When you ran Mawarebytes, you didn't check the line that instructs the program to remove what it finds- so it's still there. Please update Mbam, take care to check this:
Make sure that everything is checked, and click Remove Selected.
The SAS log shows malware in a System Restore file. That means it is not active in your system. Don't do a restore as you could reinfect the system. Old restore points are removed at the end of cleaning.
If your system is slow to load, slow to surf and slow to shut down, the main reason is that you have way to many processes starting on boot. All of these continue to run in the background and can eventually cause the system to crash when the available RAM has been used. Then you reboot the computer, it frees up the RAM and the cycle starts all over again.
Let's do some house keeping:
All of the entries below are legitimate entries. None of them need to start on boot and run in the background.
Please reopen HJT to
'do system scan only.' Check all of the entries, then
handle Services additionally as indicated: I have given you descriptions of most entries.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe>> (Used by iTunes to communicate with the Apple iPhone when it is connected to your computer.)
C:\Program Files\Bonjour\mDNSResponder.exe>> (installed with the iTunes software. Apple's site describes: "Bonjour, also known as zero-configuration networking, enables automatic discovery of computers, devices, and services on IP networks.")
C:\WINDOWS\system32\CTsvcCDA.exe>> (Creative Service for CD-ROM Access.)
C:\Program Files\Java\jre6\bin\jqs.exe>> (Java Quick Start)
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\OpenCASE\OpenCASE Media Agent\MediaAgent.exe>> (The OpenCase Media Agent is a service that is installed with NBC Direct in Windows that is automatically started when Windows starts.Very high resource user(30mb))
C:\WINDOWS\system32\MsPMSPSv.exe>> (Windows Media Player update that allows you to use the Secure Digital Music Initiative protocol )
C:\Program Files\Microsoft ActiveSync\wcescomm.exe>> (for use with Windows CE based palm PC)
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe>> Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory
C:\WINDOWS\system32\ctfmon.exe>> >> language/alternative input services in Office XP.
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe>> take off of Startup
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe>> ("messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners")
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe>> Uninstall Registry Cleaner
The following are all for the HP Digital Imaging program> None need to start on boot:
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
Check each of the Services below. When finished with HJT, follow the additional instructions for the Services.
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: OpenCASE Media Agent - ExtendMedia Inc. - C:\Program Files\OpenCASE\OpenCASE Media Agent\MediaAgent.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
Close all Windows except HijackThis and click on
"Fix Checked."
Boot into Safe Mode
- Restart your computer and start pressing the F8 key on your keyboard.
- Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.
Start> Run> type in
services.msc> right click on each of the following and set Startup type as instructed:
Apple Mobile Device - Manual
Bonjour- Manual
CLTNetCnService- Disable. LEft over from symantec security.
Creative Service for CDROM Access- Manual
gusvc- Disable (Google udater)
InstallDriver Table Manager (IDriverT) - Manual
iPod Service - Manual
JavaQuickStarterService (jqs)- Disable
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
OpenCASE Media Agent - Disable OR Manual if using intermittently
RoxLiveShare9- Disable
Reboot into Normal Mode.
Attach the new Mbam log. Rescan with HJT and include new log.
Let me know if you notice any difference.
