[demag]

Hi and Thanks for any help I get.

I have a Fujitsu Siemens Scaleo 1.8ghz P4. Upgraded to 512 mb pc133. 2 hdd Dual boot with Mepis Linux which is on the 2nd drive. ATI 9250 Graphics upgrade.

I bought this new about 2 years ago but over the last 6 months it has been starting to crawl. I only have 1 game on it Links Golf. I use it mainly for trading the Currency Markets.

A week ago the graphics crashed for no reason and I did have problems loading the drivers originally. Took the card out and replaced it all and it seems ok again. Original was Nvidia 64mb. No problems at all with that.

Typically takes 3-5 minutes to boot into Windows. I use grub loader. Linux boots a lot faster.
If I place my mouse over the Start, All Programs button it will take 30-40 seconds to populate the program file menu. If I click on a program some are fairly quick, others longer.

A couple of files and folders have played up recently denying me access. I have the dreaded Lexbce server unfortunately which screwed my printing up and I am denied access to that. I have done loads of scans and followed a lot of tips from here but no virus or malware was detected.

I ran scannow this morning and did an Xp fix which all went ok. I had to activate Xp again afterwards which I don't recall reading about I downloaded TuneUp Utilities and ran through that and although it sorted a load of stuff out, I still have problems.

I dl'd HJT but I haven't finished running all the Windows updates yet. It's just after 1am here now so I'll finish the updates while I'm in bed. Should be done for the morning.

I think thats about it anything else please ask.

Thanks.

[Advertisements]

Hello and Welcome to Geeks To Go

I think you are infected with malware, please read THIS and then if you are still heaving problems please post in the Malware Forum.

Also please read Easy XP Tweaks for ways to make your computer faster.

Edited by Michael Buckley, 22 October 2005 - 06:40 PM.

[Michael]

Hello and Welcome to Geeks To Go

I think you are infected with malware, please read THIS and then if you are still heaving problems please post in the Malware Forum.

Also please read Easy XP Tweaks for ways to make your computer faster.

Edited by Michael Buckley, 22 October 2005 - 06:40 PM.

[Johanna]

Michael Buckley:
Please state one reason why you suspect demag has a malware issue. Demag carefully listed the troubleshooting he has done, and sounds fairly comp savvy.

I have done loads of scans and followed a lot of tips from here but no virus or malware was detected.

If you don't know the answer to a question, you don't need to post. If you don't know what else to post, don't automatically direct people to the malware forum. XP has its quirks, and our job here on this forum is to rule out Windows issues before directing people to malware or hardware IF we have to, based on an educated guess. Troubleshooting is more than running malware scans.

demag, welcome to Geeks to Go! I'm curious what is running when you boot the computer. This program puts a tab in your Control Panel and you can enable or disable programs from start up without the bother of MSconfig.
http://www.mlin.net/StartupCPL.shtml

Take a look in your Device Manager for any error symbols or problems. The Event Logs in Admin Tools might hold some clues.

Also, visit PC Pitstop
http://www.pcpitstop.com/
and see what their suggestions are.

What exactly did you do when you ran scannow? Did you use your disk? I would like to know why it asked you to reactivate?? Do you have a regular XP cd or a "recovery disk"?

Johanna

[Michael]

Because his computer is just so slow. This is normaly caused by malware, so I sent him off to be cleaned. That is my point of view.

[demag]

Morning,

Adaware is still scanning but appears stalled on C:\System Volume Information\_restore{2F998D99-ED8C-46E5-B2E5-64BF5FE3759B}\RP32. Its been on the same file for more than 1hr now with very little hdd activity. Objects scanned 115640. I am leaving it to continue for now unless you tell me otherwise.

All Windows updates completed last night.

Ran scannow with the disk, took about ihr to complete. Activated Windows over the web no prob.

My original system disk was a Siemens Recovery disk so I bought a full system disk at a computer fair. It has sp2 on it.

At the moment Adaware is the only program I have running. Took a look at Device Manager, no probs at all.

Shall I leave Adaware running? Your Wish is my command!

Thanks,

demag.

[Michael]

I thing it has stoped responding if it has been on the same file for a hour. Have you tryed spybot search and destroy? Also what it you Anti Virus program? and have you run it to see if it finds anything?

[Johanna]

It's hung up on your System Restore points. If you turn SR off it will delete all the previous points, then turn it back on and make a new one. Sometimes corrupt or malicious files hide in SR (part of the protected Windows system files) and comes back if you use a restore point.

How do you connect to the internet, and what firewall do you use? Smart move buying a real XP cd.

Johanna

[demag]

Hi Both,

Sorry about the delay.

Ok, stopped Adaware, cleared restore points, rebooted, made new rp.

Installed Startup cpl.

Zone Alarm Pro f/w. AntiVir personal edition update weekly.

Internet is cable. I don't leave the pc running all the time

Right then, here we go!

Over the past few months I have run:

Registry Mechanic, Spysweeper, Spyware Doctor, Tuneup Utilities, Ace Utilities, Adaware, Spybot, Window Washer, PcPitstop scan and Mother Board Monitor besides doing scans with AntiVir and all I've ever picked up are a few tracking cookies. I also regularly check ports on GRC. I've also run through the Easy Tweaks from here but not messed with the registry. There maybe more I've forgotten about!

In the past though AntiVir has picked up Trojans on downloads from peer to peer. I then deleted restore points and re enabled.

When checking how to clear Lexbce on the web I thought maybe something was hiding there but I've picked up nothing on any scans.

I'll do the Adaware scan again.

Cheers,

demag.

[demag]

Adaware looks like its stalled again
C:\WINDOWS\system32\dllcache. Its got a bit further though, 124068 items scanned

[Johanna]

If you are concerned about AdAware, uninstall AdAware. Reboot. Download the latest version from their website, reinstall it, let it update, and try it again.

Are the the only complaints you have right now is that AdAware won't complete a scan, and general sluggishness of the system? Any freezing? Any errors? Any shut downs, or spontaneous reboots? Any BSODs?

Johanna

[demag]

Hi Again,

To be honest Johanna I'm not concerned about Adaware in the worrying sense.
I did download the latest version today and update and that was what locked up.
My main concern is I've obviously got a problem somewhere but am really puzzled about what it is.
The scans that I have managed to complete have all been inconclusive although they have picked up various problems.

I tried to do a Spybot scan earlier but it was really crawling along. I stopped it and will run it overnight.

No shutdowns of any kind, no BSOD's just very slow. Really any freezes are caused by my impatience trying to open programs and having to wait and pressing a few keys too fast or clicking the mouse too fast.
If I wait everything works, it just takes forever!

Just remembered! Idle process is always up around 98%! Sorry forgot to mention it.

Thanks.

[Michael]

I really want to know what you have running on you system, can you post a HiJack This log? Then I can see if you are infected, or work out what other process could be causing the problem. Opening Programs, and being impatient while doing so should never cause a computer to freeze.

By The Way Idle process tells you what your computer is not doing. That is, the amount of computer processing power that is not doing anything right now.

Edited by Michael Buckley, 23 October 2005 - 07:42 PM.

[demag]

I have something here!

Ran Spybot overnight, it came up with 40 cases of Smitfraud-C. What is that? Out of all the scans I have run, Spybot is the only one to pick that up.

Will post HJT soon

Cheers,

demag

[kd1966]

Post edited by mod: Murray

Thank you for your interest in helping with malware removal however, here at geekstogo, we have people specially trained in this art that handle ALL of our malware issues..

Should you feel you would like to train and learn about Malware removal, please go to the Off Topic forum and submit your application in the appropriate thread.

Murray

[demag]

Logfile of HijackThis v1.99.1
Scan saved at 19:40:25, on 24/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\MATCO\BuzzsawService\BuzzSawService.exe
C:\WINDOWS\system32\locator.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blueyonder.co.uk
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {A8482EAF-A1F3-4934-AE3F-56EB195A50BF} (DeskUpdate - Activex Control) - http://support.fujit...api/activex.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Buzzsaw_Defragmentation - MATCO - C:\Program Files\MATCO\BuzzsawService\BuzzSawService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hope this helps,

Thanks,

demag.