Laptop running slow

[resevil83]

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-03-14 11:42:16
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT            \??\C:\WINDOWS\inf\qwetab.inf                                                      ZwCreateKey [0xF8837A58]                                                       <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\inf\qwetab.inf                                                      ZwOpenKey [0xF8837B0C]                                                         <-- ROOTKIT !!!
SSDT            \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys                        ZwOpenProcess [0xF8C7B8AC]
SSDT            \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys                                 ZwTerminateProcess [0xEF8D0660]

---- Kernel code sections - GMER 1.0.14 ----

.text           qwetab.inf                                                                         F88370FD 62 Bytes  CALL F8837102 \??\C:\WINDOWS\inf\qwetab.inf
.text           qwetab.inf                                                                         F883713C 102 Bytes  [ 00, 00, 8D, B5, 6B, 04, 00, ... ]
.text           qwetab.inf                                                                         F88371A3 557 Bytes  [ 00, 00, 00, 00, 81, C7, 1C, ... ]
.text           qwetab.inf                                                                         F88373D1 289 Bytes  [ 44, C7, 45, F0, 00, 00, 00, ... ]
.text           qwetab.inf                                                                         F88374F3 143 Bytes  [ 7D, FC, 8B, 7F, 1C, 03, 7D, ... ]
.text           ...                                                                                
.text           C:\WINDOWS\inf\qwetab.inf                                                          section is writeable [0xF8837000, 0x6F78, 0xE8000020]
?               C:\WINDOWS\inf\qwetab.inf                                                          The system cannot find the file specified.

---- Devices - GMER 1.0.14 ----

Device          \FileSystem\Ntfs \Ntfs                                                             qwetab.inf

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                             aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                           aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                           qwetab.inf
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                            EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                            EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)

Device          \Driver\aswTdi \Device\AswUdpFilter                                                qwetab.inf

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                          aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                          qwetab.inf

Device          \Driver\aswTdi \Device\ASWTDI                                                      qwetab.inf
Device          \Driver\aswTdi \Device\AswTcpFilter                                                qwetab.inf

AttachedDevice  \Driver\Tcpip \Device\Udp                                                          aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                          qwetab.inf
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                        aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                        qwetab.inf

---- Services - GMER 1.0.14 ----

Service         C:\WINDOWS\inf\qwetab.inf (*** hidden *** )                                        [SYSTEM] qwetab                                                                <-- ROOTKIT !!!

---- Registry - GMER 1.0.14 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\qwetab@Type                                 1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\qwetab@Start                                1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\qwetab@ErrorControl                         0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\qwetab@ImagePath                            \??\C:\WINDOWS\inf\qwetab.inf
Reg             HKLM\SYSTEM\CurrentControlSet\Services\qwetab\Security                            
Reg             HKLM\SYSTEM\CurrentControlSet\Services\qwetab\Security@Security                    0x01 0x00 0x14 0x80 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\qwetab@Type                                     1
Reg             HKLM\SYSTEM\ControlSet002\Services\qwetab@Start                                    1
Reg             HKLM\SYSTEM\ControlSet002\Services\qwetab@ErrorControl                             0
Reg             HKLM\SYSTEM\ControlSet002\Services\qwetab@ImagePath                                \??\C:\WINDOWS\inf\qwetab.inf
Reg             HKLM\SYSTEM\ControlSet002\Services\qwetab\Security                                
Reg             HKLM\SYSTEM\ControlSet002\Services\qwetab\Security@Security                        0x01 0x00 0x14 0x80 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts@QuigleyWiggly\t(TrueType)  C:\WINDOWS\Fonts\Quigleyw.ttf

---- EOF - GMER 1.0.14 ----

[guestolo]

Can you open gmer.exe again
Expand the top toolbar beside Rootkit/malware>>>>
Click the FILE tab

Navigate to the following file in gmer
C:\WINDOWS\inf\qwetab.inf
Highlight qwetab.inf and click Delete
After the file is deleted
Click on the SERVICES tab
Look for any entries in RED related to «qwetab»
RIGHT CLICK on the entry and choose DELETE

When all done, reboot the computer

Back in Windows
Post a fresh hijackthis log
Also run a fresh scan with gmer.exe and post it's new log

[resevil83]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:06:38 PM, on 3/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\WPC54Cfg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter with SpeedBooster Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\Startup.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

--
End of file - 7339 bytes

[resevil83]

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-03-16 12:22:24
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT            \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys                        ZwOpenProcess [0xF8DB88AC]
SSDT            \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys                                 ZwTerminateProcess [0xEFC7B660]

---- Devices - GMER 1.0.14 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                             aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                           aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                            EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                            EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                          aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                          aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                        aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- Registry - GMER 1.0.14 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts@QuigleyWiggly\t(TrueType)  C:\WINDOWS\Fonts\Quigleyw.ttf

---- EOF - GMER 1.0.14 ----

[guestolo]

How's it running now?

My computer seems ok, it runs a tad slow but I think its because I have all these spyware and antivirus apps running.

Which spyware programs did you install to rid you of problems recently?

Is TrojanHunter the trial version?
Is SuperAntispyware the free version?

[resevil83]

yes sir.. both correct. I have avg anti-spyware, avast antiviurs, avg anti-rootkit, super antispyware professional, spyware blaster, trojan guard, spybot search and destroy, malware bytes anti malware.

[guestolo]

Let's see what we can disable on startup

Since you have SuperAntispyware Pro installed,
It will serve as realtime protection against spyware/malware

Leave it installed

Let's remove some tools that we used
Access your Add and Remove programs and remove
avg anti-rootkitand malware bytes anti malware

If trojanHunter is the trial version
Ensure to Exit the guard by your clock and then uninstall it from add/remove
Do the same for AVG anti-spyware, close it by the clock
Then uninstall from add/remove programs

Hold onto SpywareBlaster and AVAST>>Avast is your Antivirus software, so we don't want to remove it
SpywareBlaster sets registry killbits, so it doesn't have no need to run in the background

As for Spybot, you can use it for scanning
What version are you running?
Open Spybot, click on HELP>>ABOUT
Let me know Spybot version and latest detection update date please

I suggest you leave TEATIMER disabled, let Super Anti-spyware take care of realtime spyware protections

After the above is done
Go to START>>RUN>>copy and paste the next command in bold

ComboFix /u
Hit OK
This will uninstall ComboFix and it's components

Download [color=\"#FF0000\"]ATF-Cleaner[/color] by Atribune.
Save it to your desktop
Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.

If you use Firefox browser
      Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

      Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

========================================
Reboot may be a bit slower on startup, until a couple reboots as we also cleared your Prefetch folder

download the [color=\"red\"]OTMoveIt2 by OldTimer[/color][/url].

• Save it to your desktop.
  
• Double-click OTMoveIt.exe to run it.
  
• Click the Cleanup! button
  A list will be downloaded>>Allow it Internet access if prompted by your Firewall
  Don't change anything in this list
  
• Select Yes at the prompt
  Wait for the confirmation box to open to reboot the computer
  Don't mouseclick during the wait as you may cause the tool to stall
  
• Select Yes to reboot Now
  

NOTE: This procedure will also delete OTMoveit.exe from desktop

Back in Windows, post a fresh hijackthis log and let me know how things are running
We can still disable some entries from running on startup if you would like

[resevil83]

spybot version 1.5.2.20 latest detection update: 2/27/08

[resevil83]

when i type this in the run command box nothing happens. ComboFix /u
I get the Windows cannot find combo fix error.

[guestolo]

when i type this in the run command box nothing happens. ComboFix /u

Could you try what I asked please
COPY AND PASTE to the run command
the following in bold

ComboFix /u

Notice the space after the x but before the /
Then hit Ok

[resevil83]

Yes, sorry that's what I meant. I did copy and paste it in. I get the following error: "Windows cannot find 'ComboFix'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search."

[guestolo]

Can you manually delete combofix.exe from desktop
Find and delete the following folder if still present

C:\Qoobox
Also delete C:\Combofix.txt if found

Do the rest of the steps in post #27
Let me know how things are running after

[resevil83]

things seem to be running pretty smooth... Thanks.

[resevil83]

where is the donate now link?? I remember you used to have a paypal link for donations. You don't do that anymore??

[guestolo]

[quote name=\'resevil83\' post=\'424499\' date=\'Mar 21 2008, 03:05 PM\']where is the donate now link?? I remember you used to have a paypal link for donations. You don't do that anymore??[/quote]
It's at the bottom of my signature
Remember, It's appreciated, but not required to donate  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />

[guestolo]

Since your issues appear resolved, I'll lock this topic