i am sick of this!

[TheJamsh]

my computer takes so freaking long to boot up and i know theres a virus on it somewhere! what can i delete from this? i ONLY want core files to run when i boot up, im sick off all these stupid program extras that i dont need!

ive done a hijackthis log. PLEASE help...

Code Select Expand


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:06:46, on 27/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:en
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1001\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Hayley')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1003\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Steve')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1004\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Daniel')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1005\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1001 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Hayley')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1001 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Hayley')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1002 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Nikki')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1002 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Nikki')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1003 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Steve')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1003 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Steve')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1004 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Daniel')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1004 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Daniel')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 User Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Matthew')
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEE6E4ED-FF76-4A13-AFB0-911D40CB61E9}: NameServer = 212.139.132.57 212.139.132.56
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe

--
End of file - 9678 bytes


[Red Devil]

Start/Run/MSConfig

[Steeveeo]

http://hjt.networktechs.com/

Input the entire logfile there.

[Sonic]

Autoruns

[Axeminister]

from my one experience with hijackthis I can tell you about two things for sure that you could delete.

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


But to turn a lot more off I would suggest using the tool that Sonic linked to.

[Nielk1]

That website that S linked assumes that things are viruses when they are not. If it sees an EXE that some virus SOMEWHERE pretends to be, and you have the real program, it will claim it is the virus. Many checkers and log scanners do that. Ctfmon.exe is an office service, but the site S linked claimed mine was a virus. It is not. I am clean except for 2 blank entries and that false positive.

[Wraith]

from my one experience with hijackthis I can tell you about two things for sure that you could delete.

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


But to turn a lot more off I would suggest using the tool that Sonic linked to.

I agree with fixing those two as well as these others.

R0 - HKCU\Software\Microsoft\InternetExplorer\Toolbar,LinksFolderName =

R0 - HKLM\Software\Microsoft\InternetExplorer\Search,CustomizeSearch =

O13 - Gopher Prefix:

This is common but optional.

O1 - Hosts: ::1 localhost

This is either your service provider or a backdoor.

O17 -HKLM\System\CCS\Services\Tcpip\..\{BEE6E4ED-FF76-4A13-AFB0-911D40CB61E9}: NameServer =212.139.132.57 212.139.132.56

O4 -HKUS\S-1-5-21-3989726456-2758828616-1621172196-1005\..\Run: [WindowsWelcomeCenter] rundll32.exeoobefldr.dll,ShowWelcomeCenter Cant find anything on this one so you may want to look into it.

Also remove limewire and use something safer.

Ccleaner Works very well for me. Windows and Applications tabs you can check everything but as for the Registry have everything checked except these. (Also do not use more then one registry cleaner at a time)

Unused File Extensions
ActiveX and Class Issues
Installer

Also you can delete or disable what you dont need in Ccleaner Tools and startup menu.
Also comes with its Uninstaller just like Windows Add/Remove.

Link for CCleaner is here ----> http://www.filehippo.com/download_ccleaner/

Any questions?

[Steeveeo]

That website that S linked assumes that things are viruses when they are not. If it sees an EXE that some virus SOMEWHERE pretends to be, and you have the real program, it will claim it is the virus. Many checkers and log scanners do that. Ctfmon.exe is an office service, but the site S linked claimed mine was a virus. It is not. I am clean except for 2 blank entries and that false positive.

Dont beat it down so much, it says right on it that some programs return a false positive, and you should do at least SOME research into what it is before you kill it.

[Nielk1]

Steeveeo, DO NOT OVER-REACT. I was just pointing out it was wrong in that case. I;m sorry if posting the actual details of a case it is incorrect makes me look like I am bashing it, which I AM NOT.

[Steeveeo]

Steeveeo, DO NOT OVER-REACT. I was just pointing out it was wrong in that case. I;m sorry if posting the actual details of a case it is incorrect makes me look like I am bashing it, which I AM NOT.

How was that overreacting on my part? Does telling someone to not be so harsh on something/someone else equate to overreacting nowadays?

Instead, it rather sounded, how it was typed at least, that you were telling him to shy away from the log analyzer like the plague because it detected a single false positive.

[Nielk1]

Well if I used italics instead of CAPS you would likely accuse me of sarcasm and then the same thing. I just feel like everything I say you have a comment on and it makes me rather DEFENSIVE.

What I said is still true, as pure cold facts (which as I told S, are what should be used in all cases, unless the majority oppinion is needed for something qualitative).

EDIT: I should run that on my laptop too...

[Arbystrider]

This is what I'm known for =D

You open up MSConfig, then select the boot tab, then check the OS boot information box. Reboot your computer and when the screen looks like a DOS Field and it's loading system files, scrutinize that list for any suspicious stuff. Then, update your anvtivirus (if you think it's a virus, I highly recommend Malwarebytes' since I use it too and it pwnz, RLY!) and run a scan. After that, if it doesn't work, try OPTIMIZATION instead.

Enable the Boot Defragment function (check http://www.youtube.com/watch?v=8HQFNPcuz0w ) and then run a registry cleaner and a registry defrag. Then use MSConfig to disable any unnecessary start-up programs.

If it STILL doesn't work, you're ded (lol). OKAY, it may be a virus

If it's getting better, get your hands on some heavy guns (BoostSpeed, just the trial) and blow that #$%! that's slowin' ya down outta your computer. PLEASE don't buy it you probably only need it for once since I can't give you an alternative of each for its programs. This can work unless it's really a virus.

And yeah, CCleaner is a good cleaner and registry cleaner, but doesn't fix many registry errors.

About the "This is what I'm known for =D", that's among my MSN and MapleSEA friends since they just suck with computers.

Sorry, was also known for spamming and advertising on the FM in MapleSEA =(

[Zero Angel]

Yea, that NameServer entry bothers me. The normal route is that every request that you send out to the internet gets routed through the following

Your PC -> Your Router -> Your ISP -> Your ISP's namservers (if applicable) -> A remote nameserver -> The destination that your website -- pointed to by the DNS of your ISP or another nameserver

What Nameserver does is redirect all requests of websites (like bzuniverse.com -- to ip addresses), so if symantec.com would normally point to 212.52.21.14, then the nameserver could redirect it to any arbitrary IP address on the internet like 41.230.125.23 which would actually go to a website like spywareinfect.com

This is almost certainly a sign of a virus, unless you have some sort of 'net nanny' software installed or are using a corporate network which is supposed to do this.

[GSH]

Best procedure: reformat & reinstall.

Before you do so, do check if your HD or an optical drive somehow got dropped to PIO mode, instead of (Ultra)DMA. If that happens, everything'll crawl.

-- GSH

[TheJamsh]

okay my questions are this:

how do i find out about PIO/DMA information?
next, because im tired and cant understand much atm, could i have a simple list of what i should or can delete.

finally, i have used cCleaner for years and it is indeed very good for a free program.

one further note, i do keep getting 'Intrusion Prevention' messages from kaspersky. it blocks most of them but i cant help but feel something will get through eventually.