[Resolved] Help! Strange popup, slow computer, both on and of

Hi coolcat, welcome to the forum.

Please be advised, as I'm still in training, all my replies will have to be approved by a teacher or expert before I can post them. This may cause some delays, but I will do my best to keep them as short as possible.

To make cleaning this machine easier

• Please do not uninstall/install any programs unless asked to
  It is more difficult when files/programs are appearing in/disappearing from the logs.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
• Do not attach any logs/reports, etc.. unless specifically requested to do so.
• If you have problems with or do not understand the instructions, Please ask before continuing.

I will post back soon with additional instructions.


Thanks

HI coolcat,

Let's see if we can find out what's going on.

Download Rooter.exe to your desktop

• Then doubleclick it to start the tool
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have installed Windows). Post that in your next reply.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:

• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

Thanks

OK, I hope I did this correctly…. 📎Attach.txtMicrosoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz ) BIOS : BIOS Date: 08/11/05 03:05:08 Ver: 08.00.10 USER : Sony ( Administrator ) BOOT : Normal boot Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated) C:\ (Local Disk) - NTFS - Total:180 Go (Free:143 Go) D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go) E:\ (CD or DVD) F:\ (USB) G:\ (USB) H:\ (USB) I:\ (USB) Sun 01/04/2009|19:19 ———————-\\ Search.. ———————-\\ Cracks & Keygens.. C:\DOCUME~1\Sony\My Documents\My Pictures\PixAroundHomeIL\Standard_Oil_Cracking_Unit_1969_for_web.jpg 1 - "C:\Rooter$\Rooter_1.txt" - Sun 01/04/2009|19:21 ———————-\\ Scan completed at 19:21 —————————————————————————- DDS (Version 1.1.0) - NTFSx86 Run by [removed] at 19:22:53.36 on Sun 01/04/2009 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.200 [GMT -6:00] AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\AOL\1147670399\ee\AOLSoftware.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\America Online 9.0a\waol.exe C:\Program Files\America Online 9.0a\shellmon.exe C:\Program Files\America Online 9.0a\aolwbspd.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Documents and Settings\Sony\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com uSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html mDefault_Page_URL = hxxp://www.sony.com/vaiopeople mDefault_Search_URL = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com mSearch Page = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com mSearchAssistant = hxxp://www.google.com/ie BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [HostManager] c:\program files\common files\aol\1147670399\ee\AOLSoftware.exe mRun: [Pure Networks Port Magic] "c:\progra~1\purene~1\portma~1\PortAOL.exe" -Run mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [AlcWzrd] ALCWZRD.EXE mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe mRun: [CreateCD_Reminder] c:\windows\sonysys\vaio recovery\reminder.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [AOLDialer] "c:\program files\common files\aol\acs\AOLDial.exe" mRun: [VAIO Update 3] "c:\program files\sony\vaio update 3\VAIOUpdt.exe" /Stationary mRun: [Alcmtr] ALCMTR.EXE mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe mRun: [SSC_UserPrompt] c:\program files\common files\symantec shared\security center\UsrPrmpt.exe mRun: [PC Pitstop Optimize2 Reminder] c:\program files\pcpitstop\optimize2\Reminder.exe mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\aol91t~1.lnk - c:\program files\america online 9.0a\aoltray.exe IE: &AOL; Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html IE: Transfer by Image Converter 2 - c:\program files\sony\image converter 2\menu.htm IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: akamai.net\a248.e Trusted Zone: bitdefender.com Trusted Zone: bitdefender.com\www Trusted Zone: google.com\www Trusted Zone: kaspersky.com\www Trusted Zone: netflame.cc\ssl-hints Trusted Zone: parlophone.co.uk\queenforum Trusted Zone: sprintpcs.com\sso Trusted Zone: trendmicro.com\housecall65 TCP: {8080BB7D-C9C3-4417-A14B-52EAEEDBD30F} = 205.188.146.145 Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ============= SERVICES / DRIVERS =============== R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2008-12-23 11840] R3 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2008-12-23 151297] R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-12-23 52032] R4 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-10-29 587096] R4 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2008-12-23 68865] R4 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -svaio_vedb –> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -sVAIO_VEDB [?] S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.exe -i vaio_vedb –> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.EXE -i VAIO_VEDB [?] ============== File Associations =============== regfile=regedit.exe "%1" %* =============== Created Last 30 ================ 2009-01-04 19:19 –d—– C:\Rooter$ 2008-12-23 16:12 –d—– C:\Sony Bios 2008-12-23 14:07 –d—– c:\program files\Avira 2008-12-23 14:07 –d—– c:\docume~1\alluse~1\applic~1\Avira 2008-12-23 06:32 –d—– c:\docume~1\sony\applic~1\MySpace 2008-12-23 06:32 –d—– c:\program files\MySpace ==================== Find3M ==================== 2008-12-03 19:52 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-03 19:52 15,504 a——- c:\windows\system32\drivers\mbam.sys 2008-11-10 05:43 410,984 a——- c:\windows\system32\deploytk.dll 2006-05-24 17:29 37,311,488 a——- c:\program files\iTunesSetup.exe 2006-02-19 22:11 1,931,216 a——- c:\program files\SetupSonyDownloadTaxi.exe 2006-02-18 01:33 58,368 a——- c:\program files\MFInstall.exe 2006-02-15 22:17 10,420,936 a——- c:\program files\xlviewer.exe 2006-02-15 22:05 12,307,656 a——- c:\program files\wdviewer.exe 2006-02-15 22:02 1,951,432 a——- c:\program files\ppviewer.exe 2006-02-15 21:55 2,817,536 a——- c:\program files\ica32t.exe 2006-02-15 21:54 7,789,851 a——- c:\program files\rpv40plgIEu.exe ============= FINISH: 19:23:28.32 ===============

Hi Coolcat,

You will need to disable Spybot's Tea Timer function, if it is running, as it may interfere. - this is a two step process.
First step:

• Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
• If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
• If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

• Open Spybot S&D
• Click Mode, choose Advanced Mode
• Go To the bottom of the Vertical Panel on the Left, Click Tools
• then, also in left panel, click Resident shows a red/white shield.
• If your firewall raises a question, say OK
• In the Resident protection status frame, Uncheck the box labelled Resident "Tea-Timer"(Protection of over-all system settings) active
• OK any prompts.
• Use File, Exit to terminate Spybot
• Reboot your machine fully for the changes to take effect.

You have several old vulnerable versions of Java installed. Please go to add/remove programs and uninstall the following

J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 7
Java™ SE Runtime Environment 6 Update 1

DO NOT uninstall Java™ 6 Update 11

Next, Open HJT, do a systemscan only. Checkmark the following lines, if present

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.6.0_10) -


Close all other browsers/windows and click fix checked. Close HJT.

Next Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.

• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Note your computer may boot a little slower the first couple of times.

You have Malwarebytes' Anti-Malware installed so we will do a scan with it.

Start the program then click the update tab, click update

• If an update is found, it will download and install the latest version.
• After the update, if any, click the Scanner tab, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with the MBAM log and a new HJT log. Please tell me what is happening on your computer.

Thanks

Sorry for the delay. I can not get SpyBot to do what you ask it to do. I am going to uninstall it for the time being while I do all these scans, then reinstall. I'll be back shortly.

Hi Coolcat, You still with us? Thanks

Yes, I'm so sorry. I lost my job on Tuesday and things are very hectic and I'm freaking out. I'll get it done by tomorrow! Thanks for your patience!

You asked what the computer was doing. It has been running very slow, also just hanging and freezing so I have to unplug it to reboot because often, that's the only way I can get it to shut down. I see there was malware found. My son is constantly on MySpace and had downloaded their Instant Message application which I deleted/uninstalled right before I came here and created this thread. Thanks

Hi Coolcat,

Yes, I'm so sorry. I lost my job on Tuesday and things are very hectic and I'm freaking out. I'll get it done by tomorrow! Thanks for your patience!

Bummer. That's ok, I'm not going anywhere.

All MBAM found was one stray registry key. Are you still getting that popup?

I need you to check for a file.

Please download FileLook by jpshortstuff from one of these mirrors:
Link 1
Link 2

• Double-click FileLook.exe to run it.
• Ensure that the BBCode Ouput checkbox is checked.
• Copy the content of the following codebox into the main textfield:
  
  

  C:\Program Files\Java\jre6\bin\jp2iexp.dll

• Click the FileLook button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at C:\FileLook.txt


Then fix these lines with HJT.

Open HJT, do a system scan only. Checkmark the following lines, if present

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -

Close all other browsers/windows and click fix checked.

We'll see if we can speed you up somewhat. There are a few optional fixes you can do that may improve system preformance. These fixes will not remove the program, will just stop it from starting at startup. A link and some info as to what it does is provided for each.

To impliment the optional fixes, open HJT (hijackthis), run a system scan only. Checkmark the ones you wish to keep from running at startup, close all other browsers/windows and click "Fix Checked"

Do Not fix any other lines, as that may cause problems.

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
http://www.systemlookup.com/Startup/4268-HPWuSchd2_exe.html

O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
http://www.systemlookup.com/Startup/9790-PortAOL_exe.html

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
http://www.systemlookup.com/Startup/11442-soundman_exe.html

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
http://www.systemlookup.com/lists.php?list…=AlcWzrd&s=

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
http://www.systemlookup.com/Startup/9914-Qttask_exe.html

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
http://www.systemlookup.com/lists.php?list…IgfxTray&s=

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
http://www.systemlookup.com/Startup/4145-H…ortcut_exe.html

O4 - HKLM\..\Run: [AOLDialer] "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"
http://www.systemlookup.com/lists.php?list…OLDialer&s=

O4 - HKLM\..\Run: [PC Pitstop Optimize2 Reminder] C:\Program Files\PCPitstop\Optimize2\Reminder.exe
http://www.systemlookup.com/Startup/18363-Reminder_exe.html

O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\CommonFiles\InstallShield\UpdateService\ISUSPM.exe" -scheduler
http://www.systemlookup.com/lists.php?list…h=ISUSPM&s=

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
http://www.systemlookup.com/Startup/11949-jusched_exe.html

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
http://www.systemlookup.com/Startup/18427-mbamgui_exe.html

Any improvement? Please post a new HJT log and the FileLook results.

Thanks

Hi Coolcat,

Any improvement?

You missed an l when you copied C:\Program Files\Java\jre6\bin\jp2iexp.dll for the file search. Please rerun FileLook, be sure to copy the entire text.

Then Go here to run an online scannner from ESET:
http://www.eset.eu/online-scanner

(Note: You must use Internet Explorer for this scan.)

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
• Click Start
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
• Click Scan.
• Wait for the scan to finish.
• Re-enable your Antivirus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. We will need this later.

Please post back with the ESET log and a new HJT log.

Thanks

Hi Coolcat,

Any improvement?

You missed an l when you copied C:\Program Files\Java\jre6\bin\jp2iexp.dll for the file search. Please rerun FileLook, be sure to copy the entire text.

Then Go here to run an online scannner from ESET:
http://www.eset.eu/online-scanner

(Note: You must use Internet Explorer for this scan.)

Hi,

No, I didn't *miss* a letter. I did that scan 3 times and checked the exact file extension each time I did it. I have no idea why it did what it did but no matter what I do, when the test results come back (immediately) I can see that the 2nd l is missing from the path and I don't know what else to do about it.

Hi Coolcat,

I'll check with the program's author, may be a bug. Let's try this…do the search for

jp2iexp.dll

Thanks