Hijack This Log file

Question

hi, i've been trouble with my computer which has periodically been slowing down.  It'll start up fine, but it slows down every few seconds.  At first I figured it must be spyware, so I downloaded a few programs, adaware, windows defender, and pctools spyware doctor.  Ran Mcafee virus scan a few times-even tried toolbar cop.  They all worked to a certain degree, unfortunately the computer is still slowing down so I figure there must be something else running in the background which is degrading performance.  Anyway, here's my hijackthis log.  Let me know what you think.   Logfile of HijackThis v1.99.1Scan saved at 8:30:56 PM, on 6/7/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\STOPzilla!\szserver.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exec:\program files\mcafee.com\agent\mcdetect.exec:\PROGRA~1\mcafee.com\vso\mcshield.exec:\PROGRA~1\mcafee.com\agent\mctskshd.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Spyware Doctor\svcntaux.exeC:\Program Files\Spyware Doctor\swdsvc.exeC:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\SlySoft\CloneCD\CloneCDTray.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Spyware Doctor\SDTrayApp.exeC:\Program Files\McAfee.com\VSO\mcvsshld.exeC:\Program Files\McAfee.com\VSO\oasclnt.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\STOPzilla!\STOPzilla.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\Program Files\Java\jre1.5.0_07\bin\jusched.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\ctfmon.exeC:\Ares\Ares.exeC:\Program Files\Common Files\AOL\1146701222\ee\aolsoftware.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Google\Google Updater\GoogleUpdater.exec:\progra~1\mcafee.com\vso\mcvsftsn.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN Messenger\usnsvc.exeC:\Program Files\Java\jre1.5.0_07\bin\jucheck.exec:\program files\common files\aol\1146701222\ee\anotify.exeC:\WINDOWS\system32\mdm.exeC:\Program Files\iTunes\iTunes.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\msiexec.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Spyware Doctor\swdoctor.exeC:\Documents and Settings\John Tripi\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: (no name) - -{02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)O2 - BHO: (no name) - -{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)O2 - BHO: (no name) - -{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)O2 - BHO: (no name) - -{7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: (no name) - -{AA58ED58-01DD-4D91-8333-CF10577473F7} - (no file)O2 - BHO: (no name) - -{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)O2 - BHO: (no name) - -{E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO3 - Toolbar: (no name) - -{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O3 - Toolbar: (no name) - -{2318C2B1-4965-11D4-9B18-009027A5CD4F} - (no file)O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46C4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [CloneCDTray] 'C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe' /sO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [SDTray] 'C:\Program Files\Spyware Doctor\SDTrayApp.exe'O4 - HKLM\..\Run: [VSOCheckTask] 'C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exeO4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exeO4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hideO4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostartO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe'O4 - HKCU\..\Run: [Aim6] 'C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe' /d locale=en-US ee://aol/imAppO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /backgroundO4 - HKCU\..\Run: [ares] 'C:\Ares\Ares.exe' -hO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exeO4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exeO4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\John Tripi\Start Menu\Programs\Absolute Poker\Absolute Poker.lnkO9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\John Tripi\Start Menu\Programs\Absolute Poker\Absolute Poker.lnkO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exeO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO11 - Options group: [INTERNATIONAL] International*O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cabO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cabO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cabO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO20 - Winlogon Notify: STOPzilla - C:\WINDOWS\SYSTEM32\IS3WLHandler.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exeO23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exeO23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exeO23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe' -d -f '%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exeO23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exeO23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeO23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\szserver.exe

bamajim · Answer

Mrtripi

Not much showing up in your log except some empty junk

1. Rerun Hiajckthis (scan only) and place checks beside the following entries

O2 - BHO: (no name) - -{02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - -{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O2 - BHO: (no name) - -{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - -{7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - -{AA58ED58-01DD-4D91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - -{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - -{E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O3 - Toolbar: (no name) - -{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - -{2318C2B1-4965-11D4-9B18-009027A5CD4F} - (no file)

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis ->>Reboot your PC

2. *NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!

Download CCleaner from here to clean temp files from your computer.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
Click on the "Options" icon at the left side of the window, then click on "Advanced." deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.

3. Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log and give me an update on how your PC is running now

bamajim Graduate of MRU

CastleCops Instructor

Mrtripi · Answer

--------------------------------------------------------------------------------------------------- Also here's the latest Hijackthis log file       Logfile of HijackThis v1.99.1 Scan saved at 12:30:43 AM, on 6/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\mcafee.com\vso\OasClnt.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\program files\mcafee.com\vso\mcvsshld.exe C:\WINDOWS\system32
vsvc32.exe c:\program files\mcafee.com\agent\mcagent.exe C:\Program Files\Spyware Doctor\svcntaux.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\STOPzilla!\STOPzilla.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Common Files\AOL\1146701222\ee\aolsoftware.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Java\jre1.5.0_07\bin\jucheck.exe C:\Program Files\Windows NT\Accessories\WORDPAD.EXE C:\Program Files\Windows NT\Accessories\WORDPAD.EXE C:\Program Files\Rhapsody provided by Optimum Onlinehaphlpr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Apple Software Update\SoftwareUpdate.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE c:\program files\common files\aol\1146701222\ee\anotify.exe C:\WINDOWS\system32\mdm.exe C:\Documents and Settings\John Tripi\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: (no name) - -{E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O3 - Toolbar: (no name) - -{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O3 - Toolbar: (no name) - -{2318C2B1-4965-11D4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46C4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [CloneCDTray] 'C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe' /s O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [SDTray] 'C:\Program Files\Spyware Doctor\SDTrayApp.exe' O4 - HKLM\..\Run: [VSOCheckTask] 'C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostart O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe' O4 - HKCU\..\Run: [Aim6] 'C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe' /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O4 - HKCU\..\Run: [ares] 'C:\Ares\Ares.exe' -h O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\John Tripi\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\John Tripi\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: ToolbarCop - {A349A035-E26F-454b-ABB4-5208E50E1BE7} - C:\Documents and Settings\John Tripi\Desktop\Toolbarcop.exe (HKCU) O9 - Extra 'Tools' menuitem: ToolbarCop - {A349A035-E26F-454b-ABB4-5208E50E1BE7} - C:\Documents and Settings\John Tripi\Desktop\Toolbarcop.exe (HKCU) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: STOPzilla - C:\WINDOWS\SYSTEM32\IS3WLHandler.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe' -d -f '%ProgramFiles%\WinPcappcapd.ini (file missing) O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\szserver.exe         You'll notice I couldn't delete the toolbar (noname) entries.  That's because they kept reinstalling themselves.  Any suggestions?

Mrtripi · Answer

no good, my computer still gets extremely slow at times-to the point wherei have to wait for it to react whenever I click on icons. I've tried everything, defragging, scandisk, I uninstalled a few programs thinking they where conflicting or slowing down the system but no good. I was also wondering if my problem could stem from the Internet Explorer browser itself. I'm beginning to suspect the browser is actually corrupt since it use to display odd text in the titlebar until I installed StopZilla and used ToolbarCop to disable a few things. Another side note-Safe mode works great.

---------------------------ToolbarCop clipboard--------------------------------------

----------------------------------------
ToolbarCop
Browser Extension
{A349A035-E26F-454B-ABB4-5208E50E1BE7}
C:\Documents and Settings\John Tripi\Desktop\Toolbarcop.exe
Enabled
Current User
----------------------------------------
n/a
Browser Extension
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
Disabled
All Users
----------------------------------------
Absolute Poker
Browser Extension
{13C1DBF6-7535-495C-91F6-8C13714ED485}
C:\Documents and Settings\John Tripi\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
Disabled
All Users
----------------------------------------
Yahoo! Services
Browser Extension
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
C:\Program Files\Yahoo!\Common\yiesrvc.dll
Disabled
All Users
----------------------------------------
n/a
Browser Extension
{E2E2DD38-D088-4134-82B7-F2BA38496583}
%windir%\Network Diagnostic\xpnetdiag.exe
Disabled
All Users
----------------------------------------
Yahoo! Messenger
Browser Extension
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
Disabled
All Users
----------------------------------------
Messenger
Browser Extension
{FB5F1910-F110-11D2-BB9E-00C04F795683}
C:\Program Files\Messenger\msmsgs.exe
Disabled
All Users
----------------------------------------
&Address
Toolbar
{01E04581-4EEE-11D0-BFE9-00AA005B4383}
%SystemRoot%\system32\browseui.dll
Enabled
Current User
----------------------------------------
&Links
Toolbar
{0E5CBF21-D15F-11D0-8301-00AA005B4383}
%SystemRoot%\system32\SHELL32.dll
Enabled
Current User
----------------------------------------
Yahoo! Toolbar
Toolbar
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
Disabled
Current User
----------------------------------------
(Empty)
Toolbar
{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}
(empty)
Disabled
Current User
----------------------------------------
&Google
Toolbar
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
c:\program files\google\googletoolbar2.dll
Disabled
Current User
----------------------------------------
Yahoo! Toolbar
Toolbar
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
Disabled
All Users
----------------------------------------
&Google
Toolbar
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
c:\program files\google\googletoolbar2.dll
Disabled
All Users
----------------------------------------
McAfee VirusScan
Toolbar
{BA52B914-B692-46C4-B683-905236F6F655}
c:\progra~1\mcafee.com\vso\mcvsshl.dll
Enabled
All Users
----------------------------------------
STOPzilla Browser Helper Object
BHO
{E3215F20-3212-11D6-9F8B-00D0B743919D}
C:\Program Files\STOPzilla!\SZIEBHO.dll
Disabled
All Users
----------------------------------------
Adobe PDF Reader Link Helper
BHO
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
Enabled
All Users
----------------------------------------
&Search
Menu Extension

http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk762MAUS
Disabled
Current User
----------------------------------------
&Yahoo! Search
Menu Extension

file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
Disabled
Current User
----------------------------------------
Add to Google Photos Screensa&ver
Menu Extension

res://C:\WINDOWS\system32\GPhotos.scr/200
Disabled
Current User
----------------------------------------
Yahoo! &Dictionary
Menu Extension

file:///C:\Program Files\Yahoo!\Common/ycdict.htm
Disabled
Current User
----------------------------------------
Yahoo! &Maps
Menu Extension

file:///C:\Program Files\Yahoo!\Common/ycmap.htm
Disabled
Current User
----------------------------------------
Yahoo! &SMS
Menu Extension

file:///C:\Program Files\Yahoo!\Common/ycsms.htm
Disabled
Current User
----------------------------------------
Aim6
Run - Startup

"C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
Enabled
Current User
----------------------------------------
ctfmon.exe
Run - Startup

C:\WINDOWS\system32\ctfmon.exe
Enabled
Current User
----------------------------------------
msnmsgr
Run - Startup

"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
Enabled
Current User
----------------------------------------
ares
Run - Startup

"C:\Ares\Ares.exe" -h
Enabled
Current User
----------------------------------------
AdobeUpdater
Run - Startup

C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
Enabled
Current User
----------------------------------------
MCUpdateExe
Run - Startup

c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
Enabled
All Users
----------------------------------------
NvCplDaemon
Run - Startup

RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Enabled
All Users
----------------------------------------
MCAgentExe
Run - Startup

c:\PROGRA~1\mcafee.com\agent\mcagent.exe
Enabled
All Users
----------------------------------------
CloneCDTray
Run - Startup

"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
Enabled
All Users
----------------------------------------
QuickTime Task
Run - Startup

"C:\Program Files\QuickTime\qttask.exe" -atboottime
Enabled
All Users
----------------------------------------
iTunesHelper
Run - Startup

"C:\Program Files\iTunes\iTunesHelper.exe"
Enabled
All Users
----------------------------------------
SDTray
Run - Startup

"C:\Program Files\Spyware Doctor\SDTrayApp.exe"
Enabled
All Users
----------------------------------------
VSOCheckTask
Run - Startup

"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
Enabled
All Users
----------------------------------------
VirusScan Online
Run - Startup

C:\Program Files\McAfee.com\VSO\mcvsshld.exe
Enabled
All Users
----------------------------------------
OASClnt
Run - Startup

C:\Program Files\McAfee.com\VSO\oasclnt.exe
Enabled
All Users
----------------------------------------
STOPzilla
Run - Startup

C:\Program Files\STOPzilla!\STOPzilla.exe /autostart
Enabled
All Users
----------------------------------------
SunJavaUpdateSched
Run - Startup

"C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe"
Enabled
All Users
----------------------------------------
TkBellExe
Run - Startup

"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Enabled
All Users
----------------------------------------
Adobe Reader Speed Launcher
Run - Startup

"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Enabled
All Users
----------------------------------------
ares
Run - Startup

"C:\Ares\Ares.exe" -h
Disabled
Current User
----------------------------------------
BitTorrent
Run - Startup

"C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
Disabled
Current User
----------------------------------------
TkBellExe
Run - Startup

"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Disabled
All Users
----------------------------------------
IE Search Band
Explorer Bar - Vertical
{30D02401-6A81-11D0-8274-00C04FD5AE38}
C:\WINDOWS\system32\ieframe.dll
Enabled
All Users
----------------------------------------
&Tip of the Day
Explorer Bar - Horizontal
{4D5C8C25-D075-11D0-B416-00C04FB90376}
%SystemRoot%\system32\shdocvw.dll
Enabled
All Users
----------------------------------------
File Search Explorer Band
Explorer Bar - Vertical
{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
%SystemRoot%\system32\SHELL32.dll
Enabled
All Users
----------------------------------------
Favorites Band
Explorer Bar - Vertical
{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
%SystemRoot%\system32\shdocvw.dll
Enabled
All Users
----------------------------------------
History Band
Explorer Bar - Vertical
{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
%SystemRoot%\system32\shdocvw.dll
Enabled
All Users
----------------------------------------
Explorer Band
Explorer Bar - Vertical
{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
%SystemRoot%\system32\shdocvw.dll
Enabled
All Users

bamajim · Answer

Mrtripi

You'll notice I couldn't delete the toolbar (noname) entries. That's because they kept reinstalling themselves. Any suggestions?

Toolbar cop might be preventing their removal.

I still don't see anything malware/spyware related in your log.

Let's check one more thing

Please RIGHT-CLICK HERE and Save As (in IE it's "Save Target As") to download Silent Runners.

Save it to the desktop.
Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
You will see a text file appear on the desktop - it's not done, let it run (it won't appear to be doing anything!)
Once you receive the prompt "All Done!", double-click the new text file on the desktop, copy that entire log, and paste it here.

*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.

bamajim Graduate of MRU

CastleCops Instructor

Mrtripi · Answer

'Silent Runners.vbs', revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by '{++}' Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} 'Aim6' = ''C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe' /d locale=en-US ee://aol/imApp' ['America Online, Inc.'] 'ctfmon.exe' = 'C:\WINDOWS\system32\ctfmon.exe' [MS] 'msnmsgr' = ''C:\Program Files\MSN Messenger\msnmsgr.exe' /background' [MS] 'AdobeUpdater' = 'C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe' ['Adobe Systems Incorporated'] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} 'MCUpdateExe' = 'c:\PROGRA~1\mcafee.com\agent\mcupdate.exe' ['McAfee, Inc'] 'NvCplDaemon' = 'RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup' [MS] 'MCAgentExe' = 'c:\PROGRA~1\mcafee.com\agent\mcagent.exe' ['McAfee, Inc'] 'CloneCDTray' = ''C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe' /s' ['SlySoft, Inc.'] 'QuickTime Task' = ''C:\Program Files\QuickTime\qttask.exe' -atboottime' ['Apple Computer, Inc.'] 'iTunesHelper' = ''C:\Program Files\iTunes\iTunesHelper.exe'' ['Apple Inc.'] 'SDTray' = ''C:\Program Files\Spyware Doctor\SDTrayApp.exe'' ['PC Tools'] 'VSOCheckTask' = ''C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe' /checktask' ['McAfee, Inc.'] 'VirusScan Online' = 'C:\Program Files\McAfee.com\VSO\mcvsshld.exe' ['McAfee, Inc.'] 'OASClnt' = 'C:\Program Files\McAfee.com\VSO\oasclnt.exe' ['McAfee, Inc.'] 'STOPzilla' = 'C:\Program Files\STOPzilla!\STOPzilla.exe /autostart' ['International Software Systems Solutions'] 'SunJavaUpdateSched' = ''C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe'' ['Sun Microsystems, Inc.'] 'TkBellExe' = ''C:\Program Files\Common Files\Real\Update_OB\realsched.exe'  -osboot' ['RealNetworks, Inc.'] 'Adobe Reader Speed Launcher' = ''C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'' ['Adobe Systems Incorporated'] HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\ {++} '(Default)' = '(empty string)' [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)   -> {HKLM...CLSID} = 'Adobe PDF Reader Link Helper'                    \InProcServer32\(Default) = 'C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll' ['Adobe Systems Incorporated'] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ '{42071714-76d4-11d1-8b24-00a0c9068ff3}' = 'Display Panning CPL Extension'   -> {HKLM...CLSID} = 'Display Panning CPL Extension'                    \InProcServer32\(Default) = 'deskpan.dll' [file not found] '{88895560-9AA2-1069-930E-00AA0030EBC8}' = 'HyperTerminal Icon Ext'   -> {HKLM...CLSID} = 'HyperTerminal Icon Ext'                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\hticons.dll' ['Hilgraeve, Inc.'] '{1CDB2949-8F65-4355-8456-263E7C208A5D}' = 'Desktop Explorer'   -> {HKLM...CLSID} = 'Desktop Explorer'                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\nvshell.dll' ['NVIDIA Corporation'] '{1E9B04FB-F9E5-4718-997B-B8DA88302A47}' = 'Desktop Explorer Menu'   -> {HKLM...CLSID} = (no title provided)                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\nvshell.dll' ['NVIDIA Corporation'] '{1E9B04FB-F9E5-4718-997B-B8DA88302A48}' = 'nView Desktop Context Menu'   -> {HKLM...CLSID} = 'nView Desktop Context Menu'                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\nvshell.dll' ['NVIDIA Corporation'] '{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}' = 'My Logitech Pictures'   -> {HKLM...CLSID} = 'My Logitech Pictures'                    \InProcServer32\(Default) = 'C:\Program Files\Logitech\Video\Namespc2.dll' ['Logitech Inc.'] '{5464D816-CF16-4784-B9F3-75C0DB52B499}' = 'Yahoo! Mail'   -> {HKLM...CLSID} = 'YMailShellExt Class'                    \InProcServer32\(Default) = 'C:\PROGRA~1\Yahoo!\Common\ymmapi.dll' ['Yahoo! Inc.'] '{B7056B8E-4F99-44f8-8CBD-282390FE5428}' = 'VirtualCloneDrive'   -> {HKLM...CLSID} = 'VirtualCloneDrive Shell Extension'                    \InProcServer32\(Default) = 'C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll' ['Elaborate Bytes AG'] '{B41DB860-8EE4-11D2-9906-E49FADC173CA}' = 'WinRAR shell extension'   -> {HKLM...CLSID} = 'WinRAR'                    \InProcServer32\(Default) = 'C:\Program Files\WinRAR\rarext.dll' [null data] '{A70C977A-BF00-412C-90B7-034C51DA2439}' = 'NvCpl DesktopContext Class'   -> {HKLM...CLSID} = 'DesktopContext Class'                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\nvcpl.dll' ['NVIDIA Corporation'] '{FFB699E0-306A-11d3-8BD1-00104B6F7516}' = 'Play on my TV helper'   -> {HKLM...CLSID} = 'NVIDIA CPL Extension'                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\nvcpl.dll' ['NVIDIA Corporation'] '{cc86590a-b60a-48e6-996b-41d25ed39a1e}' = 'Portable Media Devices Menu'   -> {HKLM...CLSID} = 'Portable Media Devices Menu'                    \InProcServer32\(Default) = 'C:\WINDOWS\system32\Audiodev.dll' [MS] '{7C9D5882-CB4A-4090-96C8-430BFE8B795B}' = 'Webroot Spy Sweeper Context Menu Integration'   -> {HKLM...CLSID} = 'Webroot Spy Sweeper Context Menu Integration'                    \InProcServer32\(Default) = 'C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll' [file not found] '{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}' = 'Shell Extensions for RealOne Player'   -> {HKLM...CLSID} = 'RealOne Player Context Menu Class'                    \InProcServer32\(Default) = 'C:\Program Files\Real\RealPlayer\rpshell.dll' ['RealNetworks, Inc.'] '{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}' = 'Messenger Sharing Folders'   -> {HKLM...CLSID} = 'My Sharing Folders'                    \InProcServer32\(Default) = 'C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll' [MS] '{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}' = 'iTunes'   -> {HKLM...CLSID} = 'iTunes'                    \InProcServer32\(Default) = 'C:\Program Files\iTunes\iTunesMiniPlayer.dll' ['Apple Inc.'] '{6B19FEC2-A45B-11CF-9045-00A0C9039735}' = 'Registered ActiveX Controls'   -> {HKLM...CLSID} = 'Registered ActiveX Controls'                    \InProcServer32\(Default) = 'C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\DEVXPGL.DLL' [MS] '{D545EBD1-BD92-11CF-8772-00A0C9039735}' = 'Developer Studio Components'   -> {HKLM...CLSID} = 'Developer Studio Components'                    \InProcServer32\(Default) = 'C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\DEVXPGL.DLL' [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ < > STOPzilla\DLLName = 'IS3WLHandler.dll' ['ISSS Inc.'] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = 'PDF Column Info'   -> {HKLM...CLSID} = 'PDF Shell Extension'                    \InProcServer32\(Default) = 'C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll' ['Adobe Systems, Inc.'] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = '{B41DB860-8EE4-11D2-9906-E49FADC173CA}'   -> {HKLM...CLSID} = 'WinRAR'                    \InProcServer32\(Default) = 'C:\Program Files\WinRAR\rarext.dll' [null data] Yahoo! Mail\(Default) = '{5464D816-CF16-4784-B9F3-75C0DB52B499}'   -> {HKLM...CLSID} = 'YMailShellExt Class'                    \InProcServer32\(Default) = 'C:\PROGRA~1\Yahoo!\Common\ymmapi.dll' ['Yahoo! Inc.'] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = '{B41DB860-8EE4-11D2-9906-E49FADC173CA}'   -> {HKLM...CLSID} = 'WinRAR'                    \InProcServer32\(Default) = 'C:\Program Files\WinRAR\rarext.dll' [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ SpySweeper\(Default) = '{7C9D5882-CB4A-4090-96C8-430BFE8B795B}'   -> {HKLM...CLSID} = 'Webroot Spy Sweeper Context Menu Integration'                    \InProcServer32\(Default) = 'C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll' [file not found] WinRAR\(Default) = '{B41DB860-8EE4-11D2-9906-E49FADC173CA}'   -> {HKLM...CLSID} = 'WinRAR'                    \InProcServer32\(Default) = 'C:\Program Files\WinRAR\rarext.dll' [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SpySweeper\(Default) = '{7C9D5882-CB4A-4090-96C8-430BFE8B795B}'   -> {HKLM...CLSID} = 'Webroot Spy Sweeper Context Menu Integration'                    \InProcServer32\(Default) = 'C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll' [file not found] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ 'NoActiveDesktopChanges' = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Prohibit changes} 'DisableLocalUserRun' = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ 'NoActiveDesktopChanges' = (REG_DWORD) hex:0x00000000 {unrecognized setting} 'DisableLocalMachineRun' = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ 'NoDispAppearancePage' = (REG_DWORD) hex:0x00000000 {unrecognized setting} 'NoDispBackgroundPage' = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Hide Desktop tab} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ 'shutdownwithoutlogon' = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} 'undockwithoutlogon' = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ 'Wallpaper' = 'C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp' Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ 'Wallpaper' = 'C:\Documents and Settings\John Tripi\Local Settings\Application Data\Microsoft\Wallpaper1.bmp' Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ 'SCRNSAVE.EXE' = 'C:\WINDOWS\system32\FIREPL~1.SCR' (Fireplace_3D_Screensaver.scr) ['3Planesoft'] Startup items in 'John Tripi' & 'All Users' startup folders: ------------------------------------------------------------ C:\Documents and Settings\All Users\Start Menu\Programs\Startup 'Google Updater' -> shortcut to: 'C:\Program Files\Google\Google Updater\GoogleUpdater.exe -systray -startup' ['Google'] 'Service Manager' -> shortcut to: 'C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe /n' [MS]

Mrtripi · Answer

and the other half

Enabled Scheduled Tasks:
------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."]
"McAfee.com Scan for Viruses - My Computer (MAIN-John Tripi)" -> launches: "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe /runtask:0" ["McAfee, Inc."]
"Norton Security Scan" -> launches: "C:\Program Files\Norton Security Scan\Nss.exe /scan-full /scheduled" ["Symantec Corporation"]

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{BA52B914-B692-46C4-B683-905236F6F655}" = (no title provided)
-> {HKLM...CLSID} = "McAfee VirusScan"
\InProcServer32\(Default) = "c:\progra~1\mcafee.com\vso\mcvsshl.dll" ["McAfee, Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{A349A035-E26F-454B-ABB4-5208E50E1BE7}\
"ButtonText" = "ToolbarCop"
"MenuText" = "ToolbarCop"
"Exec" = "C:\Documents and Settings\John Tripi\Desktop\Toolbarcop.exe" [null data]

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_07"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll" ["Sun Microsystems, Inc."]

{13C1DBF6-7535-495C-91F6-8C13714ED485}\
"ButtonText" = "Absolute Poker"
"MenuText" = "Absolute Poker"
"Exec" = "C:\Documents and Settings\John Tripi\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk" [null data]

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\
"ButtonText" = "Yahoo! Services"
"CLSIDExtension" = "{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}"
-> {HKLM...CLSID} = "Yahoo! IE Services Button"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Common\yiesrvc.dll" ["Yahoo! Inc."]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\
"ButtonText" = "Yahoo! Messenger"
"MenuText" = "Yahoo! Messenger"
"Exec" = "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" ["Yahoo! Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
< > "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" ["Yahoo! Inc."]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Google Updater Service, gusvc, ""C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"" ["Google"]
iPod Service, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]
McAfee Task Scheduler, McTskshd.exe, "c:\PROGRA~1\mcafee.com\agent\mctskshd.exe" ["McAfee, Inc"]
McAfee WSC Integration, McDetect.exe, "c:\program files\mcafee.com\agent\mcdetect.exe" ["McAfee, Inc"]
McAfee.com McShield, McShield, "c:\PROGRA~1\mcafee.com\vso\mcshield.exe" ["McAfee Inc."]
Messenger Sharing Folders USN Journal Reader service, usnjsvc, ""C:\Program Files\MSN Messenger\usnsvc.exe"" [MS]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Spyware Doctor Auxiliary Service, sdAuxService, "C:\Program Files\Spyware Doctor\svcntaux.exe" ["PC Tools"]
Spyware Doctor Service, sdCoreService, "C:\Program Files\Spyware Doctor\swdsvc.exe" ["PC Tools"]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
LIDIL hpzll463\Driver = "hpzll463.dll" ["Hewlett-Packard Company"]

----------
< >: Suspicious data at a malware launch point.
< >: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 128 seconds, including 18 seconds for message boxes)

Note that I've run a series of scans and disabled a few add-ons since my last post. The most I've found are some Ares malware and a series of tracers, but still nothing major for the most part. The system is actually running smooth right now but it tends to only slow down during certain times. Is it possible I have a trojan which is only active during certain times of the day?

bamajim · Answer

Mrtripi

Note that I've run a series of scans and disabled a few add-ons since my last post. The most I've found are some Ares malware and a series of tracers, but still nothing major for the most part. The system is actually running smooth right now but it tends to only slow down during certain times. Is it possible I have a trojan which is only active during certain times of the day?

1. The program Ares you mentioned, is a P2P file sharing program. Most of us in the anti spyware/malware community consider P2P programs to be risky at best. Since they allow 2 way communication, it leaves a door open for infection. Caution should be used with these programs. Some things you may consider
a. They should never be left on unless in use at the time.
b. They shoud never be run on Startup.

You have yours set to run on Startup. To stop this

Rerun Hijackthis (scan only) and place a check beside the follwoing entry

O4 - HKCU\..\Run: [ares] "C:\Ares\Ares.exe" -h

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis and reboot your PC

2. As far as the question regarding a trojan; yes it is possible for a trojan to become active at certain times, but I see no signs of a trojan infection on your PC.

bamajim Graduate of MRU

Mrtripi · Answer

thanks for all your help, I've figured out what the problem was though.  I'm running an Inspiron 5150 labtop computer.  I've had issues in the past with dust clinging to the heatsink since the cpu is located so close to the vent(which dell decided to place under the labtop facing the desk).  As a matter of fact I've had the labtop replaced 3 times since I bought it and I assumed they would have fixed the apparent design flaw by now-unfortunately I'll have to resolve it myself by spraying compressed air in the back every now and then.    The program i used to measure the temperature of the cpu is called I8KFanGUI.exe-it also displays your cpu speed which thanks to speedswitch will drop to nearly half it's normal speed (3ghz-1.5ghz) whenever the cpu heats up too much.  This unfortunately leads to fluctuations in speed which make the system 'freeze up' every now and then.  Again-thanks for all the help, at the very least my computer should be free of malware/spyware/trojans/etc etc.

Virus & Spyware

Hijack This Log file

Was this post helpful?