« previous next »
Pages: [1] 2 3

Author Topic: questolo my computer is slow. Different comp then last time  (Read 2647 times)

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« on: August 26, 2006, 01:21:40 PM »
MY comp is slow. Is there any one i can limit what windows exp runs if u want a hijack this log jus tell me
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #1 on: August 26, 2006, 01:27:14 PM »
Yes please, post a log just to be on the safe side
I'm stepping out for a bit, I'll look at it when I return
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #2 on: August 26, 2006, 01:33:20 PM »
ok here it is
Logfile of HijackThis v1.99.1
Scan saved at 2:29:54 PM, on 8/26/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\AOL\1154633319\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\MyWebSearch\bar\1.bin\m3IMPipe.exe
C:\Program Files\Sprint DSL virtual assistant\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\America Online 9.0\wEmail Removedexe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154633319\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortEmail Removedexe" -Run
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0\Email RemovedEXE" -b
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\1.bin\m3IMPipe.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Sprint virtual assistant.lnk = C:\Program Files\Sprint DSL virtual assistant\bin\matcli.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZJxdm090YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/dd/instal...edsolutions.cab
O16 - DPF: {B8E71371-F7F7-11D2-A2CE-0060B0FB9D0D} (CDToolCtrl Class) - http://free.Email Removed/tryaolfree/cdt175/aolcdt175.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe


Also i want to get rid of most of the stuff i don't need. If you don't know what rid means it mean to take away. Look up pittsburgh english on wikipedia. I live in centreal PA don't how to explain stuff with out my accent.
« Last Edit: August 26, 2006, 01:31:32 PM by pureblood »
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #3 on: August 26, 2006, 01:36:29 PM »
Just on my way out the door, in the meantime, can you do the following
Please supply an uninstall list from Hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #4 on: August 26, 2006, 01:40:31 PM »
Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Deskbar
AOL Spyware Protection
AOL Toolbar
AOL Uninstaller (Choose which Products to Remove)
AOL You've Got Pictures Screensaver
ArcSoft PhotoImpression 4
Digital Camera Driver
HijackThis 1.99.1
HP Deskjet 3740
HP Deskjet printer preloaded drivers
Instant Support
Intel® Extreme Graphics Driver
IntelliMover Data Transfer Demo
J2SE Runtime Environment 5.0 Update 6
KBD
LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)
Microsoft .NET Framework (English) v1.0.3705
Microsoft Money 2003
Microsoft Money 2003 System Pack
Microsoft Works 7.0
Mozilla Firefox (1.5)
MUSICMATCH® Jukebox
My Web Search (Zwinky)
NVIDIA Windows 2000/XP Display Drivers
OmniPass
PC-Doctor for Windows
PS2
Pure Networks Port Magic
Python 2.2 combined Win32 extensions
Python 2.2.1
Quicken 2003 New User Edition
QuickTime
RealOne Player
RecordNow
RingMaster from Compaq (remove only)
S3Display
S3Gamma2
S3Info2
S3Overlay
Simple Installer - Multilanguage Version
Sonic Update Manager
Viewpoint Media Player
Weblink
Windows XP Hotfix (SP2) [See q329256 for more information]
Windows XP Hotfix (SP2) Q327979
Windows XP Hotfix (SP2) Q329909
Windows XP Hotfix (SP2) Q331958
Windows XP Hotfix (SP2) Q811789
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #5 on: August 26, 2006, 04:27:13 PM »
i'll be back in 15 min. I need to get on the computer that i am talking about and get a shower.
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #6 on: August 26, 2006, 04:33:16 PM »
Do a "System scan only" with Hijackthis and put a check next to these entries:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\1.bin\m3IMPipe.exe"

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZJxdm090YYUS
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab

The next ones are optional, don't need to run on startup

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe

with both Quicken and SunJava you can manually check for updates

After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Access your add/remove programs and remove the following
If you don't have any other software installed by Symantecs, remove
LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)

REMOVE
My Web Search (Zwinky)
and
Viewpoint Media Player <-bundled with AOL

Reboot the computer afterwards
Find and delete the following folder
C:\Program Files\MyWebSearch <-folder

I don't use either PC Doctor or AOL Spyware
But I do trust the following, there a free install, you should install them

Download and Install
Ad-Aware SE Personal 1.06

Open Ad-Aware, ensure to click the  check for updates now link and Connect to download the latest updates
Close out after it is updated, as we will need it later
Open Ad-Aware SE 1.06
Click START
Click the radio button to Perform a Full system scan then click NEXT
When it's finished scanning
At this point you should either right click on the screen and and choose the "Select All" Objects option or individually put a checkmark in each objects checkbox
click on the Next button. Ad-Aware SE will now present you with a confirmation box as to whether or not you would like to remove the objects you have just selected. Press the "OK" button

RESTART your computer to finish the cleaning process
===================================

Download and Install Spybot 1.4 from
HERE

After installation--Click the UPDATE button on the left
SEARCH FOR UPDATES on the right
Check, and then download all updates
After update is complete
Click the "Search & Destroy" button on the left
"Check for Problems"---When the Scan is complete
FIX all selected promblems in RED

RESTART the computer to finish any cleaning process

Back in Windows, post a fresh hijackthis log
I don't see any AntiVirus software on this computer

If this is the case, to ensure there is nothing else hiding
From my signature below,
Using INTERNET EXPLORER>>Run an online virus scan at Kaspersky's
You will be promted to install an ActiveX component from Kaspersky, Click Yes.

   
    * The program will launch and then begin downloading the latest definition files:
        * Once the files have been downloaded click on NEXT
        * Now click on Scan Settings
        * In the scan settings make sure that the following are selected:
              o Scan using the following Anti-Virus database:
                Extended (if available otherwise Standard)
              o Scan Options:
                Scan Archives
                Scan Mail Bases
        * Click OK
        * Now under select a target to scan:
                Select My Computer
        * This program will start and scan your system.
        * The scan will take a while so be patient and let it run.
        * Once the scan is complete it will display if your system has been infected.
              o Now click on the Save as Text button:
        * Save the file to your desktop.
   * Copy and paste that information in your next post along with a fresh hijackthis log
« Last Edit: August 26, 2006, 04:54:15 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #7 on: August 26, 2006, 05:00:20 PM »
I already have that Ad aware thing from lavasoft. Also i have spybot search and destroy. I do not know why it isn't showing up on my unistall list for? I reformated my computer not completely uit left all my files alone and it didn't remove them. This was awhile back. I am not going to do what you said with hijack this.
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #8 on: August 26, 2006, 05:14:15 PM »
Ok  a few more questions do i need that quicken junk. I never once used so i was wondering if i can get rid of it. Also on the hijack this log i read a aol dialer. I don't have aol and tried to unistall all the aol junk i have. My intrnet is embarq dsl and i they have eathlink with it. I have earthlink total acces installed. Do i need it? I never use it. And do i need real player and that music match jukebox?

i can't remove the my web search (zinky). Also what does weblink do?
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #9 on: August 26, 2006, 06:02:46 PM »
I don't see Ad-Aware in the uninstall list you supplied
IT SHOULD be in the list if it is installed

Do everything else I posted

You can uninstall Weblinks if not required
as well as all the AOL crap if you don't want it
It's your computer, you have to decide what you want installed???
Run the AOL Uninstaller (Choose which Products to Remove) from add/remove programs


This is your post concerning AOL
http://www.thetechguide.com/forum/index.ph...c=39275&hl=
« Last Edit: August 26, 2006, 06:08:05 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #10 on: August 26, 2006, 10:06:20 PM »
i know i put that there i liked that at first but then they put all that crap on my computer. I am getting ready to post an other hijack this log.

oh and can u lock it? with out me saying to lock it on that thread i don't want it at the top.
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #11 on: August 26, 2006, 11:03:03 PM »
Sorry questolo but u are going to have to wait till tom to get a hijack this thing and i will post another unistall list. If you like. Sorry for the wait and me bugging you.
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #12 on: August 27, 2006, 09:25:29 AM »
Logfile of HijackThis v1.99.1
Scan saved at 10:19:34 AM, on 8/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\AOL\1154633319\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Sprint DSL virtual assistant\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154633319\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortEmail Removedexe" -Run
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Sprint virtual assistant.lnk = C:\Program Files\Sprint DSL virtual assistant\bin\matcli.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/dd/instal...edsolutions.cab
O16 - DPF: {B8E71371-F7F7-11D2-A2CE-0060B0FB9D0D} (CDToolCtrl Class) - <a href="http://free.Email Removed/tryaolfree/cdt175/aolcdt175.cab" target="_blank" rel="nofollow">http://free.Email Removed/tryaolfree/cdt175/aolcdt175.cab</a>
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe


Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
AOL Uninstaller (Choose which Products to Remove)
Digital Camera Driver
HijackThis 1.99.1
HP Deskjet 3740
HP Deskjet printer preloaded drivers
Instant Support
Intel® Extreme Graphics Driver
IntelliMover Data Transfer Demo
J2SE Runtime Environment 5.0 Update 6
KBD
Microsoft .NET Framework (English) v1.0.3705
Microsoft Money 2003
Microsoft Money 2003 System Pack
Microsoft Works 7.0
Mozilla Firefox (1.5)
MUSICMATCH® Jukebox
NVIDIA Windows 2000/XP Display Drivers
OmniPass
PC-Doctor for Windows
PS2
Pure Networks Port Magic
Python 2.2 combined Win32 extensions
Python 2.2.1
Quicken 2003 New User Edition
QuickTime
RealOne Player
RecordNow
RingMaster from Compaq (remove only)
S3Display
S3Gamma2
S3Info2
S3Overlay
Simple Installer - Multilanguage Version
Sonic Update Manager
Viewpoint Media Player
Weblink
Windows XP Hotfix (SP2) [See q329256 for more information]
Windows XP Hotfix (SP2) Q327979
Windows XP Hotfix (SP2) Q329909
Windows XP Hotfix (SP2) Q331958
Windows XP Hotfix (SP2) Q811789

There has to be something wrong with uninstall list because  have aim installed and can run it. Same thing with limewire, adaware se personal addition. And spybot search and destroy. And crap cleaner. Did u ever here of anything like that?
« Last Edit: August 27, 2006, 09:34:34 AM by pureblood »
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #13 on: August 27, 2006, 10:05:33 AM »
You didn't post the results of the Kaspersky's scan
Can you run it and post the results

Also, Open Spybot, click on HELP in the top menu bar
Click on ABOUT
Let me know Latest detection date and version no.

Open Ad-Aware
Click on DETAILS under Intialization status
Let me know Ref. number and and Internal build

Also, Download and unzip to your desktop InstalledPrograms.zip
Double click on InstalledPrograms.vbs

Click OK at the IP prompt and click YES to view the results now
A text file will open, can you copy and paste back here the whole contents
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #14 on: August 27, 2006, 03:32:17 PM »
I am getting ready to run a kaspersky scam. For now here is the spyboy info and the adaware info you requested. Spypot-search and destroy 1.4. Last detection update was on 2006-08-25. Here is the stuff from adaware Definitions File Loaded: Reference Number : SE1R120 25.08.2006 Internal build : 145. Right now i am going to run scan then post the results the download the thing you tod me to do.

Here is a list of installed programs. The Kaspersky scan is running now. I will post the results and another hijack this log right away.
INSTALLED SOFTWARE (48) - FAMILYROOM - 8/27/2006 4:28:51 PM

Adobe Acrobat 5.0    Ver: 5.0
Adobe Flash Player 9 ActiveX    Ver: 9
AOL Uninstaller (Choose which Products to Remove)    
Digital Camera Driver    Ver: 1.00.0000    Installed: 8/8/2006
HijackThis 1.99.1    Ver: 1.99.1
HP Deskjet 3740    Ver: 1.00.0000    Installed: 8/3/2006
HP Deskjet printer preloaded drivers    Ver: 1.00.0200    Installed: 4/9/2003
HpSdpAppCoreApp    Ver: 2.00.0000    Installed: 4/9/2003
Instant Support    
Intel® Extreme Graphics Driver    
IntelliMover Data Transfer Demo    
J2SE Runtime Environment 5.0 Update 6    Ver: 1.5.0.60    Installed: 8/17/2006
Kaspersky Online Scanner    Ver: 5.0.83.0
KBD    
Microsoft .NET Framework (English) v1.0.3705    
Microsoft .NET Framework (English) v1.0.3705    Ver: 1.0.3705    Installed: 4/9/2003
Microsoft Money 2003    Ver: 11.0.50    Installed: 4/9/2003
Microsoft Money 2003 System Pack    Ver: 11.0.80    Installed: 4/9/2003
Microsoft Works 7.0    Ver: 07.02.0620    Installed: 4/9/2003
Mozilla Firefox (1.5)    Ver: 1.5 (en-US)
MUSICMATCH® Jukebox    
NVIDIA Windows 2000/XP Display Drivers    
OmniPass    
PC-Doctor for Windows    
PS2    
Pure Networks Port Magic    Ver: 1.2.1393.0
Python 2.2 combined Win32 extensions    
Python 2.2.1    Ver: 2.2.1
Quicken 2003 New User Edition    Ver: 12.00.0000    Installed: 4/9/2003
Quicken 2003 New User Edition    Ver: 12.00.0000    Installed: 4/9/2003
QuickTime    
RealOne Player    
RecordNow    Ver: 5.0    Installed: 4/9/2003
RingMaster from Compaq (remove only)    
S3Display    
S3Gamma2    
S3Info2    
S3Overlay    
Simple Installer - Multilanguage Version    
Sonic Update Manager    Ver: 2.80    Installed: 4/9/2003
Viewpoint Media Player    
WebFldrs XP    Ver: 9.50.6513    Installed: 4/9/2003
Weblink    
Windows XP Hotfix (SP2) [See q329256 for more information]    
Windows XP Hotfix (SP2) Q327979    Ver: 20021114.125755
Windows XP Hotfix (SP2) Q329909    Ver: 20021107.233949
Windows XP Hotfix (SP2) Q331958    Ver: 20021029.122936
Windows XP Hotfix (SP2) Q811789    Ver: 20030113.170849


I thought i removed that veiwpoint player yesterday. Now it is back again. Same with aol it wont go away
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #15 on: August 27, 2006, 06:57:44 PM »
Here is the scan you requested.
-------------------------------------------------------------------------------
 KASPERSKY ONLINE SCANNER REPORT
 Sunday, August 27, 2006 7:54:29 PM
 Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
 Kaspersky Online Scanner version: 5.0.83.0
 Kaspersky Anti-Virus database last update: 27/08/2006
 Kaspersky Anti-Virus database records: 218755
-------------------------------------------------------------------------------

Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\

Scan Statistics:
    Total number of scanned objects: 70259
    Number of viruses found: 18
    Number of infected objects: 41 / 0
    Number of suspicious objects: 0
    Duration of the scan process: 02:04:40

Infected Object Name / Virus Name / Last Action
C:\a.zip/Setup.exe    Infected: Worm.Win32.VB.an    skipped
C:\a.zip    ZIP: infected - 1    skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aolstderr.txt    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aolstdout.txt    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aoltsmon.lock    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\cache.db    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\server.lock    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2508b774daea75a835e6a7f23154c2c1_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\26477b0700a04b8f0d17980de385c238_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3025934c4f8da04ad4d8e5fd27244a57_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6252f954e8a96779dc57418f512f2e22_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\710a940c670344f0edde13da798b8bf3_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb828e7d94b2431db5b2f828727e7583_925d8183-3ae8-4d61-86f4-3fdeb0643764    Object is locked    skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp    Object is locked    skipped
C:\Documents and Settings\All Users\Documents\My Music\PowerPoint to Flash 1.6.7.1.zip/Setup.exe    Infected: Worm.Win32.VB.an    skipped
C:\Documents and Settings\All Users\Documents\My Music\PowerPoint to Flash 1.6.7.1.zip    ZIP: infected - 1    skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat    Object is locked    skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat    Object is locked    skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat    Object is locked    skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat    Object is locked    skipped
C:\Documents and Settings\LocalService\NTUSER.DAT    Object is locked    skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG    Object is locked    skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat    Object is locked    skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT    Object is locked    skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG    Object is locked    skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\cert8.db    Object is locked    skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\formhistory.dat    Object is locked    skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\history.dat    Object is locked    skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\key3.db    Object is locked    skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\parent.lock    Object is locked    skipped
C:\Documents and Settings\Owner\Cookies\index.dat    Object is locked    skipped
C:\Documents and Settings\Owner\Desktop\backups\backup-20060826-180611-102.dll    Infected: not-a-virus:AdWare.Win32.MyWebSearch.aq    skipped
C:\Documents and Settings\Owner\Desktop\backups\backup-20060826-180611-757.dll    Infected: not-a-virus:AdWare.Win32.MyWebSearch.an    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\Cache\_CACHE_001_    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\Cache\_CACHE_002_    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\Cache\_CACHE_003_    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\gsw0lebd.default\Cache\_CACHE_MAP_    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Temp\AVP4CF.tmp    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Temp\AVP4D0.tmp    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Temp\AVP5D9.tmp    Object is locked    skipped
C:\Documents and Settings\Owner\Local Settings\Temp\iinstall.exe    Infected: Trojan-Downloader.Win32.IstBar.mz    skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I302RD1S\popup[1].htm    Infected: Trojan-Clicker.HTML.Agent.a    skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I302RD1S\popup[1].php/packed    Infected: Trojan-Clicker.HTML.Agent.a    skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I302RD1S\popup[1].php    GZIP: infected - 1    skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat    Object is locked    skipped
C:\Documents and Settings\Owner\NTUSER.DAT    Object is locked    skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG    Object is locked    skipped
C:\Documents and Settings\Owner\Shared\LimeWire Pro 4.9.28.zip/Setup.exe    Infected: Worm.Win32.VB.an    skipped
C:\Documents and Settings\Owner\Shared\LimeWire Pro 4.9.28.zip    ZIP: infected - 1    skipped
C:\hp\bin\KillWind.exe    Infected: not-a-virus:RiskTool.Win32.PsKill.p    skipped
C:\hp\region\EN_US-ie.reg    Infected: Trojan.WinREG.StartPage    skipped
C:\n.exe    Infected: Trojan-Downloader.Win32.Small.cdy    skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log    Object is locked    skipped
C:\Program Files\Sprint DSL virtual assistant\log\mpbtn.log    Object is locked    skipped
C:\Program Files\winupdates\winupdates.exe    Infected: Worm.Win32.VB.an    skipped
C:\s.tmp    Infected: Worm.Win32.VB.an    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP16\A0001435.DLL    Infected: not-a-virus:AdWare.Win32.FunWeb.e    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003380.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.aq    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003381.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.an    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003472.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003473.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003474.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.af    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003476.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.an    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003477.SCR    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003478.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.v    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003479.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003480.EXE    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003481.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.an    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003482.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.aq    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003483.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003486.DLL    Infected: not-a-virus:AdWare.Win32.IWon.a    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003490.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003491.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.as    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003492.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.ad    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003494.EXE    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003495.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.ab    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003496.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\A0003497.DLL    Infected: not-a-virus:AdWare.Win32.MyWebSearch.i    skipped
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP32\change.log    Object is locked    skipped
C:\WINDOWS\Debug\oakley.log    Object is locked    skipped
C:\WINDOWS\Debug\PASSWD.LOG    Object is locked    skipped
C:\WINDOWS\SchedLgU.Txt    Object is locked    skipped
C:\WINDOWS\Sti_Trace.log    Object is locked    skipped
C:\WINDOWS\system32\config\AppEvent.Evt    Object is locked    skipped
C:\WINDOWS\system32\config\default    Object is locked    skipped
C:\WINDOWS\system32\config\default.LOG    Object is locked    skipped
C:\WINDOWS\system32\config\SAM    Object is locked    skipped
C:\WINDOWS\system32\config\SAM.LOG    Object is locked    skipped
C:\WINDOWS\system32\config\SecEvent.Evt    Object is locked    skipped
C:\WINDOWS\system32\config\SECURITY    Object is locked    skipped
C:\WINDOWS\system32\config\SECURITY.LOG    Object is locked    skipped
C:\WINDOWS\system32\config\software    Object is locked    skipped
C:\WINDOWS\system32\config\software.LOG    Object is locked    skipped
C:\WINDOWS\system32\config\SysEvent.Evt    Object is locked    skipped
C:\WINDOWS\system32\config\system    Object is locked    skipped
C:\WINDOWS\system32\config\system.LOG    Object is locked    skipped
C:\WINDOWS\system32\f3PSSavr.scr    Infected: not-a-virus:AdWare.Win32.MyWebSearch    skipped
C:\WINDOWS\system32\h323log.txt    Object is locked    skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR    Object is locked    skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA    Object is locked    skipped
C:\WINDOWS\wiadebug.log    Object is locked    skipped
C:\WINDOWS\wiaservc.log    Object is locked    skipped
D:\sync-src-1.00.tbz    Infected: Net-Worm.Win32.Doomjuice.a    skipped

Scan process completed.



oh Should i delete those entrys then post a fresh hijack this log?
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #16 on: August 27, 2006, 07:10:55 PM »
Hold tight for a second, let me look your log over
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #17 on: August 27, 2006, 07:15:52 PM »
ok
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
questolo my computer is slow. Different comp then last time
« Reply #18 on: August 27, 2006, 07:21:13 PM »
We still have some cleaning to do

Do the following, this should help out
It will require a few other tools, make sure to use them

Download and save [color=\"red\"]Brute Force Uninstaller[/color][/b] to the desktop
  • Right click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to, click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk (C:) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
[color=\"red\"]RIGHT-CLICK HERE[/color][/b] and choose "Save As" (in IE it's "Save Target As") in order to download [color=\"red\"]Alcan worm remover[/color].
Save it to the same folder you made earlier (c:\BFU).

==Download, install, and update  Ewido anti-spyware[list=1]
  • Load Ewido and then click the Update tab at the top. Under Manual Update click Start update.
  • After the update finishes (the status bar at the bottom will display "Update successful")
  • Close Ewido. Do not run it yet.
==Download and install Windows CleanUp! 4.5.2
Don't run a scan yet

CleanUp! attempts to delete files from various temporary directories (including download directories/caches),
as well as emptying the Recycle Bins.
If you make a habit of saving files that you wish to keep in any of these places,  they will be deleted when CleanUp! is run.
Please move them too a different location before we run this tool if the above is true
Note: It is generally considered poor practice to use temporary folders or the Recycle Bin to store files you intend to keep.

Print and/or save the rest of these instructions to a text file saved to desktop
This is very important, as I need you too reboot into safe mode without internet connection

Reboot your computer into Safe Mode. To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads. Select Safe Mode on the screen that appears.

Access your add/remove programs and remove
Viewpoint Media Player
Remain in safe mode

==Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

    * Empty Recycle Bins
    * Delete Cookies
    * Delete Prefetch files
    * Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.
When it's done>>Click Close
DECLINE to Log off or Restart the computer
NOTE: The first time you run CleanUp! it may prompt to run in Demonstration mode
Deny this, we want to run the actual cleanup!!
Run this twice please

==Go to Start > My Computer and navigate to the C:\BFU folder.
  • Start the Brute Force Uninstaller by doubleclicking BFU.exe
  • Next to the scriptline to execute field click the folder icon and select alcanshorty.bfu
  • Press Execute and let it do it’s job. (You ought to see a progress bar if you did this correctly.)
  • Wait for the complete script execution box to pop up and press OK.
  • Press exit to terminate the BFU program.
Ewido Scan
  • Then run Ewido and click on the Scanner tab at the top and then click on Complete System Scan.  This scan can take quite a while to run, so be prepared.
  • Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.
  • Click on "Save Report", then "Save Report As".  This will create a text file.  Make sure you know where to find this file again (like on the Desktop).
  • Restart back into Normal Mode.
Back in Windows

Post back all the following
1. Post a fresh hijackthis log
2. Post the Whole Report from Ewido's
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline Pureblood

  • Hero Member
  • *****
  • Posts: 4958
  • Karma: +0/-0
    • View Profile
    • http://passurclass.com
questolo my computer is slow. Different comp then last time
« Reply #19 on: August 27, 2006, 07:40:15 PM »
current updating ewido.Should i most def save the instrctions or just use my laptop?
Logged
[font=\"Garamond\"][color=\"#4169e1\"] If you still want to contact me send a pm to me here i'll give personal msn.

MSN: Pureblood@rs2mm.com [/color][/font]
[color=\"#4169e1\"]Total Amount of Money MMed and Item Transfered: 766 Mil

Total Amount of MM's and Item Transfers:128[/color]







Pages: [1] 2 3
« previous next »