HiJackThis log computer slow on start up/shut down

This computer hasn't been on the internet very often. (I plug in a ethernet cord from this computer to the Linksys box every once in awhile to get updates for my AV) Otherwise it sits independantly, not networked in any way to the other computers. We homeschool and it is used for computer school classes and games my kids play.

I want to get it ready to go on the internet regulaly because this year, we need to access the web with one of our school programs. I hadn't dl SP2 for My Windows XP so I did that first. I updated the AV, windows updates, and got Adaware, Spybot and CCleaner, ran all of them as well as the AV scan.

The computer started having a problem about midyear last year--slow on shutdown because something was still running in the background and always had to be shut down (end task). We thought it was the school program. (We used AlphaOmega's Switched-On School, if that is necessary to know) I just uninstalled everything to do with it, including deleting the folders. I need to instell this year's program soon, but the computer is still very slow at start up and shut down. When I hit ctl-alt-del, it seems an awful lot of processes are running--maybe too much?

Don't know if you needed all that info, but just in case you did, and here's my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 3:27:11 PM, on 9/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157313823984
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thank you, Navigator, for your help.

I read the Symptoms of infection page. It seemed This computer showed no signs of that type, except whatever it is that is running in the background slows the computer in it's shut down. I also got rid of the entries in the HiJack this, got rid of the old Java, installed the new, then went to Panda. And then I ran into a big problem. When I click the "scan your computer" button, the little window pops up for a split second, and disappears!

I've clicked on it several times, rebooted, tried again, and that window won't open. Am I missing something? There is another thing I could click--it's in the upper right, a pink link that says "Free use ActiveScan" should I try that?

Thanks

Hi Navigator
Sorry it took me so long to get back. As I said, this is a school computer, and it was in use most of the day yesterday, and I didn't get to iy last night. I figured out the problem with the Panda scan-- I have popup blocker enabled both in IE and from the yahoo toolbar. (btw, the yahoo toolbar came when I installed CCleaner. I don't really want the toolbar, but didn't know if it would affect the installation or usage of the CCleaner--can I get rid of that in Add/Remove Programs now without affecting the CCLeaner?)

I ended up running the scan from the other button on the page--the Javascript, because I hadn't figured out the pop up problem yet. My security settings are on medium for now.



The Panda scan:


Incident Status Location

Spyware:spyware/searchcentrix Not disinfected Windows Registry
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Cookies\owner@mediaplex[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt
Potentially unwanted tool:Application/PRScheduler Not disinfected C:\hijackthis\backups\backup-20060905-194958-781-PowerReg Scheduler.exe
Potentially unwanted tool:Application/HideWindow.A Not disinfected C:\hp\bin\FondleWindow.exe
Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe
Another question; I have automatic updates, but I went to Windows updates, to see if there are any "non-critical" updates needed. There are 7 software and 2 hardware items. I wonder if these would have anything to do with my school program that won't install properly. I'm getting a "unhandled exception error", and the "details" button says something about the JIT debugging. I'd like to know if you can explore this with me after we deal with the other scans.

Thanks

Hi Navigator
Thanks again for your assistance. Sorry I'm so long in getting back again. We have to share the 'puter time! LOL!

I kinda thought that Panda scan looked pretty harmless except that Registry entry. I get the heebie-jeebies just thinking about the Registry and had no idea what that meant! Glad to read it's probably harmless also.

I got rid of Yahoo's toolbar--sneaky lil bugger tries to install with a lot of things as I discovered when updating my son's musicmatch jukebox a couple days ago! I'll have to pay attention.

I went ahead and dl the other updates at Windows updates. Not much of a difference IMO, but my son says it is running faster. What I don't understand is what is running in the background that has to be shut down before windows shuts down? (the little box that pops up saying windows can't shut down til it ends some program that is running--it never tells what program that is) I believe you that it probably isn't malware or security related, or something would have shown up on the scans.

I appreciate the link to the site for checking about the possible software issue. I will do the exact google search first and check with the software developer. (there is a live support window--I tried it the other day, but was a couple hours early for their timezone)


Thanks for looking at my log and for all your help. We have 4 computers here, and I try to maintain what I have learned--running the scans for Adaware, Spybot and the other antispyware porgrams in the "How Did I Get Infected.." article, but I get stumped frequently!! I appreciate the time you've given me to help!



THANK YOU VERY MUCH!!!!!

Hi Navigator
I wasn't looking for the name of the app at the top of the box, only in the message. First couple times I tried to get the name, it flashed up on the screen so fast and was gone, I couldn't read it. So I set my son to the task. He finally got it it's ccApp no numbers, nothing else. The box came up twice, with each one taking a little longer to end the process.

I googled it. This is something to do with Symantec/Norton. The advice given to another person who was asking about it, was to go to Symantic and do an update and that should fix it. hmmmm, I'll try that, but I already have it checking for automatic updates every time this computer goes online.

As to the software problem with my school program, I did two things. I have two application discs for the two subjects from this provider. (AlphaOmega Switched onSchool). I had installed one of them, then ran into the problems (Long story short problem: the teacher program won't open properly to allow me to set up my school and install the subjects--gets to a certain point and then the "unhandled exception" box).
I googled that. It seems to be a problem with "Net.Framework2.0" and maybe the JIT debugging, also, but it was all "Geek" to me and I couldn't figure out what I was supposed to do--I think I was supposed to get into the Registry YIKES! RUN AWAY!! I'm gonna have to get help with that. I will be calling tech support for the school program right after I'm done typing here.

I realize it's not their problem--it's my computer, but maybe they are familiar with this? I hope! I uninstalled the first application disc and installed the other one--the exact same problem.

Again, I thank you for your help and your time.

Hi again, Navigator,
The SOS (school) problem is solved--thanks for your direction. I didn't understand it would be their problem--sure enough, when I called them, it WAS! (I was on hold for 45 min waiting for the techs to answer--heavy call volume-- grrr!) Something with their 2.0 program having a problem with WinXP SP2. I needed a patch from them. (Which explains why I hadn't had this trouble with it last year, I was still on SP1) School's working fine, and evidently the shut down slowdown was always the Norton. (My son remembers seeing the ccapp before in the "ending program" box)

I followed the directions from Symantec in the link you gave. It went away for a short time (maybe the next few shutdowns), and it's back--with a friend. (Shellcon Hidden Window--I looked it up--it's Musicmatch 10) I'm considering dumping Norton and going back to a free AV program. I have used AVG (??--the one from Grisoft), and didn't find it very user friendly. Any advice? (I need to go with a free program for now). I hesitate to dump the Norton because it has the anti spy and pop up blocker--and I think a firewall.

As to the Shellcon Hidden window, I discovered that is from the upgrade we just did on Musicmatch. From the stuff i read, one suggestion was to go to msconfig, and uncheck musicmatch from the startup list. (the computer complained about changing anything in that start up list, and has itself on "selective Startup"--I think I can hear it muttering now )

Well the ending program popup went away--once. It's back now, and the box in startup is still unchecked. The other solution I'd read about was to go back to an earlier version. My son doesn't want that because he wanted the choices of colorful skins in Musicmatch 10!! LOL! We may HAVE to go back, or something, because as of this morning, he can't even get a cd to play. (I'm wondering if it is the drive, because when I went to my computer>>E drive>>properties>>autoplay tab, checked the "select an action"; I still couldn't get it to play. Musicmatch says there's nothing in the drive. I've checked several cds this morning--nuttin!)

Guess it's time to register at G2G, huh?


Anyhoo, thank you again for helping!

Glad we could be of assistance.

This topic is now closed. If you wish it
reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.