[Closed] No longer the fast computer I loved!

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Any other problems apart from slowness?

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Thanks.

Than you so much for your help. The only other thing I've noticed is that some programs will just shut down by themselves. But yes it's running very slowly. Here is the info you've asked for. DDS (Version 1.0) - NTFSx86 Run by [removed] at 11:06:12.71 on Mon 11/17/2008 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.152 [GMT -7:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Parallels\Parallels Tools\cohrence.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Parallels\Parallels Tools\ParallelsToolsCenter.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICFA.EXE c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Parallels\Parallels Tools\toolsrv.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Psuedo HJT Report =============== uStart Page = hxxp://www.aol.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe uRun: [EPSON Stylus CX9400Fax Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticfa.exe /fu "c:\windows\temp\E_SF32.tmp" /EF "HKCU" uRun: [RIMDeviceManager] "c:\program files\common files\research in motion\rimdevicemanager\RIMDeviceManager.exe" -RunServer mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe mRun: [Parallels Tools] c:\program files\parallels\parallels tools\ParallelsToolsCenter.exe mRun: [SharedInternetApplication] "c:\program files\parallels\parallels tools\sia\sharedintapp.exe" /start mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R1 PrlNP;PrlNP;c:\windows\system32\drivers\prlfs.sys [2007-6-28 138368] R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;"c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe" [2008-1-11 30312] R2 cohrence;Parallels Coherence Service;"c:\program files\parallels\parallels tools\cohrence.exe" [2007-6-28 53342] R2 MSSQL$REPLICONEXPRESS;SQL Server (REPLICONEXPRESS);"c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe" -sREPLICONEXPRESS [2008-2-26 29183504] R2 prl_paravirt_32;Parallels Paravirtualization Driver;\??\c:\windows\system32\drivers\prl_paravirt_32.sys [2008-1-9 14953] R2 PrlTime;Parallels Time Synchronization Driver;\??\c:\windows\system32\drivers\PrlTime.sys [2007-6-28 2546] R2 toolsrv;Parallels Tools Utility Service;c:\program files\parallels\parallels tools\toolsrv.exe [2007-6-28 90112] R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\program files\microsoft sql server\mssql.2\mssql\binn\sqlservr.exe" -sMSSMLBIZ [2008-2-26 29183504] R3 PCITG;PCITG;c:\windows\system32\drivers\pcitg.sys [2007-6-28 15232] R3 prleth;Parallels Network Adapter;c:\windows\system32\drivers\prleth.sys [2007-6-28 6112] R3 PrlMouse;Parallels Mouse Synchronization Tool;c:\windows\system32\drivers\PrlMouse.sys [2007-6-28 5337] R3 PrlVideo;PrlVideo;c:\windows\system32\drivers\PrlVideo.sys [2007-6-28 16384] S3 NtApm;NT Apm/Legacy Interface Driver;c:\windows\system32\drivers\NtApm.sys [2007-6-28 9344] S3 RimSerPort;RIM Virtual Serial Port;c:\windows\system32\drivers\RimSerial.sys [2007-8-21 26496] =============== Created Last 30 ================ 2008-11-16 14:51 455,296 -c—— c:\windows\system32\dllcache\mrxsmb.sys 2008-11-16 14:49 1,106,944 -c—— c:\windows\system32\dllcache\msxml3.dll 2008-11-16 13:10 –d—– c:\program files\Trend Micro 2008-10-26 08:33 333,824 -c—— c:\windows\system32\dllcache\srv.sys 2008-10-26 08:32 1,846,400 -c—— c:\windows\system32\dllcache\win32k.sys 2008-10-26 08:31 2,145,280 -c—— c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-26 08:31 2,189,184 -c—— c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-26 08:31 2,023,936 -c—— c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-26 08:31 2,066,048 -c—— c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-26 08:26 337,408 -c—— c:\windows\system32\dllcache\netapi32.dll ==================== Find3M ==================== 2008-10-26 09:04 –d—– c:\docume~1\owner\applic~1\MSN6 2008-10-26 07:57 –d—– c:\program files\McAfee 2008-10-02 10:43 –d—– c:\program files\Messenger 2008-10-02 07:58 76,487 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-10-02 07:48 –d—– c:\program files\Windows NT 2008-10-01 08:51 –d—– c:\program files\common files\Research In Motion 2008-09-15 05:12 1,846,400 a——- c:\windows\system32\win32k.sys 2008-09-09 18:14 1,307,648 a——- c:\windows\system32\msxml6.dll 2008-09-05 07:11 –d—– c:\docume~1\owner\applic~1\McAfee 2008-09-04 10:15 1,106,944 a——- c:\windows\system32\msxml3.dll 2008-08-26 00:24 826,368 a——- c:\windows\system32\wininet.dll 2008-08-22 18:06 –d—– c:\docume~1\alluse~1\applic~1\~0 2008-08-15 08:47 –d—– c:\docume~1\alluse~1\applic~1\Viewpoint 2008-06-23 00:09 –d—– c:\docume~1\owner\applic~1\MSNInstaller 2008-06-22 11:33 –d—– c:\docume~1\owner\applic~1\Snapfish 2008-03-16 20:21 –d—– c:\docume~1\alluse~1\applic~1\EPSON 2008-02-16 15:34 –d—– c:\docume~1\owner\applic~1\Downloaded Installations 2008-01-18 21:00 –d—– c:\docume~1\alluse~1\applic~1\Awem 2008-01-18 20:59 –d—– c:\docume~1\alluse~1\applic~1\Trymedia 2008-01-18 19:30 –d—– c:\docume~1\owner\applic~1\FaxCtr 2008-01-17 16:03 –d—– c:\docume~1\owner\applic~1\Download Manager 2008-01-09 16:26 –d—– c:\docume~1\owner\applic~1\Parallels 2007-10-18 08:46 –d—– c:\docume~1\owner\applic~1\funkitron 2007-10-10 13:24 –d—– c:\docume~1\owner\applic~1\Stamps.com Internet Postage 2007-09-12 19:39 –d—– c:\docume~1\alluse~1\applic~1\MumboJumbo 2007-09-12 19:37 –d—– c:\docume~1\owner\applic~1\PlayFirst 2007-09-12 19:37 –d—– c:\docume~1\alluse~1\applic~1\PlayFirst 2007-09-11 21:34 –d—– c:\docume~1\owner\applic~1\Acoustica 2007-09-03 12:16 –d—– c:\docume~1\alluse~1\applic~1\NCH Swift Sound 2007-09-03 12:12 –d—– c:\docume~1\owner\applic~1\NCH Swift Sound 2007-08-21 10:26 –d—– c:\docume~1\owner\applic~1\Research In Motion 2007-07-14 20:22 –d—– c:\docume~1\owner\applic~1\eFax Messenger 2007-07-07 21:49 –d—– c:\docume~1\owner\applic~1\MySpace 2007-06-28 16:07 –d—– c:\docume~1\owner\applic~1\4200Series 2007-06-28 15:21 –d—– c:\docume~1\alluse~1\applic~1\MSN6 ============= FINISH: 11:07:14.94 ===============

Hi.

Open HijackThis. Hit Do A System Scan Only. Place a check next to the following items (if present):
R3 - URLSearchHook: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)

Close all browsers and windows except for HijackThis and click Fix Checked.


Let's see what programs we can get rid of. Click Start >> Control Panel >> Add/Remove Programs.

First of all, you can get rid of these old versions of Java:
J2SE Runtime Environment 5.0 Update 11
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ SE Runtime Environment 6 Update 1
(Make sure you leave Java™ 6 Update 7 as this is the latest)

Remove the following unless you installed/use them:
Viewpoint Media Player
WebFldrs XP

P2P programs like Ares Ultra 4.0. can cause a computer to become infected as you don't know where the stuff you are downloading is coming from, and who has had a chance to tamper with it. I would recommend you remove any P2P programs like this from your computer, but it's your choice.

Have a look down the list yourself, if you see anything else that you don't use then get rid of it.


A fantastic guide for slow computers can be found here:
http://www.malwareremoval.com/tutorials/runningslowly.php


Let's just have one last check for Malware.

Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply, along with a fresh HijackThis log.

Thanks.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log