Solved PC running slowly

Broni · Feb 9, 2012

We'll see about it....

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
O15 - HKU\S-1-5-21-1220945662-1801674531-725345543-1003\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKU\S-1-5-21-1220945662-1801674531-725345543-1003\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKU\S-1-5-21-1220945662-1801674531-725345543-1003\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKU\S-1-5-21-1220945662-1801674531-725345543-1003\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKU\S-1-5-21-1220945662-1801674531-725345543-1003\..Trusted Domains: windows,update.com ([download] http in Trusted sites)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

============================================================

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Do NOT post JavaRa log.

===============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

4. Please, run F-Secure Online Scanner

Disable your Antivirus program.
Checkmark I have read and accepted the license terms.
Click on Run Check button.
Quick scan (recommended) option will come pre-checked. Don't change it.
Click on Start button.
When scan is done, in Step 3: Clean the files, leave all settings as they're.
Click Next button.
Click Full report... button.
Copy report's content and paste it into your next reply.

Gouge · Feb 9, 2012

Here's the OTL scan results:

All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\*.update\ deleted successfully.
Invalid CLSID key: *.update
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\*.update\ not found.
Invalid CLSID key: *.update
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\update\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\update\ not found.
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\windows,update.com\download\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 41085 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 13689508 bytes
->Flash cache emptied: 41085 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 42478 bytes
->Flash cache emptied: 470 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 728489 bytes
->Temporary Internet Files folder emptied: 30545423 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 61512122 bytes
->Google Chrome cache emptied: 6171858 bytes
->Flash cache emptied: 41519 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 41085 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 126185094 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 39520 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 1640748 bytes
RecycleBin emptied: 719052 bytes

Total Files Cleaned = 230.00 mb

[EMPTYJAVA]

User: Administrator
->Java cache emptied: 0 bytes

User: All Users

User: Default User
->Java cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Owner
->Java cache emptied: 0 bytes

User: UpdatusUser
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

User: UpdatusUser
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 02092012_225158

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF30AF.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF48DA.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF61DB.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF68EE.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF692A.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6A5C.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6A9E.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6BC8.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6C04.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7323.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7648.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.Word\~WRF1684.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.Word\~WRS3595.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\cwgtdd_PORTALHomepage_8[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\omnes-medium-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\omnes-regular-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\RDGE5Q6S\helveticaroundedltstd-bd-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\adCAK89V2P.htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\ebay-iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\pie[1].htc moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9LN0O4G6\adCAQ94Z2O.htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9LN0O4G6\play-to-win-iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\WINDOWS\temp\Max\2E11D3B_SDV1.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11D3B_SDV1.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E11D6A_SDV2.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11D6A_SDV2.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E11ED1_SDV3.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11ED1_SDV3.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV4.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV4.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV5.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV5.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1227B_SDV7.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1227B_SDV7.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E12402_SDV8.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E12402_SDV8.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E16F14_SPDBNM not found!
File\Folder C:\WINDOWS\temp\Max\2E16F14_SPDBSEC not found!

Registry entries deleted on Reboot...

Gouge · Feb 9, 2012

Just about to go to bed!! Anyway I've run the files as requested and here are the results:

All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\*.update\ deleted successfully.
Invalid CLSID key: *.update
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\*.update\ not found.
Invalid CLSID key: *.update
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\update\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\update\ not found.
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\windows,update.com\download\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 41085 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 13689508 bytes
->Flash cache emptied: 41085 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 42478 bytes
->Flash cache emptied: 470 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 728489 bytes
->Temporary Internet Files folder emptied: 30545423 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 61512122 bytes
->Google Chrome cache emptied: 6171858 bytes
->Flash cache emptied: 41519 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 41085 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 126185094 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 39520 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 1640748 bytes
RecycleBin emptied: 719052 bytes

Total Files Cleaned = 230.00 mb

[EMPTYJAVA]

User: Administrator
->Java cache emptied: 0 bytes

User: All Users

User: Default User
->Java cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Owner
->Java cache emptied: 0 bytes

User: UpdatusUser
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

User: UpdatusUser
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 02092012_225158

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF30AF.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF48DA.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF61DB.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF68EE.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF692A.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6A5C.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6A9E.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6BC8.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6C04.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7323.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7648.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.Word\~WRF1684.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.Word\~WRS3595.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\cwgtdd_PORTALHomepage_8[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\omnes-medium-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\omnes-regular-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\RDGE5Q6S\helveticaroundedltstd-bd-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\adCAK89V2P.htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\ebay-iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\pie[1].htc moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9LN0O4G6\adCAQ94Z2O.htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9LN0O4G6\play-to-win-iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\WINDOWS\temp\Max\2E11D3B_SDV1.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11D3B_SDV1.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E11D6A_SDV2.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11D6A_SDV2.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E11ED1_SDV3.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11ED1_SDV3.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV4.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV4.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV5.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV5.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1227B_SDV7.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1227B_SDV7.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E12402_SDV8.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E12402_SDV8.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E16F14_SPDBNM not found!
File\Folder C:\WINDOWS\temp\Max\2E16F14_SPDBSEC not found!

Registry entries deleted on Reboot...

Farbar Service Scanner Version: 08-02-2012
Ran by Owner (administrator) on 09-02-2012 at 23:15:42
Running from "C:\Documents and Settings\Owner\Desktop"
Microsoft Windows XP Home Edition Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
===========

File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll
[2006-02-28 12:00] - [2006-05-19 12:59] - 0111616 ____A (Microsoft Corporation) EF545E1A4B043DA4C84E230DD471C55F

C:\WINDOWS\system32\Drivers\afd.sys
[2006-02-28 12:00] - [2008-08-14 09:51] - 0138368 ____A (Microsoft Corporation) 55E6E1C51B6D30E54335750955453702

C:\WINDOWS\system32\Drivers\netbt.sys
[2006-02-28 12:00] - [2006-02-28 12:00] - 0162816 ____A (Microsoft Corporation) 0C80E410CD2F47134407EE7DD19CC86B

C:\WINDOWS\system32\Drivers\tcpip.sys
[2006-02-28 12:00] - [2008-06-20 10:45] - 0360320 ____A (Microsoft Corporation) 2A5554FC5B1E04E131230E3CE035C3F9

C:\WINDOWS\system32\Drivers\ipsec.sys
[2006-02-28 12:00] - [2006-02-28 12:00] - 0074752 ____A (Microsoft Corporation) 64537AA5C003A6AFEEE1DF819062D0D1

C:\WINDOWS\system32\dnsrslvr.dll
[2006-02-28 12:00] - [2008-02-20 05:32] - 0045568 ____A (Microsoft Corporation) AAC8FFBFD61E784FA3BAC851D4A0BD5F

C:\WINDOWS\system32\ipnathlp.dll
[2006-02-28 12:00] - [2006-02-28 12:00] - 0331264 ____A (Microsoft Corporation) 36CC8C01B5E50163037BEF56CB96DEFF

C:\WINDOWS\system32\netman.dll
[2006-02-28 12:00] - [2005-08-22 18:29] - 0197632 ____A (Microsoft Corporation) 36739B39267914BA69AD0610A0299732

C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-12-08 16:58] - [2006-02-28 12:00] - 0144896 ____A (Microsoft Corporation) F399242A80C4066FD155EFA4CF96658E

C:\WINDOWS\system32\srsvc.dll
[2008-12-08 17:00] - [2006-02-28 12:00] - 0170496 ____A (Microsoft Corporation) 92BDF74F12D6CBEC43C94D4B7F804838

C:\WINDOWS\system32\Drivers\sr.sys
[2008-12-08 17:00] - [2006-02-28 12:00] - 0073472 ____A (Microsoft Corporation) E41B6D037D6CD08461470AF04500DC24

C:\WINDOWS\system32\wscsvc.dll
[2006-02-28 12:00] - [2006-02-28 12:00] - 0081408 ____A (Microsoft Corporation) 4D59DAA66C60858CDF4F67A900F42D4A

C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-12-08 16:58] - [2006-02-28 12:00] - 0144896 ____A (Microsoft Corporation) F399242A80C4066FD155EFA4CF96658E

C:\WINDOWS\system32\wuauserv.dll
[2008-12-08 17:01] - [2006-02-28 12:00] - 0006656 ____A (Microsoft Corporation) 13D72740963CBA12D9FF76A7F218BCD8

C:\WINDOWS\system32\qmgr.dll
[2008-12-08 17:01] - [2006-02-28 12:00] - 0382464 ____A (Microsoft Corporation) 2C69EC7E5A311334D10DD95F338FCCEA

C:\WINDOWS\system32\es.dll
[2006-02-28 12:00] - [2008-07-07 20:32] - 0253952 ____A (Microsoft Corporation) 60D1A6342238378BFB7545C81EE3606C

C:\WINDOWS\system32\cryptsvc.dll
[2006-02-28 12:00] - [2006-02-28 12:00] - 0060416 ____A (Microsoft Corporation) 10654F9DDCEA9C46CFB77554231BE73B

C:\WINDOWS\system32\svchost.exe
[2006-02-28 12:00] - [2006-02-28 12:00] - 0014336 ____N (Microsoft Corporation) 8F078AE4ED187AAABC0A305146DE6716

C:\WINDOWS\system32\rpcss.dll
[2006-02-28 12:00] - [2009-02-09 10:20] - 0399360 ____A (Microsoft Corporation) 01095FEBF33BEEA00C2A0730B9B3EC28

C:\WINDOWS\system32\services.exe
[2006-02-28 12:00] - [2009-02-06 17:14] - 0110592 ____A (Microsoft Corporation) 37561F8D4160D62DA86D24AE41FAE8DE

Extra List:
=======
AegisP(23) epfwtdir(15) Gpc(3) IPSec(5) NetBT(6) PSched(7) StreamSurge(11) Tcpip(4)
0x170000000500000001000000020000000300000004000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F0000001000000011000000120000001300000014000000150000001600000017000000

**** End of log ****
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 2 x86
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET NOD32 Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Max Spyware Detector
SUPERAntiSpyware Free Edition
TuneUp Utilities Language Pack (en-GB)
Driver Cleaner.NET
Java(TM) 6 Update 30
Adobe Flash Player 11.1.102.55
Adobe Reader X (10.1.2)
Mozilla Firefox (Firefox, Opera, Netscape only..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````

F-Secure Scan Report

7 malware found
TrackingCookie.Advertising (spyware)
System (Disinfected)
TrackingCookie.Atdmt (spyware)
System (Disinfected)
TrackingCookie.Doubleclick (spyware)
System (Disinfected)
TrackingCookie.Adbrite (spyware)
System (Disinfected)
TrackingCookie.Mediaplex (spyware)
System (Disinfected)
TrackingCookie.Atwola (spyware)
System (Disinfected)
TrackingCookie.Yieldmanager (spyware)
System (Disinfected)

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 5181
System: 5181
Not scanned: 0
Actions:
Disinfected: 7
Renamed: 0
Deleted: 0
Not cleaned: 0
Submitted: 0

--------------------------------------------------------------------------------

Options
Scanning engines:

--------------------------------------------------------------------------------

Copyright © 1998-2009 Product support | Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name. This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

Broni · Feb 9, 2012

You still owe me F-Secure scan.

Gouge · Feb 10, 2012

It was the final file sent :

I've run the scan again this morning and results below:

Scanning Report
Friday, February 10, 2012 09:44:25 - 09:48:21
Computer name: MARTINPC
Scanning type: Quick scan
Target: System

--------------------------------------------------------------------------------

No malware found

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 5188
System: 5188
Not scanned: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Not cleaned: 0
Submitted: 0

--------------------------------------------------------------------------------

Options
Scanning engines:

--------------------------------------------------------------------------------

Copyright © 1998-2009 Product support | Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name. This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

Broni · Feb 10, 2012

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current (including Service Pack 3 installation!!!)

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

Gouge · Feb 10, 2012

Thanks for all your help Broni.

BTW I am now getting a message that jushed.exe has encountered a problem (Java). Had it a couple of times when I reboot.

OK, first of all, here is the OTL log (Stage 1):

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 35307 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 180018008 bytes
->Temporary Internet Files folder emptied: 1508646 bytes
->Java cache emptied: 29632 bytes
->FireFox cache emptied: 105652979 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 470 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 110464546 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 379.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

User: UpdatusUser
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: Administrator
->Java cache emptied: 0 bytes

User: All Users

User: Default User
->Java cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Owner
->Java cache emptied: 0 bytes

User: UpdatusUser
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.31.0 log created on 02102012_194432

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Max\22BB6A2_SDV1.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BB6A2_SDV1.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\22BB6E0_SDV2.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BB6E0_SDV2.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\22BB848_SDV3.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BB848_SDV3.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\22BBBD2_SDV4.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BBBD2_SDV4.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\22BBBD2_SDV5.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BBBD2_SDV5.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\22BBC20_SDV7.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BBC20_SDV7.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\22BBDB6_SDV8.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\22BBDB6_SDV8.DB_SEC not found!

Registry entries deleted on Reboot...

Broni · Feb 10, 2012

Disable jusched.exe as a startup: http://www.howtogeek.com/howto/windows-vista/what-is-juschedexe-and-why-is-it-running/

Gouge · Feb 11, 2012

When I bought my PC several years ago it was configured for audio/music production. I was advised not to update to SP3 as it, reportedly, conflicted with some of the music software. However, I've heard nothing more recently so I have updated to XP SP3. It failed the first time, but second time successful. There then followed 68 updates, which were really appreciated at 11.45pm!! Anyway, all ok now.

I ran PSI and managed to get from 80% to 92%. I'll try to sort out the remainder today.

I'll also run the File Hippo Update Checker.

The PC seems far more responsive now, thanks. I've still got a lot of programs installed so I think I'll do a serious cull of those that I don't use now.

I'll monitor how things go over the weekend and come back to you early next week to report.

Thanks again for all of your assistance in cleaning up my PC. I might ask you to do the same with my old laptop!!

Do I start a new thread for the problem with linking my PC and MacBook wirelessly?

Broni · Feb 11, 2012

Do I start a new thread for the problem with linking my PC and MacBook wirelessly?

Yes.

Good luck and stay safe

Gouge · Feb 11, 2012

Thanks, Broni.

Keep the faith!!

Broni · Feb 11, 2012

You're very welcome

Gouge · Feb 13, 2012

Just to confirm PC is back to normal speed now. Wonderful. No problems other than the DWWIN.EXE annoyance - just can't get rid of it!!

I'll just put up with it I guess.

Broni · Feb 13, 2012

I suggest you start new topic in Windows forum.

Solved PC running slowly

Broni

Posts: 56,041 +516

Gouge

Posts: 128 +0

Gouge

Posts: 128 +0

Broni

Posts: 56,041 +516

Gouge

Posts: 128 +0

Broni

Posts: 56,041 +516

Gouge

Posts: 128 +0

Broni

Posts: 56,041 +516

Gouge

Posts: 128 +0

Broni

Posts: 56,041 +516

Gouge

Posts: 128 +0

Broni

Posts: 56,041 +516

Gouge

Posts: 128 +0

Broni

Posts: 56,041 +516

Similar threads

Latest posts