Computer acting funny? (HJT log)

Richard132 · Sep 29, 2007

So l8ly my com seems to be doing alot of scanning which laggs my computer really bad and freeze ups i allways know when its finished because the floppy disc drive lights up n makes a loading noise but this happens about 9 times a day? could you see if there is anything Malicious or find out whats doing these annoying scans? thanks alot

evilfantasy · Sep 29, 2007

This will help get you started in cleaning up your computer.

You need to have a read of this - If your system is infected. Read this before deciding whether to CLEAN or REFORMAT.

Then if you should wish to proceed with cleaning your system you need to go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, Combofix, and AVG Antispyware logs as ATTACHMENTS into this thread, only after doing the above.

This thread is for the use of Richard132 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Bobbye · Sep 29, 2007

Richard, in addition to the logs, do you perform any routine maintenance on the system- like disc cleanup, error check, defrag, run anti-virus and spyware/adware scans, updating each right before the scan. Have you stopped all unnecessary programs from starting up and running in the background, using the msconfig utility.

Which operating system do you use, how much installed RAM do you have and which browser and version do you use?

Richard132 · Oct 5, 2007

I dont know how to stop and start background running processes, i use windows XP pro / 512ram /firefox and yes i do do regular maintenance.

and evilfantasy i will get back to you soon because that is ALOT of stuff to do and with my busy life its going to be hard to fit in

i will post asap

Bobbye · Oct 5, 2007

Well, Richard, it's time you learn! This will take you through the entire process. Know that the only startup programs you must have are the anti-virus program, firewall, touchpad if on laptop, possibly network settings. All the rest slow the system down can be called on to start up when needed:

Working in msconfig to stop unnecessary programs from starting up, This will improve the performance of your system.

Start> Run>type in 'msconfig' (no quotes)> OK> click on Selective Start-up> Startup tab. For any programs you don't recognize, refer to any of the sites below for ID. If you don't need them to startup and run in the background, click to remove the check.
NOTE: if you can't see enough to ID the program name, put your cursor over the dividing line at the top of the column and move it to the right.
NOTE: you will need to stay in Selective Start-up after making changes. If you do not, it will revert back to Normal and include the programs you stopped.
NOTE: if you find you do need something you stopped, the program will still be there and you can go back in an recheck it.
NOTE: you will get a 'nag' message about being in Selective Start-up. Check 'don't show me this message any more.'> Close on the X.

STARTUP APPLICATION DATABASE LIST
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
http://startup.iamnotageek.com/ http://www.pcpitstop.com/spycheck/SWDetail.asp?fn=gah95on6.exe

Additional msconfig info:
How to troubleshoot by using the System Configuration utility in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310560

How to use msconfig: excellent reference site with screen shots:
http://www.netsquirrel.com/msconfig/

Richard132 · Oct 12, 2007

Done the online scans etc

managed to get a HJT log when the scan was active aswell

i cant do the other logs because those programs clash with my current protection.

@bob ty for the info

disabled about 7 programs ;D

Jase123 · Oct 12, 2007

You are using an outdated version of HJT. Please could you download the latest one from HERE, and post a fresh HJT log.

Regards Jase

Richard132 · Oct 12, 2007

sorry about that

updated.

EDIT: in the outdated log it showed alot of missing dll's? :S (when the scan was active)

Jase123 · Oct 12, 2007

This needs to be deleted:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Also, i recommend you moving msn plus from your computer, as it is known to come with spyware.

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

Apart from that, i can't find anything else unusual in your HJT log.

Go through these instructions: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Please could you run AVG Antispyware, and post a Combofix log too.

Also, Let me know the results of the Panda Antirootkit scan.

Regards Jase

Richard132 · Oct 30, 2007

hi sorry taking so long...

right would i be able to start over? my younger cousin has downloaded random stuff iv done alot of scans and nothing but just to be safe...

will post "Please could you run AVG Antispyware, and post a Combofix log too.

Also, Let me know the results of the Panda Antirootkit scan." asap

cannot today doing night shift... horrid i know.

evilfantasy · Oct 30, 2007

From the amount of time that has passed it would be best to start back on post #2 and submit all fresh logs.

Richard132 · Nov 3, 2007

hi so i started all of it at 11am it is now 7:40 pm!!

Panda antirootkit came back clean.

here are all the logs

also as i done step 13 (unhiding folders/files) AOL spyware protection popped up with some things but iv done ALL the steps you asked and nothing came back? but i think AOL is well known for all its false positives.

screenshot:

http://img215.imageshack.us/img215/5738/issueud0.jpg

and it doesnt show locations because ofcourse.. its AOL -sigh-

looking forward to your reply

Bobbye · Nov 3, 2007

Richard, here are some more to take off startup

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

AOLSP Scheduler.exe> disable this AOL Automatic Spyware Protection. You can initiate the once a week scan yourself without starting this up and having it run in the background.

AOLDial.exe: needed IF you have a dial-up connection and IF you want to connect to the Internet via AOL without first having to start your main AOL software and connect to your email. But not everyone necessarily wants to connect to the Internet immediately after turning the PC ON, and on PCs which use modem connections rather than broadband this task can not only add significantly to the boot-up time of the PC, but, worse, on some PCs, because of timing issues, it will give errors either on boot-up or on shutdown, or both. It is recommended that you disable this feature and take it off of start-up.

AOLacsd.exe: supposedly reconnects you to AOL if you lose your connection while online. It runs as a task in Win9x/ME, and as a service under WinNT4/2000/XP/2003. Reasons to stop it:
1. this task is responsible for boot-up errors on some PCs.
2. constant autodials on boot-up of some PCs.
3. it is incompatible with some programs on others (you have to terminate ACSD to use the programs without problems)
4. on other PCs it uses inconsiderable amounts of memory for what its role is, on some Win2000/XP PCs we have found it running away with CPU resources and incredibly slow PCs as a result.
5. and, worse, it stays around when you have deliberately closed your Internet connection.
answesrthatwork.com has this to say: "This, in our opinion, is TerribleWare ! "

VS7DEBUG\MDM.EXE is the Its the M$ debugger. Stands for Machine Debug Manager. Its not essential, but can help if one knows how to use it. It is usually used as a developers tool> Remove it from startup.

Please note: Process descriptions and recommendations are from:
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

howard_hopkinso · Nov 4, 2007

All your log files are clean.

I don`t think you have a malware problem.

Regards Howard

Richard132 · Nov 4, 2007

cool

so do you think those AOL alerts are false positives?

also when i right click zonealarm it says gamemode? do i change it to that when i play a game? lol

and in your tutorial you say to turn off AVG anti spyware sheild? why is this?

thanks

howard_hopkinso · Nov 4, 2007

What exactly is Aol alerting you to?

Zonealarm Gamemode is for playing online games, so yes, change it to game mode if you need to.

I recommend to diasble AVG Antispyware`s active shield in order to reduce system resources. Also, when running any fix in HJT etc, it can interfere with fixes.

Regards Howard