a.p.barron

Great! Thank you so much for all of your help Tom, I really appreciate it. You are definitely a life saver. Now all I need to do is stick some more RAM in this baby, and I'll be ready to go. Thanks again, -Alex-

Hey Tom, It's still running a little slow, but I think that might be due to how old it is. Anyway, here's the log: OTL logfile created on: 1/13/2010 7:29:04 PM - Run 6 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Documents and Settings\me\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 222.00 Mb Total Physical Memory | 74.00 Mb Available Physical Memory | 33.00% Memory free 880.00 Mb Paging File | 571.00 Mb Available in

Here you go: OTL logfile created on: 1/12/2010 2:40:03 PM - Run 4 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Documents and Settings\me\Desktop Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 222.00 Mb Total Physical Memory | 67.00 Mb Available Physical Memory | 30.00% Memory free 880.00 Mb Paging File | 590.00 Mb Available in Paging File | 67.00% Paging File free Paging file location(s): C:\pagefile.sys 672 672 [binary data] %

Hey Tom, It found 8 infections? Yikes! After it quarantined and deleted them, I still have that extra iexplorer running. Is that just some feature that comes with IE 8? I don't get an extra Firefox when I use Firefox. Anyway, here are the results: ESETscan.txt================================================================================================= C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Spybot - Search &

I ran Malwarebytes, and it said it found a rootkit.agent. I quarantined and deleted it. Here's the log after I did that. Also, I still have that extra iexplorer running. Here's the long after quarantine: Malwarebytes' Anti-Malware 1.44 Database version: 3535 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 1/10/2010 9:58:33 AM mbam-log-2010-01-10 (09-58-32).txt Scan type: Quick Scan Objects scanned: 110416 Time elapsed: 11 minute(s), 37 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items In

I still have that extra iexplorer opening up. :-\ The follow up scan: OTL logfile created on: 1/9/2010 11:43:33 AM - Run 3 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Documents and Settings\me\Desktop Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 222.00 Mb Total Physical Memory | 49.00 Mb Available Physical Memory | 22.00% Memory free 880.00 Mb Paging File | 492.00 Mb Available in Paging File | 56.00% Paging File free Paging

First OTL Scan: All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-6CB0-410C-8C3D-8FA8D2011D0A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6CB0-410C-8C3D-8FA8D2011D0A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95C59A11-5544-4705-8E55-E6DE0387EBAA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95C59A11-5544-4705-8E55-E6DE

Hey Tom, My system overall is running a lot better than before, but I still can't seem to get rid of that dpwsoc.dll file I was talking about. While I was running the OTL scan, I had a virus warning pop up from AVG. Also, when I opened the task manager, I noticed that it said I had two iexplorer.exe open, but I only had one open, so I'm guessing that the trojan is cloaking itself as internet explorer. Here's is the log, along with some pictures: OTL logfile created on: 1/8/2010 12:32:37 PM - Run 2 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Documents and Settings\me\Desktop Windows XP H

Hey Tom, Here are the logs you requested: Log-------------------------------------------- ComboFix 10-01-04.01 - me 01/07/2010 12:06:05.2.1 - x86 Running from: c:\documents and settings\me\Desktop\schrauber.exe Command switches used :: c:\documents and settings\me\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FILE :: "c:\windows\system32\drivers\hslorztm.dat" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\LOG.TXT c:\windows\system32\drivers\hslor

Hey Tom, thanks for helping me out. Here's what you asked for: Log: ComboFix 10-01-04.01 - me 01/06/2010 14:29:11.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222.112 [GMT -8:00] Running from: c:\documents and settings\me\Desktop\schrauber.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\iMeshBar c:\program files\iMeshBar\bar\History\search c:\recycler\S-1-5-21-3635463022-288117105

Hi, My mom's boyfriend gave my mom an old computer that "didn't work." It works perfectly fine, but it had a gang of issues, all sorts of trojans and worms. It looks like I managed to clean out most of the really bad stuff, but there are, and might be, a few things that I can't seem to get rid of. I ran a system/registry scan with CCleaner, AVG, Malwarebytes, and Spybot S&D, and AVG keeps detecting dpwsoc.dll, but can't remove it. I'm not sure what it is, nor how to get rid of it, but hopefully someone can help. Also, I can't seem to run Spybot. It seems to only work in Safe Mode. Anyway,