13October 22, 2007, 6:03 PM UTC

yeah still nothing happening. downloaded mvps but same thing is happening when i click open i am asked for open with but when i go into properties it tells me open with unknown application. i have both files downloaded to my desktop but cant open either

LDTate

Post #14October 22, 2007, 8:27 PM UTC

You need to UNZIP the file: Instructions here:
http://www.mvps.org/winhelp2002/hosts2.htm

tailight

Post #15October 23, 2007, 7:31 PM UTC

when i tried to unzip the file manually i was told that c:\windows\system32\drivers\etc had been moved or removed so i went into local disc c and got into the hosts file that way82.146.60.44 postbank.de
82.146.60.44 www.postbank.de
82.146.60.44 banking.postbank.de
82.146.60.44 direkt.postbank.de
82.146.60.44 www.smile.co.uk
82.146.60.44 smile.co.uk
82.146.60.44 cahoot.com
82.146.60.44 www.cahoot.com
82.146.60.44 www.cahoot.co.uk
82.146.60.44 cahoot.co.uk
82.146.60.44 www.co-operativebank.co.uk
82.146.60.44 co-operativebank.co.uk
82.146.60.44 www.co-operativebank.com
82.146.60.44 co-operativebank.com
82.146.60.44 personal.barclays.co.uk
82.146.60.44 barclays.co.uk
82.146.60.44 ibank.barclays.co.uk
82.146.60.44 www.barclays.co.uk
82.146.60.44 barclays.touchclarity.com
82.146.60.44 hsbc.co.uk
82.146.60.44 www.hsbc.co.uk
82.146.60.44 hsbc.touchclarity.com
82.146.60.44 www1.member-hsbc-group.com
82.146.60.44 lloydstsb.co.uk
82.146.60.44 www.lloydstsb.co.uk
82.146.60.44 lloydstsb.com
82.146.60.44 www.lloydstsb.com
82.146.60.44 mi.lloydstsb.com
82.146.60.44 www.woolwich.co.uk
82.146.60.44 woolwich.co.uk
82.146.60.44 www.deutsche-bank.de
82.146.60.44 deutsche-bank.de
82.146.60.44 meine.deutsche-bank.de
82.146.60.44 www.anbusiness.com
82.146.60.44 anbusiness.com
82.146.60.44 www.abbeyinternational.com
82.146.60.44 www.barclays.com
82.146.60.44 barclays.com
82.146.60.44 ibank.internationalbanking.barclays.com
82.146.60.44 offshore.hsbc.com
82.146.60.44 www.lloydstsb-offshore.com
82.146.60.44 lloydstsb-offshore.comLogfile of HijackThis v1.99.1
Scan saved at 21:38:04, on 23/10/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eircom.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8081
O1 - Hosts: 82.146.60.44 postbank.de
O1 - Hosts: 82.146.60.44 www.postbank.de
O1 - Hosts: 82.146.60.44 banking.postbank.de
O1 - Hosts: 82.146.60.44 direkt.postbank.de
O1 - Hosts: 82.146.60.44 www.smile.co.uk
O1 - Hosts: 82.146.60.44 smile.co.uk
O1 - Hosts: 82.146.60.44 cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.co.uk
O1 - Hosts: 82.146.60.44 cahoot.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.com
O1 - Hosts: 82.146.60.44 co-operativebank.com
O1 - Hosts: 82.146.60.44 personal.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.co.uk
O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk
O1 - Hosts: 82.146.60.44 www.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.touchclarity.com
O1 - Hosts: 82.146.60.44 hsbc.co.uk
O1 - Hosts: 82.146.60.44 www.hsbc.co.uk
O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com
O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com
O1 - Hosts: 82.146.60.44 lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.com
O1 - Hosts: 82.146.60.44 www.lloydstsb.com
O1 - Hosts: 82.146.60.44 mi.lloydstsb.com
O1 - Hosts: 82.146.60.44 www.woolwich.co.uk
O1 - Hosts: 82.146.60.44 woolwich.co.uk
O1 - Hosts: 82.146.60.44 www.deutsche-bank.de
O1 - Hosts: 82.146.60.44 deutsche-bank.de
O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de
O1 - Hosts: 82.146.60.44 www.anbusiness.com
O1 - Hosts: 82.146.60.44 anbusiness.com
O1 - Hosts: 82.146.60.44 www.abbeyinternational.com
O1 - Hosts: 82.146.60.44 www.barclays.com
O1 - Hosts: 82.146.60.44 barclays.com
O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com
O1 - Hosts: 82.146.60.44 offshore.hsbc.com
O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com
O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [iamapp] "C:\Program Files\Norton Internet Security\IAMAPP.EXE"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINNT\system32\mmsvc32.exe
O4 - HKLM\..\Run: [Spools Service Controller] C:\WINNT\system32\spools.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\spysub.exe
O9 - Extra button: Paddy Power Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\PADDYP~1\client.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{83C0D946-4CE8-42AE-8183-5A7B11C1D3A3}: NameServer = 213.94.190.235 213.94.190.195
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] computer very slow

✨ Ask AI

Ask AI