« previous next »
Pages: [1]

Author Topic: runnimg slow/new user account made by it self?  (Read 1523 times)

Offline Aaron40002

  • Newbie
  • *
  • Posts: 47
  • Karma: +0/-0
    • View Profile
runnimg slow/new user account made by it self?
« on: July 17, 2006, 02:17:53 AM »
well in the last few days ive noticed the computer slowing down and then today it was running funky and denieing other accounts access to some things i checked user accounts and it some mac machine limited user account and no one useing this computer made it so i deleted it and i thought id post here to see if u notice something going on with it adware dident show anything niether did zonealarm


Logfile of HijackThis v1.99.1
Scan saved at 1:13:40 AM, on 7/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "F:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc...aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
runnimg slow/new user account made by it self?
« Reply #1 on: July 18, 2006, 11:35:51 PM »
Are you still having problems?

Can I also see the following
Download GMER from here:
http://www.gmer.net/gmer.zip

Unzip it to the desktop and start GMER.exe
Click the Rootkit tab and click the Scan button.

Warning! Please DO NOT select the "Show all" checkbox during the scan.

Once done, click the Copy button.
This will copy the results to your clipboard.
Paste the results here in your next reply.

If you're having problems with running GMER.exe, try it in safe mode. This tool works in safe mode. Most other rootkit revealers don't.
« Last Edit: July 18, 2006, 11:37:41 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Aaron40002

  • Newbie
  • *
  • Posts: 47
  • Karma: +0/-0
    • View Profile
runnimg slow/new user account made by it self?
« Reply #2 on: July 19, 2006, 12:46:28 AM »
well the that new user account has come back but it still is running a lil slow and hangs on the boot screen longer then it used to heres the scan

GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-07-18 23:45:03
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.10 ----

SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwConnectPort
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreateFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreateKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreatePort
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreateProcess
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreateProcessEx
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreateSection
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwCreateWaitablePort
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwDeleteFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwDeleteKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwDeleteValueKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwDuplicateObject
SSDT    sptd.sys                                                                                ZwEnumerateKey
SSDT    sptd.sys                                                                                ZwEnumerateValueKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwLoadKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwMapViewOfSection
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwOpenFile
SSDT    sptd.sys                                                                                ZwOpenKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwOpenProcess
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwOpenThread
SSDT    sptd.sys                                                                                ZwQueryKey
SSDT    sptd.sys                                                                                ZwQueryValueKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwReplaceKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwRequestWaitReplyPort
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwRestoreKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwSecureConnectPort
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwSetInformationFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwSetSystemInformation
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwSetValueKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                       ZwTerminateProcess

---- Devices - GMER 1.0.10 ----

Device  \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE                                                    82390B78
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE                                             8217A680
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE                                                  [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CLOSEIRP_MJ_READ                                        [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL                                 [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN                                                [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT                                         [BAE79A80] vsdatant.sys
Device  \Driver\00000051 \Device\00000044 IRP_MJ_SYSTEM_CONTROL                                 [F8451F68] sptd.sys
Device  \Driver\00000051 \Device\00000044 IRP_MJ_DEVICE_CHANGE                                  [F8466A70] sptd.sys
Device  \Driver\00000051 \Device\00000044 IRP_MJ_PNP_POWER                                      [F845F728] sptd.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE                                                 [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSEIRP_MJ_READ                                       [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL                                [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN                                               [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT                                        [BAE79A80] vsdatant.sys
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE                                    823DB4F0
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE                                    823DB4F0
Device  \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE                                              82096EB0
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE                                          8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE                               8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSEIRP_MJ_READ                                8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE                                           8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION                               8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION                                 8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA                                        8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA                                          8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS                                   8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION                        8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION                          8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL                               8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL                             8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL                                  8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL                         8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN                                        8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL                                    8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP                                         8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT                                 8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY                                  8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY                                    8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER                                           8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL                                  8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE                                   8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA                                     8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA                                       8210D0E8
Device  \FileSystem\Rdbss \Device\FsWrap IRP_MJ_PNP                                             8210D0E8
Device  \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE                                              82096EB0
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE                                   820929D0
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE                                          820929D0
Device  \Driver\Tcpip \Device\Udp IRP_MJ_CREATE                                                 [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_CLOSEIRP_MJ_READ                                       [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL                                [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN                                               [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT                                        [BAE79A80] vsdatant.sys
Device  \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE                                        82390E30
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE                                               [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSEIRP_MJ_READ                                     [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL                              [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN                                             [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT                                      [BAE79A80] vsdatant.sys
Device  \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CREATE                                        82390E30
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE                         821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE              821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSEIRP_MJ_READ               821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE                          821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION              821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION                821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA                       821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA                         821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS                  821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION       821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION         821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL              821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL            821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL                 821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL        821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN                       821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL                   821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP                        821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT                821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY                 821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY                   821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER                          821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL                 821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE                  821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA                    821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA                      821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP                            821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP_POWER                      821BFA20
Device  \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE                                         [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSEIRP_MJ_READ                               [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL                        [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN                                       [BAE79A80] vsdatant.sys
Device  \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_MAILSLOT                                [BAE79A80] vsdatant.sys
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE                               821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE                    821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSEIRP_MJ_READ                     821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE                                821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION                    821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION                      821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA                             821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA                               821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS                        821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION             821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION               821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL                    821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL                  821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL                       821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL              821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN                             821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL                         821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP                              821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT                      821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY                       821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY                         821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER                                821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL                       821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE                        821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA                          821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA                            821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP                                  821BFA20
Device  \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP_POWER                            821BFA20
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE                                        8205F410
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE_NAMED_PIPE                             8205F410
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLOSEIRP_MJ_READ                              8205F410
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_WRITE                                         8205F410
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_INFORMATION                             8205F410
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_INFORMATION                               8205F410
Device  \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_EA                                      8205F410
Device  \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE                                          823DB4F0
Device  \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE                                         820E9EB0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{E72EDB5B-47FE-4021-8437-4123CD1A525B} IRP_MJ_CREATE  820929D0
Device  \Driver\viamraid \Device\Scsi\viamraid1 IRP_MJ_CREATE                                   823900E8
Device  \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CREATE                                       82045E10
Device  \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_CREATE                  82045E10
Device  \FileSystem\Fastfat \Fat IRP_MJ_CREATE                                                  8217A680
Device  \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE                                                    8157BAF0

---- Files - GMER 1.0.10 ----

File    C:\System Volume Information\MountPointManagerRemoteDatabase                            
File    C:\System Volume Information\tracking.log                                              
File    C:\System Volume Information\_restore{CFD8312E-EC25-4251-909E-FE783D689F74}            

---- EOF - GMER 1.0.10 ----
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
runnimg slow/new user account made by it self?
« Reply #3 on: July 19, 2006, 11:50:17 PM »
I don't see what's adding the limited account
There is a legit program that does this, I just can't remember it right now, I'll try and see what I come up with
What is the exact name of the new user account added?

But for now
* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
  • Back at the main window, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found:
  • If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:

    This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.

Along with a fresh Hijackthis log
[/list]I want to see what it comes up with
Also, Can you close and then reopen Hijackthis after posting the log
Click on Misc tools section>>Open Uninstall Manager>>click the SAVE LIST.. button
Save this list to your desktop then copy>>Paste back here the contents please
« Last Edit: July 20, 2006, 12:13:57 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Aaron40002

  • Newbie
  • *
  • Posts: 47
  • Karma: +0/-0
    • View Profile
runnimg slow/new user account made by it self?
« Reply #4 on: July 20, 2006, 02:00:18 AM »
heres the frsh hjt log

Logfile of HijackThis v1.99.1
Scan saved at 12:55:32 AM, on 7/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "F:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc...aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

heres the drweb log

SeXy.pif;C:\;Win32.HLLW.MyBot.based;Deleted.;
~1C2.exe;C:\Documents and Settings\Aaron\Local Settings\Temp;Win32.HLLW.MyBot.based;Deleted.;
mirc.exe;C:\Program Files\mIRC;Program.mIRC.617;Incurable.Moved.;
A0015144.pif;C:\System Volume Information\_restore{CFD8312E-EC25-4251-909E-FE783D689F74}\RP69;Win32.HLLW.MyBot.based;Deleted.;
popcaploader.dll;C:\WINDOWS\Downloaded Program Files;Program.PopcapLoader;Incurable.Moved.;
scvhos32t.exe;C:\WINDOWS\system32;Win32.HLLW.MyBot.based;Deleted.;

and the other log u wanted

Ad-Aware SE Personal
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Download Manager 2.0 (Remove Only)
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.0.8
Adobe Stock Photos 1.0
AOL Uninstaller (Choose which Products to Remove)
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
CDBurnerXP Pro 3
DeepBurner v1.8.0.224
DVD Shrink 3.2
Family Feud (remove only)
GameShadow
Google Earth
HijackThis 1.99.1
HLSW v1.0.0.50
ICatch (VI) PC Camera
IrfanView (remove only)
ISO Recorder
iTunes
J2SE Runtime Environment 5.0 Update 7
LimeWire PRO 4.10.9
Macromedia Flash Player 8
MailFrontier Desktop
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
mIRC
MSN Messenger 7.5
MSN Music Assistant
PC Alert 4
QuickTime
Realtek AC'97 Audio
RollerCoaster Tycoon 3 Demo
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Steam
TeamSpeak 2 RC2
TrackMania Nations ESWC 0.1.7.5
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Ventrilo Client
VIA Platform Device Manager
Viewpoint Media Player
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
Yahoo! Messenger
Yahoo! Toolbar
ZoneAlarm Security Suite
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
runnimg slow/new user account made by it self?
« Reply #5 on: July 20, 2006, 09:03:48 PM »
It appears your friend got some kind of bug thru mIRC
Disable it from running for now

Change all passwords on the computer, including users profiles accounts, emails, etc...

remove the limited user account you have no knowledge about
Do a "System scan only" with Hijackthis and put a check next to these entries:

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc...aploader_v6.cab


After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Run and updated scan with Ad-Aware and fix anything it finds
Reboot the computer

Also, Download and Install Spybot 1.4 from
HERE
 or HERE

After installation--Click the UPDATE button on the left
SEARCH FOR UPDATES on the right
Check, and then download all updates
After update is complete

Click the "Search & Destroy" button on the left
"Check for Problems"---When the Scan is complete
FIX all selected promblems in RED

RESTART the computer to finish any cleaning process if any entries were fixed

Let me know how things are going
Post back another fresh hijackthis log
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Aaron40002

  • Newbie
  • *
  • Posts: 47
  • Karma: +0/-0
    • View Profile
runnimg slow/new user account made by it self?
« Reply #6 on: July 21, 2006, 12:03:13 AM »
seems to run fine now thx a lot heres the log

Logfile of HijackThis v1.99.1
Scan saved at 11:02:01 PM, on 7/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
F:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "F:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
runnimg slow/new user account made by it self?
« Reply #7 on: July 22, 2006, 04:54:43 PM »
If you didn't intentionally install Viewpoint Media Player I would remove it from add/remove programs

If everything is running better
We should flush all your restore points
    Go to START>>RUN
    Type in
msconfig
Click OK
Click the "Launch System Restore" button
On the Left hand side click on "System Restore Settings"
Put a Check in "Turn off System Restore"
Apply it and OK out of there>>Reboot your computer
[/list]                          
Back in Windows, Go back and take the check out of "Turn off system restore"
This will reenable the System Restore feature and creates a new restore point

                 [indent][color=\"#CC0000\"]Protect yourself against Future Attacks[/color][/i][/b][/indent]
*Install  SpywareBlaster 3.5.1 by JavaCool  
    *Will block bad ActiveX Controls
    *Block Malevolent cookies in Internet Explorer and Firefox
    *Restrict actions of potentially dangerous sites in Internet Explorer
After installation, Check for updates and then click the "Enable all protection"
"Check for updates every couple of weeks"
after every update just simply click the "enable protection on all unprotected items"

*Keep up to date on Windows updates (High Priorities)
This is the most important step in keeping your system secure
Make sure you check for updates at least once a month and/or set to Autoupdate
                   
*Make sure your Anti-Virus software is always kept up to date and actively running in the background

*Keep your Firewall protection enabled
A Firewall is also very important
This provides a line of defense against someone who might try to access your computer without your permission

Update and do scan's with your Anti-Spyware programs on a regular basis
In addition, open Spybot 1.4
Click the "Immunize" button on the left>>>OK at the prompt>>Immunzine at the top green cross
Immunize after every update

Stay safe  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
runnimg slow/new user account made by it self?
« Reply #8 on: July 30, 2006, 10:03:24 AM »
Since the problems appear resolved, I'll lock this topic
Take care
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: [1]
« previous next »