Slow computer: Here are HijackThis results please help

Question

Logfile of HijackThis v1.99.0 Scan saved at 7:48:19 PM, on 23/01/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32
etdde.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\cisvc.exe C:\WINNT\system32\clipsrv.exe C:\WINNT\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\PROGRA~1\SYMPAT~1\ACCESS~1\app\pppoeservice.exe C:\WINNT\system32egsvc.exe C:\WINNT\System32svp.exe C:\WINNT\System32\SCardSvr.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32	lntsvr.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\WFXSVC.EXE C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\dmadmin.exe C:\WINNT\System32\locator.exe C:\PROGRA~1\Adaptec\DirectCD\directcd.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINNT\system32\wfxsnt40.exe C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\System32\cidaemon.exe C:\PROGRA~1\SYMPAT~1\ACCESS~1\app\EnterNet.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINNT\system32\windll32.exe C:\WINNT\system32	askmgr.exe C:\hjt\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe O4 - HKLM\..\Run: [RSPC Driver D] eijym.exe O4 - HKLM\..\Run: [Sygate Personal AntiVir] ctfs.exe O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINNT\system32\defragfatz.exe O4 - HKLM\..\Run: [Microsoft Security Management] winamp.exe O4 - HKLM\..\Run: [Windows Task Manager] wintask.exe O4 - HKLM\..\Run: [Sygate Personal Firewall Start] servic.exe O4 - HKLM\..\Run: [System CPL manager] ebrwsil.exe O4 - HKLM\..\Run: [Sygate Personal Block] Studio.exe O4 - HKLM\..\Run: [CPVHOST Settings] cpvhost.exe O4 - HKLM\..\Run: [Windows AdTools] C:\Program Files\Windows AdTools\WinAdTools.exe O4 - HKLM\..\Run: [Start Uppings] svcchosts.exe O4 - HKLM\..\Run: [XPCPHOST Settings] xpcphost.exe O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] windll32.exe O4 - HKLM\..\Run: [systemstart.exe] systemstart.exe O4 - HKLM\..\Run: [Windows Online Updater] dllman.exe O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe' O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [Zone Labs Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r O4 - HKLM\..\RunServices: [RSPC Driver D] eijym.exe O4 - HKLM\..\RunServices: [Sygate Personal AntiVir] ctfs.exe O4 - HKLM\..\RunServices: [Microsoft Security Management] winamp.exe O4 - HKLM\..\RunServices: [Windows Task Manager] wintask.exe O4 - HKLM\..\RunServices: [Sygate Personal Firewall Start] servic.exe O4 - HKLM\..\RunServices: [System CPL manager] ebrwsil.exe O4 - HKLM\..\RunServices: [Sygate Personal Block] Studio.exe O4 - HKLM\..\RunServices: [CPVHOST Settings] cpvhost.exe O4 - HKLM\..\RunServices: [Start Uppings] svcchosts.exe O4 - HKLM\..\RunServices: [XPCPHOST Settings] xpcphost.exe O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] windll32.exe O4 - HKLM\..\RunServices: [Windows Online Updater] dllman.exe O4 - HKLM\..\RunServices: [systemstart.exe] systemstart.exe O4 - HKCU\..\Run: [Sygate Personal AntiVir] ctfs.exe O4 - HKCU\..\Run: [Sygate Personal Firewall Start] servic.exe O4 - HKCU\..\Run: [RSPC Driver D] eijym.exe O4 - HKCU\..\Run: [Windows Task Manager] wintask.exe O4 - HKCU\..\Run: [System CPL manager] ebrwsil.exe O4 - HKCU\..\Run: [Sygate Personal Block] Studio.exe O4 - HKCU\..\Run: [CPVHOST Settings] cpvhost.exe O4 - HKCU\..\Run: [Start Uppings] svcchosts.exe O4 - HKCU\..\Run: [XPCPHOST Settings] xpcphost.exe O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] windll32.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINNT\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: PPPoE Service - Unknown - C:\PROGRA~1\SYMPAT~1\ACCESS~1\app\pppoeservice.exe O23 - Service: Trend Micro Real-time Service - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe O23 - Service: WinFax PRO - Symantec Corporation - C:\WINNT\system32\WFXSVC.EXE

Midnight Star · Answer

milandm,

Let's see what we can do...

Go to www.trendmicro.com, and then:

1. Click " Free Online Scan".
2. Click " Scan now, it's free".

It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:

1. Select all available drives.
2. Check(tick) " Auto Clean".
3. Click " Scan".

When it completes, post back the full filename of any files that cannot be cleaned or deleted.

Go to Add/Remove programs and remove(uninstall) the following, if present:

Web Related
Anything with ' search' in the entry that you didn't install.
Anything with ' toolbar' in the entry

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

Run HiJackThis then:

1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"

-

Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

C:\WINNT\system32\windll32.exe

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O4 - HKLM\..\Run: [RSPC Driver D] eijym.exe
O4 - HKLM\..\Run: [Sygate Personal AntiVir] ctfs.exe
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINNT\system32\defragfatz.exe
O4 - HKLM\..\Run: [Microsoft Security Management] winamp.exe
O4 - HKLM\..\Run: [Windows Task Manager] wintask.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall Start] servic.exe
O4 - HKLM\..\Run: [System CPL manager] ebrwsil.exe
O4 - HKLM\..\Run: [Sygate Personal Block] Studio.exe
O4 - HKLM\..\Run: [CPVHOST Settings] cpvhost.exe
O4 - HKLM\..\Run: [Windows AdTools] C:\Program Files\Windows AdTools\WinAdTools.exe
O4 - HKLM\..\Run: [Start Uppings] svcchosts.exe
O4 - HKLM\..\Run: [XPCPHOST Settings] xpcphost.exe
O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] windll32.exe
O4 - HKLM\..\Run: [systemstart.exe] systemstart.exe
O4 - HKLM\..\Run: [Windows Online Updater] dllman.exe
O4 - HKLM\..\RunServices: [RSPC Driver D] eijym.exe
O4 - HKLM\..\RunServices: [Sygate Personal AntiVir] ctfs.exe
O4 - HKLM\..\RunServices: [Microsoft Security Management] winamp.exe
O4 - HKLM\..\RunServices: [Windows Task Manager] wintask.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall Start] servic.exe
O4 - HKLM\..\RunServices: [System CPL manager] ebrwsil.exe
O4 - HKLM\..\RunServices: [Sygate Personal Block] Studio.exe
O4 - HKLM\..\RunServices: [CPVHOST Settings] cpvhost.exe
O4 - HKLM\..\RunServices: [Start Uppings] svcchosts.exe
O4 - HKLM\..\RunServices: [XPCPHOST Settings] xpcphost.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] windll32.exe
O4 - HKLM\..\RunServices: [Windows Online Updater] dllman.exe
O4 - HKLM\..\RunServices: [systemstart.exe] systemstart.exe
O4 - HKCU\..\Run: [Sygate Personal AntiVir] ctfs.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall Start] servic.exe
O4 - HKCU\..\Run: [RSPC Driver D] eijym.exe
O4 - HKCU\..\Run: [Windows Task Manager] wintask.exe
O4 - HKCU\..\Run: [System CPL manager] ebrwsil.exe
O4 - HKCU\..\Run: [Sygate Personal Block] Studio.exe
O4 - HKCU\..\Run: [CPVHOST Settings] cpvhost.exe
O4 - HKCU\..\Run: [Start Uppings] svcchosts.exe
O4 - HKCU\..\Run: [XPCPHOST Settings] xpcphost.exe
O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] windll32.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm

Now, with all windows closed except HiJackThis, click " Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Program Files\Windows AdTools

files...

C:\WINNT\system32\windll32.exe

Post back a new log.

-

Mike.

Milandm · Answer

The results of your help this morning are below. Thank you. Anything further I should be concerned about? Logfile of HijackThis v1.99.0 Scan saved at 11:29:51 AM, on 24/01/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32
etdde.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\cisvc.exe C:\WINNT\system32\clipsrv.exe C:\WINNT\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\PROGRA~1\SYMPAT~1\ACCESS~1\app\pppoeservice.exe C:\WINNT\system32egsvc.exe C:\WINNT\System32svp.exe C:\WINNT\System32\SCardSvr.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32	lntsvr.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\WFXSVC.EXE C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\dmadmin.exe C:\WINNT\System32\locator.exe C:\PROGRA~1\Adaptec\DirectCD\directcd.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINNT\system32\wfxsnt40.exe C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\System32\cidaemon.exe C:\Program Files\Qualcomm\Eudora\Eudora.exe C:\PROGRA~1\SYMPAT~1\ACCESS~1\app\EnterNet.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\hjt\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe' O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [Zone Labs Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINNT\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: PPPoE Service - Unknown - C:\PROGRA~1\SYMPAT~1\ACCESS~1\app\pppoeservice.exe O23 - Service: Trend Micro Real-time Service - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe O23 - Service: WinFax PRO - Symantec Corporation - C:\WINNT\system32\WFXSVC.EXE

Midnight Star · Answer

Milandm,

Good work! That log looks good to me? Is everything running ok? Did the virus scan turn anything up?

Now if everything is running ok, let's do some cleanup...

1. Run " Disk Cleanup" and allow it to remove everything it finds.

2. Go to www.trendmicro.com and click " Free Online Scan", then " Scan now, it's free!". When it's downloaded, select all available drives, then check(tick) " Auto clean", then click " Scan".

3. Run AdAware SE Personal and " perform a full system scan", then Spybot S&D, and " Check for Problems". Let them both remove the residual 'problems' left that HiJackThis couldn't fix.

4. Disable, then re-enable system restore; with a reboot in-between. Then immediately create a new system point manually.

If your having any more problems, post back.

-

Your welcome,

Mike.

Virus & Spyware

Slow computer: Here are HijackThis results please help

Was this post helpful?