my computer takes so freaking long to boot up and i know theres a virus on it somewhere! what can i delete from this? i ONLY want core files to run when i boot up, im sick off all these stupid program extras that i dont need!
ive done a hijackthis log. PLEASE help...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:06:46, on 27/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:en
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1001\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Hayley')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1003\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Steve')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1004\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Daniel')
O4 - HKUS\S-1-5-21-3989726456-2758828616-1621172196-1005\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1001 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Hayley')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1001 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Hayley')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1002 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Nikki')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1002 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Nikki')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1003 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Steve')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1003 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Steve')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1004 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Daniel')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1004 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Daniel')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 User Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Matthew')
O4 - S-1-5-21-3989726456-2758828616-1621172196-1005 User Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Matthew')
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEE6E4ED-FF76-4A13-AFB0-911D40CB61E9}: NameServer = 212.139.132.57 212.139.132.56
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
--
End of file - 9678 bytes
Start/Run/MSConfig
http://hjt.networktechs.com/
Input the entire logfile there.
Autoruns (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx)
from my one experience with hijackthis I can tell you about two things for sure that you could delete.
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
But to turn a lot more off I would suggest using the tool that Sonic linked to.
That website that S linked assumes that things are viruses when they are not. If it sees an EXE that some virus SOMEWHERE pretends to be, and you have the real program, it will claim it is the virus. Many checkers and log scanners do that. Ctfmon.exe is an office service, but the site S linked claimed mine was a virus. It is not. I am clean except for 2 blank entries and that false positive.
Quote from: Axeminister on January 28, 2009, 02:24:10 AM
from my one experience with hijackthis I can tell you about two things for sure that you could delete.
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
But to turn a lot more off I would suggest using the tool that Sonic linked to.
I agree with fixing those two as well as these others.
R0 - HKCU\Software\Microsoft\InternetExplorer\Toolbar,LinksFolderName =
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,CustomizeSearch =
O13 - Gopher Prefix:
This is common but optional.
O1 - Hosts: ::1 localhost
This is either your service provider or a backdoor.
O17 -HKLM\System\CCS\Services\Tcpip\..\{BEE6E4ED-FF76-4A13-AFB0-911D40CB61E9}: NameServer =212.139.132.57 212.139.132.56
O4 -HKUS\S-1-5-21-3989726456-2758828616-1621172196-1005\..\Run: [WindowsWelcomeCenter] rundll32.exeoobefldr.dll,ShowWelcomeCenter Cant find anything on this one so you may want to look into it.
Also remove limewire and use something safer.
Ccleaner Works very well for me. Windows and Applications tabs you can check everything but as for the Registry have everything checked except these. (Also do not use more then one registry cleaner at a time)
Unused File Extensions
ActiveX and Class Issues
Installer
Also you can delete or disable what you dont need in Ccleaner Tools and startup menu. :)
Also comes with its Uninstaller just like Windows Add/Remove.
Link for CCleaner is here ----> http://www.filehippo.com/download_ccleaner/
Any questions?
Quote from: Nielk1 on January 28, 2009, 02:30:35 AM
That website that S linked assumes that things are viruses when they are not. If it sees an EXE that some virus SOMEWHERE pretends to be, and you have the real program, it will claim it is the virus. Many checkers and log scanners do that. Ctfmon.exe is an office service, but the site S linked claimed mine was a virus. It is not. I am clean except for 2 blank entries and that false positive.
Dont beat it down so much, it says right on it that some programs return a false positive, and you should do at least SOME research into what it is before you kill it.
Steeveeo, DO NOT OVER-REACT. I was just pointing out it was wrong in that case. I;m sorry if posting the actual details of a case it is incorrect makes me look like I am bashing it, which I AM NOT.
Quote from: Nielk1 on January 28, 2009, 08:15:33 AM
Steeveeo, DO NOT OVER-REACT. I was just pointing out it was wrong in that case. I;m sorry if posting the actual details of a case it is incorrect makes me look like I am bashing it, which I AM NOT.
How was that overreacting on my part? Does telling someone to not be so harsh on something/someone else equate to overreacting nowadays?
Instead, it rather sounded, how it was typed at least, that you were telling him to shy away from the log analyzer like the plague because it detected a single false positive.
Well if I used italics instead of CAPS you would likely accuse me of sarcasm and then the same thing. I just feel like everything I say you have a comment on and it makes me rather DEFENSIVE.
What I said is still true, as pure cold facts (which as I told S, are what should be used in all cases, unless the majority oppinion is needed for something qualitative).
EDIT: I should run that on my laptop too...
This is what I'm known for =D
You open up MSConfig, then select the boot tab, then check the OS boot information box. Reboot your computer and when the screen looks like a DOS Field and it's loading system files, scrutinize that list for any suspicious stuff. Then, update your anvtivirus (if you think it's a virus, I highly recommend Malwarebytes' since I use it too and it pwnz, RLY!) and run a scan. After that, if it doesn't work, try OPTIMIZATION instead.
Enable the Boot Defragment function (check http://www.youtube.com/watch?v=8HQFNPcuz0w ) and then run a registry cleaner and a registry defrag. Then use MSConfig to disable any unnecessary start-up programs.
If it STILL doesn't work, you're ded (lol). OKAY, it may be a virus
If it's getting better, get your hands on some heavy guns (BoostSpeed, just the trial) and blow that #$%! that's slowin' ya down outta your computer. PLEASE don't buy it you probably only need it for once since I can't give you an alternative of each for its programs. This can work unless it's really a virus.
And yeah, CCleaner is a good cleaner and registry cleaner, but doesn't fix many registry errors.
About the "This is what I'm known for =D", that's among my MSN and MapleSEA friends since they just suck with computers.
Sorry, was also known for spamming and advertising on the FM in MapleSEA =(
Yea, that NameServer entry bothers me. The normal route is that every request that you send out to the internet gets routed through the following
Your PC -> Your Router -> Your ISP -> Your ISP's namservers (if applicable) -> A remote nameserver -> The destination that your website -- pointed to by the DNS of your ISP or another nameserver
What Nameserver does is redirect all requests of websites (like bzuniverse.com -- to ip addresses), so if symantec.com would normally point to 212.52.21.14, then the nameserver could redirect it to any arbitrary IP address on the internet like 41.230.125.23 which would actually go to a website like spywareinfect.com
This is almost certainly a sign of a virus, unless you have some sort of 'net nanny' software installed or are using a corporate network which is supposed to do this.
Best procedure: reformat & reinstall.
Before you do so, do check if your HD or an optical drive somehow got dropped to PIO mode, instead of (Ultra)DMA. If that happens, everything'll crawl.
-- GSH
okay my questions are this:
how do i find out about PIO/DMA information?
next, because im tired and cant understand much atm, could i have a simple list of what i should or can delete.
finally, i have used cCleaner for years and it is indeed very good for a free program.
one further note, i do keep getting 'Intrusion Prevention' messages from kaspersky. it blocks most of them but i cant help but feel something will get through eventually.
For PIO mode, see http://support.microsoft.com/kb/817472 (http://support.microsoft.com/kb/817472) , http://winhlp.com/node/10 (http://winhlp.com/node/10) , or http://users.bigpond.net.au/ninjaduck/itserviceduck/uDMA_fix/ (http://users.bigpond.net.au/ninjaduck/itserviceduck/uDMA_fix/) . Took me 5 seconds to search google -- see http://www.google.com/search?client=opera&rls=en&q=pio+mode&sourceid=opera&ie=utf-8&oe=utf-8 (http://www.google.com/search?client=opera&rls=en&q=pio+mode&sourceid=opera&ie=utf-8&oe=utf-8) . You can do the same.
-- GSH
as for PIO mode, it seems that vista doesnt suffer from it. Or rather there is no available hotfix for it, so ill assume for now its not that.
what i CAN see, is that both svchost.exe and explorer.exe take up a LOT of cpu time, and never used to. My old XP laptop developed the same issue after a year or so...
Clean your registry?
i do it almost every day, along with history, cookies the whole lot
thanks for the help GSH
Is this about the NameServer Registry entry? I've taken it out before, use Malwarebytes'.
Somebody help me take out DHCPNameServer!!! (Yeah, nothing kills THAT one)
Do you know the reason why DHCPNameServer can't be removed? It's kind of necessary for Windows. Google it for more info.
VSMIT.
oh GSH, what would a safer alternative to limewire be? (besides not having a P2P program of course)
I use Azures Vuze bittorent. It has tons of legal content, can do normal torrents to, has lots of plugins you can get, etc.
The main thing is, it has a whole legal section and media browser. I do not use the media player/server options though.
Quote from: VSMIT on January 29, 2009, 08:37:15 AM
Do you know the reason why DHCPNameServer can't be removed? It's kind of necessary for Windows. Google it for more info.
VSMIT.
I have those disabled, but than again, I have a static IP and my own DNS server sitting in my network.
I do, too, but somehow I doubt that Arbystrider is sitting on a network with his own DNS server.
VSMIT.
Yep, no networking with other computers. I mean, WHY would anybody build one?
Anyhoo, uTorrent is the safest, and fastest. Just look at everybody else.
How can you be sure it is the safest, what is your rational? It is just another simple torrent program like any other? That and it has nothing in it that screams 'I am for legal purposes".
Quote from: Nielk1 on January 30, 2009, 04:28:28 PM
How can you be sure it is the safest, what is your rational? It is just another simple torrent program like any other? That and it has nothing in it that screams 'I am for legal purposes".
Well, Its default setting are the fastest, so you don;t need to modify anything. It's also got a simple, clean GUI. Plus a progress bar you can sticky around on your screen.
Quote from: Arbystrider on January 31, 2009, 07:12:42 AM
Well, Its default setting are the fastest, so you don;t need to modify anything. It's also got a simple, clean GUI. Plus a progress bar you can sticky around on your screen.
I agree with ARby. Utorrent is pretty fast and uses up the less ram out of the bunch.
Azures Vuze does have a lot of crap in it :-P
I still like it since even when all trackers for a torrent are down it can still find and access pears from any client capable of decentralized tracking. ATM I think that only means other Vuze clients.
Crap = Waste of Space. Get uTorrent. It's only a single .EXE, and only less than 500 KB!!! (The last time I checked)
I am using what I want to use and here is why:
- Able to find peers without any tracker
- Able to get tons of plugins.
- It is java so it IS also only 1 file (a jar) unless you decide to get addons, which are also single files.
- It has a built in media server.
- It can playmedia inside of it.
- It has a ton of legal downloads in it.
- It has peer boosts for friends on friend lists.
- It has built in updating with the ability to select the version you want and it normally does not need to restart even the program to update.
I have had some overloading malfunctions do to the limits of the Java VM itself, but no one should tax these programs like I do.
/me checks Azures and ram use... is surprised by how little it uses.
It is run in a Java VM so it never actually touches my PC aside from the files themselves and the obvious use of RAM/CPU.
Is there a way to schedule downloads in Azureus? In utorrent, I find that limiting my dl speeds for all hours of the day except for the hours in which downloads don't cout towards the daily limit.
I believe. If it is not already in Azures it would be a plugin downloaded and activated seamlessly from inside the program.