Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Slow bootup and slow response

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Slow bootup and slow response

Unread postby fig » August 21st, 2007, 1:27 pm

My computer has been bogged down lately and I can't seem to figure it out. I'm getting a lot of PUPs and Program Access prompts from McAfee.

Here's my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 1:26:38 PM, on 8/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
G:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
g:\program files\common files\mcafee\mna\mcnasvc.exe
G:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
G:\PROGRA~1\McAfee\MSC\mcpromgr.exe
g:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
G:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
G:\Program Files\McAfee\MPF\MPFSrv.exe
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\explorer.exe
G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Internet Explorer\iexplore.exe
G:\WINDOWS\system32\dllhost.exe
G:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\New Folder\docs\jTools\spyware\tools\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Editor plugin - {2C91577A-5253-492c-89A6-DA08849A3298} - reccon.dll (file missing)
O2 - BHO: (no name) - {55431DD1-8795-4AF3-8FA0-D645DF7910D4} - G:\WINDOWS\system32\werweb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - g:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - G:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - G:\WINDOWS\system32\tmp18.tmp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" G:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [MSConfig] G:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "G:\WINDOWS\efddcb.dll",forkonce
O4 - HKLM\..\RunOnce: [SpybotDeletingA2934] command /c del "G:\WINDOWS\system32\mordex.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4582] cmd /c del "G:\WINDOWS\system32\mordex.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [VundoFix] "L:\\vundofix.exe"
O4 - HKLM\..\RunOnce: [AskSBar Uninstall] rundll32 G:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKLM\..\RunOnce: [SpybotDeletingA1600] command /c del "G:\Documents and Settings\fig\Application Data\tmp2.tmp.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8877] cmd /c del "G:\Documents and Settings\fig\Application Data\tmp2.tmp.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3361] command /c del "G:\WINDOWS\system32\mordex.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC986] cmd /c del "G:\WINDOWS\system32\mordex.dll_tobedeleted"
O4 - HKCU\..\Run: [DDC] G:\WINDOWS\system32\qwerty12.exe
O4 - HKCU\..\Run: [swg] G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - G:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.drivecleaner.com
O15 - Trusted Zone: *.errorprotector.com
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantispyware.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/fi ... tup163.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: g:\windows\system32\geebbxw.dll
O20 - Winlogon Notify: mordex - G:\WINDOWS\SYSTEM32\mordex.dll
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - G:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - G:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - G:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - G:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - g:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - G:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - G:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - g:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - G:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - G:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - G:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe

Any help is appreciated. Thanks.
fig
Regular Member
 
Posts: 16
Joined: June 9th, 2007, 12:08 pm
Advertisement
Register to Remove

Unread postby IndiGenus » August 21st, 2007, 3:04 pm

Hi fig and welcome to the forums.

My name is Dave. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can sometimes take a while to research so please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Everything I post must be checked by a teacher so please be patient as we go through the fix.

For now we are going to use HJT to create a list of your currently installed programs.
    1. Open HijackThis and click on the Config... button in the "Other stuff" section (lower right hand corner).
    2. Click on the Misc Tools button.
    3. Click on the Open Uninstall Manager... button.
    4. Click on the Save list... button.
    5. Save the file uninstall_list.txt to a convinient location. This should open Notepad with the list.
    6. Please Copy and Paste the list into your next reply.
User avatar
IndiGenus
Regular Member
 
Posts: 657
Joined: February 2nd, 2005, 1:49 pm
Location: New England, USA

Unread postby fig » August 21st, 2007, 8:59 pm

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 8:56:58 PM, on 8/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Safe mode with network support

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
G:\WINDOWS\Explorer.EXE
G:\Documents and Settings\fig\Desktop\jTools_pkg_4.0.2\spyware\tools\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org/
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - G:\Program Files\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - G:\Program Files\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Editor plugin - {2C91577A-5253-492c-89A6-DA08849A3298} - reccon.dll (file missing)
O2 - BHO: (no name) - {55431DD1-8795-4AF3-8FA0-D645DF7910D4} - G:\WINDOWS\system32\werweb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - g:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - G:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - G:\WINDOWS\system32\tmp18.tmp.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - G:\Program Files\AskSBar\bar\2.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - G:\Program Files\AskSBar\bar\2.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" G:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [MSConfig] G:\Documents and Settings\fig\Desktop\jTools_pkg_4.0.2\spyware\tools\msconfig.exe /auto
O4 - HKCU\..\RunOnce: [SpybotDeletingB7734] command /c del "G:\Documents and Settings\fig\Application Data\tmp19.tmp.exe_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4494] cmd /c del "G:\Documents and Settings\fig\Application Data\tmp19.tmp.exe_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1818] command /c del "G:\WINDOWS\system32\mordex.dll_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5272] cmd /c del "G:\WINDOWS\system32\mordex.dll_tobedeleted"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - G:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O10 - Unknown file in Winsock LSP: g:\windows\system32\nwprovau.dll
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/fi ... tup163.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{6B550856-AAB7-4F81-B6D5-FAD4A5D3E193}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: g:\windows\system32\geebbxw.dll
O20 - Winlogon Notify: mordex - G:\WINDOWS\SYSTEM32\mordex.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - G:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - G:\WINDOWS\system32\browseui.dll
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - G:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - G:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - G:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - G:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - g:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - G:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - G:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - g:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - G:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - G:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - G:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6023 bytes


uninstall_list

Adobe Flash Player 9 ActiveX
Adobe Reader 8.1.0
Adobe® Photoshop® Album Starter Edition 3.2
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Avanquest update
Eye of the Storm 3000
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
GrabIt 1.7.1 Beta (build 960)
High Definition Audio Driver Package - KB888111
HijackThis 2.0.0
iTunes
Java(TM) 6 Update 2
McAfee SecurityCenter
Microsoft .NET Framework 2.0
Microsoft Flight Simulator X
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows XP Video Decoder Checkup Utility
mIRC
Motorola Driver Installation
Motorola Phone Tools
MSXML 4.0 SP2 Parser and SDK
Need for Speedâ„¢ Most Wanted
Nero 7 Premium
neroxml
NVIDIA Drivers
PokerStars.net
QuickTime
Realtek High Definition Audio Driver
Spy Sweeper
Steam
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
WinRAR archiver
fig
Regular Member
 
Posts: 16
Joined: June 9th, 2007, 12:08 pm

Unread postby IndiGenus » August 23rd, 2007, 7:21 am

Just noticed your version of HijackThis is out of date and a beta version. Please download the newest version, HijackThis v2.0.2.
Be sure to replace your old HijackThis.exe with this new one by saving over it or deleting your old one before downloading the current version.

Please repost a new updated log.
User avatar
IndiGenus
Regular Member
 
Posts: 657
Joined: February 2nd, 2005, 1:49 pm
Location: New England, USA

Unread postby IndiGenus » August 28th, 2007, 8:32 am

Hi fig,

Do you still need help? Please let us know.

Thanks
User avatar
IndiGenus
Regular Member
 
Posts: 657
Joined: February 2nd, 2005, 1:49 pm
Location: New England, USA

Unread postby askey127 » September 14th, 2007, 6:48 am

This topic is now closed due to inactivity. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 313 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware