bar5 Posted November 12, 2006 Report Share Posted November 12, 2006 (edited) Hi:Need piece of mind. I don't think I'm infected, but would like someone to take a look.My problem is when I connect to a site like, Geeks to Go, Bleeping Computer, Castle Cops, etc., it is very slow. It hangs while "tranferring data from" whatever site. The progress bar hangs at about 40 %. It stays there for what seems like an eternity, eventually I give up. BT is faster, but today is also slow.What I have done so far is ran scan:1. Spybot S&D2. Adaware SE3. Ewido4. A-Squared5. PC-Cillin6. SuperAd Blocker (has a malware scan)Here is HJT Log:Logfile of HijackThis v1.99.1Scan saved at 11:31:55 AM, on 11/12/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\SYSTEM32\SVCHOST.EXEC:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\PROGRA~1\Iomega\System32\AppServices.exeC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exeC:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXEC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exeC:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXEC:\Program Files\Iomega\AutoDisk\ADService.exeC:\WINDOWS\system32\fxssvc.exeC:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exeC:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exeC:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exeC:\WINDOWS\stsystra.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Logitech\iTouch\iTouch.exeC:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exeC:\Program Files\Iomega\AutoDisk\ADUserMon.exeC:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXEC:\Program Files\Java\jre1.5.0_08\bin\jusched.exeC:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Documents and Settings\BARB\My Documents\HiJackThis\HijackThis-1.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dellnet.msn.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.comO2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll (file missing)O2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dllO3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabtb.dllO4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [sunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exeO4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exeO4 - HKLM\..\Run: [iSUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startupO4 - HKLM\..\Run: [!ewido] "C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimizedO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"O4 - HKCU\..\Run: [superAdBlocker] C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll (file missing)O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CABO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d...lscbase8460.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{1C94B32F-708E-47B2-9F13-0672B4F2A3B5}: NameServer = 67.132.213.8 67.132.213.13O17 - HKLM\System\CS1\Services\Tcpip\..\{1C94B32F-708E-47B2-9F13-0672B4F2A3B5}: NameServer = 67.132.213.8 67.132.213.13O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLLO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dllO20 - Winlogon Notify: SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exeO23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exeO23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXEO23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exeO23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exeO23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exeO23 - Service: ZipToA - Unknown owner - C:\WINDOWS\system32\ZipToA.exe (file missing)O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exeThanks. Any advice would be appreciated.BarbP.S Scans came up clean, just minor tracking cookies. Edited November 12, 2006 by bar5 Link to post Share on other sites
therock247uk Posted November 13, 2006 Report Share Posted November 13, 2006 Please download ATF Cleaner by Atribune.This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.Under Main choose: Select AllClick the Empty Selected button.If you use Firefox browserClick Firefox at the top and choose: Select AllClick the Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt.If you use Opera browserClick Opera at the top and choose: Select AllClick the Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt.Click Exit on the Main menu to close the program.For Technical Support, double-click the e-mail address located at the bottom of each menu.Please go HERE to run Panda's ActiveScanOnce you are on the Panda site click the Scan your PC buttonA new window will open...click the Check Now buttonEnter your CountryEnter your State/ProvinceEnter your e-mail address and click sendSelect either Home User or CompanyClick the big Scan Now buttonIf it wants to install an ActiveX component allow itIt will start downloading the files it requires for the scan (Note: It may take a couple of minutes)When download is complete, click on My Computer to start the scanWhen the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report Link to post Share on other sites
bar5 Posted November 13, 2006 Author Report Share Posted November 13, 2006 therock247uk:Will get back to you tomorrow, after I have followed all your instructions.ThanksBarb Link to post Share on other sites
therock247uk Posted November 13, 2006 Report Share Posted November 13, 2006 Ok. Link to post Share on other sites
bar5 Posted November 13, 2006 Author Report Share Posted November 13, 2006 therock247uk:I did all you asked. D/L ATF ran it for Firefox browser, as that is mostly what I use.Ran Panda scan, "No viruses or malicios software found"I have no problem with BT. Most of the problem is with the sites I previously told you. I just tried Bleeping Computer, Castle Cops and Geeks to Go, and finally got on, but still took awhile transferring data. I immediately connect to site, it is transfer data where it takes forever. Screen stays blank until it is done.Not every site does this. Could it be this lousey dial-up, which I have no choice?Thanks for your time, greatly appreciated.Barb Link to post Share on other sites
therock247uk Posted November 13, 2006 Report Share Posted November 13, 2006 Dial up would slow browisng etc alot yes... Link to post Share on other sites
bar5 Posted November 14, 2006 Author Report Share Posted November 14, 2006 Dial up would slow browisng etc alot yes...therock247uk:Go ahead and close this. I do believe it is my dial-up. It is not like this every day, but at least I know my computer is clean.One last question, how often should I use that ATF Cleaner? I have a regular weekly and monthly maintenance schedule set up. Thanks for your time and help. Barb Link to post Share on other sites
therock247uk Posted November 15, 2006 Report Share Posted November 15, 2006 Every month or so should be good enough. Link to post Share on other sites
bar5 Posted November 15, 2006 Author Report Share Posted November 15, 2006 Every month or so should be good enough.OK, Thanks again.Barb Link to post Share on other sites
therock247uk Posted November 15, 2006 Report Share Posted November 15, 2006 Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. Link to post Share on other sites
Recommended Posts