My apologies in advance if I am in the incorrect forum or making improper assumptions. I have posted to this forum previously and it has been a tremendous help. On prior occassions, I had obvious malware and one occassion Bugbatter and on another Bamajim helped me out. This time, however, the malware is not nearly as obvious, although the computer is running so slowly and so poorly that I suspect but cannot confirm that there is a malware issue. I ran a Hijack this log and it appears below. I also ran a C cleaner program a month or so ago on the basis of advice received in a prior experience with the forum, but frankly don't know if I did more harm than good. There is a good possibility that you cannot help and this old computer has had it, but in this economy I thought I would try the forum to se if I can straighten it out. Thanks.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:15:25 PM, on 3/30/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal
Welcome. Thank you for using Dell Community Forums.
I am reviewing your log. In the meantime, you can help me by addressing the following:
* Have you have posted this issue on another forum? If so, please provide a link to the topic.
* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly.
* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE.
* If you are using any P2P (file sharing) programs, please remove them before we clean your computer. The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a list HERE.
* If this computer belongs to someone else, do you have authority to apply the fixes we will use?
* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log.
* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures. Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.
* During the course of our cleanup please do not do any additional online work or surfing until we have verified that your system is clean.
* We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.
* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.
I look forward to your reply so we can begin cleaning. We can check for malware and perhaps find out if the problem is that or just "old age".
Instructions posted for this user are customized for this user only. The tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a log at the top of this board to start a new forum topic.
THANKS FOR YOUR REPLY. I HAVE PASTED PARTS OF YOUR EMAIL BELOW AND REPLIED TO YOUR QUESTIONS IN ALL CAPS.
"Welcome. Thank you for using Dell Community Forums.
I am reviewing your log. In the meantime, you can help me by addressing the following:
* Have you have posted this issue on another forum? If so, please provide a link to the topic. NO
* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly. HAVE NOT
* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE. NONE USED
* If you are using any P2P (file sharing) programs, please remove them before we clean your computer. The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a list HERE. NOT USING
* If this computer belongs to someone else, do you have authority to apply the fixes we will use? ITS MINE
* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log. DID NOT -- JUST RAN THE LOG. I DID RUN THE C CLEANER A WHILE AGO TO TRY TO SPEED IT UP A BIT AND DELETED WHAT I HOPED TO BE JUST EXCESS FILES.
I look forward to your reply so we can begin cleaning. We can check for malware and perhaps find out if the problem is that or just "old age". IF ITS NOT MALWARE, PERHAPS ITS OLD AGE OR JUST TOO MUCH "STUFF" . UNFORTUNATELY, WE ARE PACK RATS EVEN WHEN IT COMES TO COMPUTERS.
A small box will open, with an explanation about the tool.
Click Yes at the prompt for Optional Scan.
When done, DDS will open two (2) logs
1. DDS.txt 2. Attach.txt
Save both reports to your desktop.
Copy/paste both logs to your reply on the forum.
Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.
On another topic -- and you aren't going to believe my luck -- my laptop (the other computer in the house -- was just taken ovewr by MS 2009 and is now all locked up -- worse thatn the slow and old desktop. I am going to have to post that as well. I hope it won't be too confusing but with thisa one slow and that one siezed up, I'm gonna be out of commission!!
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-03-16.01)
Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 2/5/2005 11:44:42 AM System Uptime: 4/1/2009 8:44:56 PM (4 hours ago)
Motherboard: Dell Inc. | | 0M3918 Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz
==== Disk Partitions =========================
A: is Removable C: is FIXED (NTFS) - 71 GiB total, 48.46 GiB free. D: is CDROM () E: is CDROM () G: is Removable
==== Disabled Device Manager Items =============
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318} Description: Intel(R) 82915G/GV/910GL Express Chipset Family Device ID: PCI\VEN_8086&DEV_2782&SUBSYS_01811028&REV_04\3&172E68DD&0&11 Manufacturer: Intel Corporation Name: Intel(R) 82915G/GV/910GL Express Chipset Family PNP Device ID: PCI\VEN_8086&DEV_2782&SUBSYS_01811028&REV_04\3&172E68DD&0&11 Service: ialm
DDS (Ver_09-03-16.01) - NTFSx86 Run by MILISSA MURRAY at 0:06:04.70 on Thu 04/02/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.76 [GMT -4:00]
Here is the attach this log. Funny , I thought I posted it before. As for the other computer, I went back to a restore point and it works fine!! But you are correct, I really don't do as well as I should with security software. I have aol and rely on that and some standard windows stuff. I think I also have nortons load but it is probably out of date I ought to upgrade but to what? I would do a malwarebytes product if they had run of the mill security software becasue I like the fact that they offer their other programs for free. What's P2P?
Anyway -- here is the attach this log
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-03-16.01)
Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 2/5/2005 11:44:42 AM System Uptime: 4/2/2009 7:08:27 AM (18 hours ago)
Motherboard: Dell Inc. | | 0M3918 Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz
==== Disk Partitions =========================
A: is Removable C: is FIXED (NTFS) - 71 GiB total, 48.466 GiB free. D: is CDROM () E: is CDROM () G: is Removable
==== Disabled Device Manager Items =============
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318} Description: Intel(R) 82915G/GV/910GL Express Chipset Family Device ID: PCI\VEN_8086&DEV_2782&SUBSYS_01811028&REV_04\3&172E68DD&0&11 Manufacturer: Intel Corporation Name: Intel(R) 82915G/GV/910GL Express Chipset Family PNP Device ID: PCI\VEN_8086&DEV_2782&SUBSYS_01811028&REV_04\3&172E68DD&0&11 Service: ialm
RP432: 1/3/2009 9:34:36 AM - System Checkpoint RP433: 1/4/2009 10:28:09 AM - System Checkpoint RP434: 1/6/2009 12:11:11 AM - System Checkpoint RP435: 1/7/2009 8:04:47 AM - System Checkpoint RP436: 1/8/2009 8:17:00 AM - System Checkpoint RP437: 1/9/2009 10:11:24 PM - System Checkpoint RP438: 1/10/2009 10:39:03 PM - System Checkpoint RP439: 1/11/2009 10:40:05 PM - System Checkpoint RP440: 1/13/2009 1:16:44 AM - System Checkpoint RP441: 1/14/2009 1:53:53 AM - System Checkpoint RP442: 1/14/2009 3:00:23 AM - Software Distribution Service 3.0 RP443: 1/15/2009 3:11:30 AM - System Checkpoint RP444: 1/16/2009 6:02:13 AM - System Checkpoint RP445: 1/17/2009 8:39:29 AM - System Checkpoint RP446: 1/18/2009 9:11:53 AM - System Checkpoint RP447: 1/19/2009 9:15:03 AM - System Checkpoint RP448: 1/20/2009 9:40:05 AM - System Checkpoint RP449: 1/21/2009 11:41:59 AM - System Checkpoint RP450: 1/22/2009 12:56:15 PM - System Checkpoint RP451: 1/23/2009 1:09:44 PM - System Checkpoint RP452: 1/24/2009 1:18:41 PM - System Checkpoint RP453: 1/25/2009 1:46:05 PM - System Checkpoint RP454: 1/26/2009 8:09:04 PM - System Checkpoint RP455: 1/26/2009 11:15:52 PM - Removed Adobe Reader 7.0.9 RP456: 1/26/2009 11:17:59 PM - Removed Bonjour RP457: 1/26/2009 11:20:10 PM - Removed Easy CD Creator 5 Basic RP458: 1/26/2009 11:28:57 PM - Removed Microsoft Picture It! Express 9 RP459: 1/26/2009 11:30:02 PM - Removed Microsoft Picture It! Library 9 RP460: 1/27/2009 11:54:12 PM - Installed Adobe Reader 9. RP461: 1/28/2009 11:59:42 PM - System Checkpoint RP462: 1/30/2009 12:02:40 AM - System Checkpoint RP463: 1/31/2009 12:32:25 AM - System Checkpoint RP464: 2/1/2009 2:27:35 AM - System Checkpoint RP465: 2/2/2009 7:29:54 AM - System Checkpoint RP466: 2/3/2009 8:02:10 AM - System Checkpoint RP467: 2/4/2009 9:25:55 AM - System Checkpoint RP468: 2/5/2009 9:31:29 AM - System Checkpoint RP469: 2/6/2009 11:05:43 AM - System Checkpoint RP470: 2/7/2009 1:03:47 PM - System Checkpoint RP471: 2/8/2009 1:31:33 PM - System Checkpoint RP472: 2/9/2009 4:43:50 PM - System Checkpoint RP473: 2/11/2009 1:03:15 AM - System Checkpoint RP474: 2/11/2009 3:00:19 AM - Software Distribution Service 3.0 RP475: 2/12/2009 4:19:45 AM - System Checkpoint RP476: 2/12/2009 7:45:15 AM - Spybot-S&D Spyware removal RP477: 2/12/2009 9:09:10 AM - Installed MozyHome Remote Backup RP478: 2/12/2009 10:43:52 PM - Removed Google Toolbar for Internet Explorer RP479: 2/13/2009 1:00:27 AM - Spybot-S&D Spyware removal RP480: 2/14/2009 11:31:32 AM - System Checkpoint RP481: 2/15/2009 1:38:45 PM - System Checkpoint RP482: 2/16/2009 1:55:26 PM - System Checkpoint RP483: 2/17/2009 3:30:17 PM - System Checkpoint RP484: 2/22/2009 5:31:40 PM - System Checkpoint RP485: 2/23/2009 9:14:42 PM - System Checkpoint RP486: 2/24/2009 10:57:46 PM - System Checkpoint RP487: 2/25/2009 3:00:24 AM - Software Distribution Service 3.0 RP488: 2/26/2009 7:41:05 AM - System Checkpoint RP489: 2/27/2009 12:19:46 PM - System Checkpoint RP490: 2/28/2009 2:07:58 PM - System Checkpoint RP491: 3/1/2009 2:20:01 PM - System Checkpoint RP492: 3/2/2009 3:07:31 PM - System Checkpoint RP493: 3/3/2009 3:54:59 PM - System Checkpoint RP494: 3/4/2009 5:26:08 PM - System Checkpoint RP495: 3/5/2009 3:00:25 AM - Software Distribution Service 3.0 RP496: 3/6/2009 7:09:17 AM - System Checkpoint RP497: 3/7/2009 7:28:52 AM - System Checkpoint RP498: 3/8/2009 12:24:06 PM - System Checkpoint RP499: 3/9/2009 6:55:24 PM - System Checkpoint RP500: 3/11/2009 6:47:57 AM - System Checkpoint RP501: 3/11/2009 9:56:26 AM - Software Distribution Service 3.0 RP502: 3/12/2009 7:30:41 PM - System Checkpoint RP503: 3/13/2009 10:56:26 PM - System Checkpoint RP504: 3/14/2009 2:00:27 AM - Software Distribution Service 3.0 RP505: 3/15/2009 5:11:03 AM - System Checkpoint RP506: 3/16/2009 8:28:49 AM - System Checkpoint RP507: 3/17/2009 9:21:32 AM - System Checkpoint RP508: 3/18/2009 10:57:17 AM - System Checkpoint RP509: 3/19/2009 11:42:21 AM - System Checkpoint RP510: 3/20/2009 11:50:33 AM - System Checkpoint RP511: 3/21/2009 1:51:02 PM - System Checkpoint RP512: 3/22/2009 2:32:06 PM - System Checkpoint RP513: 3/23/2009 5:06:09 PM - System Checkpoint RP514: 3/25/2009 7:31:59 AM - System Checkpoint RP515: 3/26/2009 8:05:47 AM - System Checkpoint RP516: 3/27/2009 8:44:58 AM - System Checkpoint RP517: 3/28/2009 11:47:50 AM - System Checkpoint RP518: 3/29/2009 12:44:43 PM - System Checkpoint RP519: 3/30/2009 2:11:52 PM - System Checkpoint RP520: 3/31/2009 4:56:03 PM - System Checkpoint RP521: 4/1/2009 9:34:02 PM - System Checkpoint RP522: 4/2/2009 11:12:34 PM - System Checkpoint
==== Installed Programs ======================
Acrobat.com Adobe Flash Player 10 ActiveX Adobe Reader 9 Adobe Shockwave Player AiO_Scan_CDA AiOSoftwareNPI AOL Toolbar AOL Uninstaller (Choose which Products to Remove) Apple Mobile Device Support Apple Software Update B57Inst Broadcom Driver Installer BufferChm C6100 c6100_Help CCleaner (remove only) Citrix Web Client CP_CalendarTemplates1 cp_OnlineProjectsConfig CP_Package_Basic1 CP_Panorama1Config cp_PosterPrintConfig CueTour CustomerResearchQFolder Defraggler (remove only) Dell Picture Studio - Dell Image Expert Dell ResourceCD Destinations DeviceManagementQFolder DIGOpt DIGReqEx DivX Web Player DocProc DocProcQFolder DocumentViewer DocumentViewerQFolder Download Updater (AOL LLC) eSupportQFolder Fax_CDA FullDPAppQFolder Google Earth HijackThis 2.0.2 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows XP (KB952287) HP Customer Participation Program 7.0 HP Document Viewer 7.0 HP Imaging Device Functions 7.0 HP Photosmart Premier Software 6.5 HP Photosmart, Officejet and Deskjet 7.0.A HP Solution Center 7.0 HP Update HPPhotoSmartExpress HPProductAssistant InstantShareDevices InstantShareDevicesMFC Intel(R) Graphics Media Accelerator Driver Intel(R) PRO Network Adapters and Drivers iTunes J2SE Runtime Environment 5.0 Update 5 J2SE Runtime Environment 5.0 Update 6 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) 6 Update 5 Malwarebytes' Anti-Malware MarketResearch MathPlayer McAfee SecurityCenter Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2000 Professional Microsoft VC9 runtime libraries MozyHome Remote Backup MSN MSN Encarta Plus Support Files MSN Music Assistant MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) Musicnotes Player V1.22.3 My Web Search (Cursor Mania) NewCopy_CDA Norton PC Checkup OCR Software by I.R.I.S 7.0 OpenOffice.org Installer 1.0 Paint Shop Pro 7 PanoStandAlone PhotoGallery Picasa Picasa 2 ProductContextNPI QMusic 2.5 QuickTime QuickTime for Windows (32-bit) RandMap Readme RealPlayer Basic Scan ScannerCopy Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) SkinsHP1 SlideShow SolutionCenter Sonic_PrimoSDK SoundMAX Spybot - Search & Destroy Spybot - Search & Destroy 1.5.2.20 Status Toolbox TrayApp Unload Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) VC80CRTRedist - 8.0.50727.762 Verizon Online Support Center Viewpoint Media Player WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 7 Windows Live installer Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format Runtime Windows Media Player 10 Windows XP Service Pack 3 WinZip 11.2 Yahoo! Toolbar
==== Event Viewer Messages From Past Week ========
3/28/2009 5:59:53 PM, error: Dhcp [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 00111139D570 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 3/28/2009 4:54:17 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 3/28/2009 4:43:48 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 30 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 3/30/2009 10:46:15 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 00111139D570 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
And because I do think I've posted the attach this log twice, here is the other DDS log.
DDS (Ver_09-03-16.01) - NTFSx86 Run by MILISSA MURRAY at 1:26:53.96 on Fri 04/03/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.80 [GMT -4:00]
Please disable TeaTimer: Go to Start>Run. Type Msconfig > OK. On the next window that opens > Startup tab UNcheck the entry for TeaTimer until this is over... 1. Open Spybot 2. Click Mode -> Advanced Mode 3. Click Yes 4. Click Tools (located in the bottom left corner) -> Resident 5. Uncheck 'Resident "TeaTimer" (Protection of over-all system settings) active' 6. Then close Spybot. Reboot. Verify that TeaTimer is not running. After ALL cleaning of your system has been completed and we have confirmed that your computer is clean, reverse these steps and re-enable the protection applets for TeaTimer.
Please update your Malwarebytes' Anti-Malware and run a Full Scan. Please post that log along with a fresh Hijackthis log.
Thanks . We moved today so I will be out of comission until our connection is back up. It might be a couple of days but I will be back to you as soon as I can.
Bugbatter
4 Apprentice
•
20487 Posts
444
0
Posted March 31st, 2009 15:00
Welcome. Thank you for using Dell Community Forums.
I am reviewing your log. In the meantime, you can help me by addressing the following:
* Have you have posted this issue on another forum? If so, please provide a link to the topic.
* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly.
* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE.
* If you are using any P2P (file sharing) programs, please remove them before we clean your computer. The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a list HERE.
* If this computer belongs to someone else, do you have authority to apply the fixes we will use?
* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log.
* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures. Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.
* During the course of our cleanup please do not do any additional online work or surfing until we have verified that your system is clean.
* We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.
* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.
I look forward to your reply so we can begin cleaning. We can check for malware and perhaps find out if the problem is that or just "old age".
Instructions posted for this user are customized for this user only. The tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a log at the top of this board to start a new forum topic.