[Alex Mora]

Hello,

I have been experiencing lag on my desktop for quite some time but never really had the time to post the logs on here. As the Topic Title states, I am currently experiencing heavy lags during system start up as well as increased wait times for Mozilla loadings. If someone could please verify that I'm clean of all malware I would greatly appreciate it.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:31 PM, on 6/23/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Wireless-G USB Network Adapter with RangeBooster\WLService.exe
C:\Program Files\Wireless-G USB Network Adapter with RangeBooster\WUSB54GR.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.inc.com
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\printer.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [sclauncher] C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecu...asyInstallX.CAB
O20 - AppInit_DLLs: C:\WINDOWS\System32\stdole32.dat
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WUSB54GR - GEMTEKS - C:\Program Files\Wireless-G USB Network Adapter with RangeBooster\WLService.exe

--
End of file - 6274 bytes


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/23/2008 at 09:49 PM

Application Version : 4.15.1000

Core Rules Database Version : 3489
Trace Rules Database Version: 1480

Scan type : Complete Scan
Total Scan Time : 00:28:57

Memory items scanned : 378
Memory threats detected : 0
Registry items scanned : 4109
Registry threats detected : 0
File items scanned : 33732
File threats detected : 0

Adware.Tracking Cookie
www.entrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
www.entrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.atdmt.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.atlas.entrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.atlas.entrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.atlas.entrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.entrepreneur.122.2o7.net [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.youngentrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.youngentrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.youngentrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.youngentrepreneur.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xs2k8ev9.default\cookies.txt ]


Malwarebytes' Anti-Malware 1.17
Database version: 846

8:39:40 PM 6/23/2008
mbam-log-6-23-2008 (20-39-40).txt

Scan type: Quick Scan
Objects scanned: 35387
Time elapsed: 3 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Advertisements]

Hello and welcome to Geeks To Go! My name is BHowett and I will be helping you to get sorted.

Sorry for the delay, as you can tell we are very busy here. Ok let’s see what we need to do to get you sorted

Well your logs are not looking to bad so don’t worry to much You do have an infection and we will get to that, but first the thing that is using up all your resources, and slowing your computer is the fact that you are running two antivirus programs at the same time (avast & AVG7) Please pick the one you want to keep and uninstall the other (AVG 7 is being replaced with AVG8 very soon)

To uninstall one just go to Start > Control Panel > Add/Remove Programs and remove the what ever one you choose.

Now moving on to the infection……



ComboFix

Please visit below webpage for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. DO NOT select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Please post the log from ComboFix (located in C:\combofix.txt), and a fresh HijackThis log in your next reply.


Also let me know how things are running now

[BHowett]

Hello and welcome to Geeks To Go! My name is BHowett and I will be helping you to get sorted.

Sorry for the delay, as you can tell we are very busy here. Ok let’s see what we need to do to get you sorted

Well your logs are not looking to bad so don’t worry to much You do have an infection and we will get to that, but first the thing that is using up all your resources, and slowing your computer is the fact that you are running two antivirus programs at the same time (avast & AVG7) Please pick the one you want to keep and uninstall the other (AVG 7 is being replaced with AVG8 very soon)

To uninstall one just go to Start > Control Panel > Add/Remove Programs and remove the what ever one you choose.

Now moving on to the infection……



ComboFix

Please visit below webpage for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. DO NOT select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Please post the log from ComboFix (located in C:\combofix.txt), and a fresh HijackThis log in your next reply.


Also let me know how things are running now

[BHowett]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.