Computer Hope
Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: bluecountry on February 16, 2012, 10:56:03 PM
-
The past two weeks, my PC has been at times slow, freezing, and constantly grinding.
Each time I do the CC/SAS scans and it helps until a week later.
So figured I would post the details of my PC and let me know if something else is wrong.
After I did all the scans yesterday it worked just fine today.
MBAM
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org
Database version: v2012.02.15.03
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Johnny Ola :: JOHNNYOLA-PC [administrator]
2/15/2012 2:36:09 PM
mbam-log-2012-02-15 (14-36-09).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197898
Time elapsed: 7 minute(s), 7 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
SAS (Oh great, my SAS log from yesterday can't be found...six things were removed, what do I do)
DDS txt
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org
Database version: v2012.02.15.03
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Johnny Ola :: JOHNNYOLA-PC [administrator]
2/15/2012 2:36:09 PM
mbam-log-2012-02-15 (14-36-09).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197898
Time elapsed: 7 minute(s), 7 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Attach
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 1/1/2005 3:07:20 AM
System Uptime: 2/16/2012 2:59:28 AM (22 hours ago)
.
Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz | N/A | 1801/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 291 GiB total, 191.932 GiB free.
D: is Removable
E: is Removable
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP343: 1/30/2012 12:16:19 AM - Scheduled Checkpoint
RP344: 1/30/2012 5:07:17 PM - Scheduled Checkpoint
RP345: 2/1/2012 3:36:33 PM - Scheduled Checkpoint
RP346: 2/2/2012 5:30:45 PM - Scheduled Checkpoint
RP347: 2/3/2012 8:48:31 PM - Windows Backup
RP348: 2/4/2012 12:07:50 AM - Windows Backup
RP349: 2/4/2012 3:44:15 PM - 2/4/2012
RP350: 2/5/2012 1:28:00 PM - Scheduled Checkpoint
RP351: 2/6/2012 12:56:35 PM - Scheduled Checkpoint
RP352: 2/7/2012 2:21:52 PM - Scheduled Checkpoint
RP353: 2/8/2012 1:22:21 PM - Scheduled Checkpoint
RP354: 2/9/2012 4:12:07 AM - Scheduled Checkpoint
RP355: 2/12/2012 2:25:06 AM - Scheduled Checkpoint
RP356: 2/13/2012 9:13:32 PM - Scheduled Checkpoint
RP357: 2/14/2012 2:23:39 PM - Scheduled Checkpoint
RP358: 2/15/2012 2:45:16 PM - Windows Update
RP359: 2/16/2012 9:46:52 PM - Scheduled Checkpoint
RP360: 2/17/2012 12:22:58 AM - Installed Java(TM) 6 Update 31
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 11 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 8
AIM 7
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AVG 2012
AVG PC Tuneup 2011
Battery Care Function
BitLord 2.0
Bluetooth Stack for Windows by Toshiba
Bonjour
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
CCleaner
Click to DVD 2.0.05 Menu Data
Click to DVD 2.6.00
COMODO Internet Security
Complitly
Dropbox
DSD Direct
DSD Playback Plug-in
Google Chrome
Google Cloud Connect for Microsoft Office
Google Talk Plugin
Google Update Helper
Grouper Screen Saver 1.0
HDAUDIO SoftV92 Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iCloud
Image Converter 3
Instant Mode
Intel(R) Graphics Media Accelerator Driver
iTunes
Java Auto Updater
Java(TM) 6 Update 31
LocationFree Player
Malwarebytes Anti-Malware version 1.60.1.1000
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Mozilla Firefox 10.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
OpenMG Limited Patch 4.7-07-13-24-01
OpenMG Secure Module 4.7.00
QuickBooks Product Listing Service
QuickBooks Simple Start Free Starter Edition
Realtek High Definition Audio Driver
Roxio Easy Media Creator Home
Safari
SeaTools for Windows
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Setting Utility Series
Simple Start Entice
Skype Click to Call
Skype™ 5.5
SonicStage 4.3
SonicStage Mastering Studio
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Audio Filter Custom Preset
SonicStage Mastering Studio Plugins
Sony Utilities DLL
Sony Video Shared Library
Spiderman 3 XXXX
SpywareBlaster 4.6
SUPERAntiSpyware
SupportSoft Assisted Service
Synaptics Pointing Device Driver
TeamSpeak 3 Client
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VAIO AV Mode Launcher
VAIO Azure Float Wallpaper
VAIO Camera Capture Utility
VAIO Camera Utility
VAIO Center Access Bar
VAIO Central
VAIO Entertainment Center
VAIO Entertainment Platform
VAIO Event Service
VAIO Floral Dusk Wallpaper
VAIO Help And Support
VAIO Media
VAIO Media 6.0
VAIO Media AC3 Decoder 1.0
VAIO Media Content Collection 6.0
VAIO Media Integrated Server 6.0
VAIO Media Redistribution 6.0
VAIO Media Registration Tool
VAIO Media Registration Tool 6.0
VAIO OOBE
VAIO Photo 2007
VAIO Power Management
VAIO Productivity Center
VAIO Security Center
VAIO Service Utility
VAIO Survey
VAIO Teal Whisper Wallpaper
VAIO Update 3
VAIO Video & Photo Suite
Veetle TV
Windows Media Player Firefox Plugin
WinDVD for VAIO
Wireless Switch Setting Utility
.
==== Event Viewer Messages From Past Week ========
.
2/16/2012 7:42:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the PlugPlay service.
2/15/2012 3:24:41 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/15/2012 3:24:35 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
2/15/2012 3:20:51 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
2/15/2012 1:24:09 PM, Error: srv [2017] - The server was unable to allocate from the system nonpaged pool because the server reached the configured limit for nonpaged pool allocations.
2/15/2012 1:22:36 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the VAIO Event Service service.
2/14/2012 1:06:53 AM, Error: netbt [4311] - Initialization failed because the driver device could not be created. Use the string "0013E8354465" to identify the interface for which initialization failed. It represents the MAC address of the failed interface or the Globally Unique Interface Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither the MAC address nor the GUID were available, the string represents a cluster device name.
2/11/2012 12:50:33 AM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{D83D5627-FB49-437C-B3E7-C61C85550B27} because another computer on the network has the same name. The server could not start.
2/11/2012 12:50:33 AM, Error: netbt [4321] - The name "JOHNNYOLA-PC :20" could not be registered on the interface with IP address 0.0.0.0. The computer with the IP address 192.168.1.105 did not allow the name to be claimed by this computer.
2/11/2012 12:27:00 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSearch service.
2/10/2012 2:57:05 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
.
==== End Of File ===========================
-
If there is a grinding noise it's probably the harddrive or the fans. You can check this by opening the box and disconnecting the fans one by one and see if the noise still persists. If the noise is still there you can run a diagnostic on your hard drive.
Run hard drive diagnostics: tacktech.com (http://www.tacktech.com/display.cfm?ttid=287)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn (http://www.imgburn.com/) to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: (http://sdd.toshiba.com/main.aspx?Path=ServicesSupport/FujitsuDrivesUSandCanada/SoftwareUtilities#diagnostic)
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
-
I will take care of that stuff later.
Meantime, I wanted to check, is my PC safe?
You know, a week later, again, it was running slow.
So again, I ran a scan. I did all but one of your scans.
Revealing is doing SAS it came up with the SAME exact problems as last week!
Oddly, these are issues with spyware from google mail!
I have attached the logs, could you let me know what is going on?
I am surprised my PC keeps getting re-infected after cleaning, why, and is this a big problem, how can I fix?
Further, what is up with google being the source of infections? Gmail is safe!
MBAM Log
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org
Database version: v2012.02.23.02
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Johnny Ola :: JOHNNYOLA-PC [administrator]
2/23/2012 2:35:28 PM
mbam-log-2012-02-23 (14-35-28).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 199888
Time elapsed: 6 minute(s), 2 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
SAS Log
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 02/23/2012 at 05:29 PM
Application Version : 5.0.1142
Core Rules Database Version : 8270
Trace Rules Database Version: 6082
Scan type : Complete Scan
Total Scan Time : 01:22:26
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)
Memory items scanned : 795
Memory threats detected : 0
Registry items scanned : 24240
Registry threats detected : 0
File items scanned : 128145
File threats detected : 5
Trojan.Agent/Gen-Mabezat
C:\USERS\JOHNNY OLA\APPDATA\LOCAL\TEAMSPEAK 3 CLIENT\UNINSTALL.EXE
Adware.Tracking Cookie
accounts.google.com[wmn|gmail|[email protected]] [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com[wmn|gmail|[email protected]] [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Download Combofix from any of the links below, and save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
To prevent your anti-virus application interfering with ComboFix we need to disable it. See here (http://"http://www.pchelpforum.com/anti-virus/110194-how-disable-your-security-applications.html") for a tutorial regarding how to do so if you are unsure.
- Close any open windows and double click ComboFix.exe to run it.
You will see the following image:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_disclaimer_ENG.png)
Click I Agree to start the program.
ComboFix will then extract the necessary files and you will see this:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_extraction.png)
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7
It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
If you did not have it installed, you will see the prompt below. Choose YES.
(http://i424.photobucket.com/albums/pp322/digistar/RcAuto1.gif)
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
(http://i424.photobucket.com/albums/pp322/digistar/whatnext.png)
Click on Yes, to continue scanning for malware.
When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.
Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
-
Dave, thank you.
I have been out of town.
My PC is slow and grinding.
I just did another scan last night, since this data was two weeks old.
I am going to post the scans now, should I simply follow your last post or has something changed at all?
MBAM
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org
Database version: v2012.03.10.02
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Johnny Ola :: JOHNNYOLA-PC [administrator]
3/10/2012 1:04:14 AM
mbam-log-2012-03-10 (01-04-14).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 204184
Time elapsed: 6 minute(s), 45 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
SAS
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 03/10/2012 at 03:18 AM
Application Version : 5.0.1142
Core Rules Database Version : 8324
Trace Rules Database Version: 6136
Scan type : Complete Scan
Total Scan Time : 01:20:28
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)
Memory items scanned : 849
Memory threats detected : 0
Registry items scanned : 24271
Registry threats detected : 0
File items scanned : 128020
File threats detected : 15
Adware.Tracking Cookie
accounts.google.com[wmn|gmail|[email protected]] [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com[wmn|gmail|[email protected]] [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
And once again...GMAIL problems!
-
If there is a grinding noise it's either one of the fans or the harddrive. Can you open the box and give a listen. You can disconnect each fan to try to isolate the noise. Also, please run ComboFix.
-
Dave, before I do that, do I have a malware problem I can take care of...would rather do the "easy" part first! Uncomfy touching the hardrive physically yet.
-
I really need help...PC keeps running slow, slowest it has been in a LONG time...each new SAS scan now all of the sudden has GOOGLE problems...please help
-
Download DDS from HERE (http://download.bleepingcomputer.com/sUBs/dds.scr) or HERE (http://www.forospyware.com/sUBs/dds) and save it to your desktop.
Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)
* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs.
* Save both reports to your desktop.
* The instructions here ask you to attach the Attach.txt.
(http://i424.photobucket.com/albums/pp322/digistar/DDS.jpg)
1) DDS.txt
2) Attach.txt
Instead of attaching, please copy/past both logs into your Thread
Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.
•Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run.
After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE (http://www.bleepingcomputer.com/forums/topic114351.html).Then post your DDS logs. (DDS.txt and Attach.txt )
-
Several logs:
MBAM (short scan)
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org
Database version: v2012.03.14.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Johnny Ola :: JOHNNYOLA-PC [administrator]
3/14/2012 1:49:53 PM
mbam-log-2012-03-14 (13-49-53).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 204990
Time elapsed: 5 minute(s), 49 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
MBAM (long scan)
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org
Database version: v2012.03.14.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Johnny Ola :: JOHNNYOLA-PC [administrator]
3/14/2012 2:09:25 PM
mbam-log-2012-03-14 (14-09-25).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 337519
Time elapsed: 1 hour(s), 28 minute(s), 11 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
SAS
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 03/14/2012 at 02:14 AM
Application Version : 5.0.1144
Core Rules Database Version : 8333
Trace Rules Database Version: 6145
Scan type : Complete Scan
Total Scan Time : 01:32:05
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)
Memory items scanned : 801
Memory threats detected : 0
Registry items scanned : 35767
Registry threats detected : 0
File items scanned : 131710
File threats detected : 2
Adware.Tracking Cookie
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
SAS
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 03/14/2012 at 01:41 PM
Application Version : 5.0.1144
Core Rules Database Version : 8333
Trace Rules Database Version: 6145
Scan type : Complete Scan
Total Scan Time : 01:47:13
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)
Memory items scanned : 756
Memory threats detected : 0
Registry items scanned : 35767
Registry threats detected : 0
File items scanned : 131867
File threats detected : 4
Adware.Tracking Cookie
accounts.google.com[wmn|gmail|[email protected]] [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com[wmn|gmail|[email protected]] [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\JOHNNY OLA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3YU3MJE6.DEFAULT\COOKIES.SQLITE ]
DDS 1
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by Johnny Ola at 22:58:37 on 2012-03-14
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.884 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: COMODO Defense+ *Enabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Google\Update\1.3.21.99\GoogleCrashHandler.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Center Access Bar\VCAB.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Users\Johnny Ola\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Windows\system32\sdclt.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2818425
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [iCloudServices] c:\program files\common files\apple\internet services\iCloudServices.exe
uRun: [ApplePhotoStreams] c:\program files\common files\apple\internet services\ApplePhotoStreams.exe
uRun: [Google Update] "c:\users\johnny ola\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [ISBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe"
mRun: [VAIOCameraUtility] "c:\program files\sony\vaio camera utility\VCUServe.exe"
mRun: [VAIO Center Access Bar] "c:\program files\sony\vaio center access bar\VCAB.exe"
mRun: [VAIOSecurity] "c:\program files\sony\vaio security center\VSC.exe" 1
mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
StartupFolder: c:\users\johnny~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\johnny ola\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
TCP: Interfaces\{20DA44BE-98A1-475D-B8AC-88DF3AD26CDD} : NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{D83D5627-FB49-437C-B3E7-C61C85550B27} : NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{D83D5627-FB49-437C-B3E7-C61C85550B27} : DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
AppInit_DLLs: c:\windows\system32\guard32.dll c:\windows\system32\guard32.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\johnny ola\appdata\roaming\mozilla\firefox\profiles\3yu3mje6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2818425&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.93\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\users\johnny ola\appdata\local\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\users\johnny ola\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\johnny ola\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-10-7 491816]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-10-7 38616]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2011-10-16 21504]
R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-1-3 11032]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134736]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2007-5-3 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2007-5-3 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2007-5-3 31104]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-5-3 807424]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-10-11 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-10-11 136176]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\sony\image converter 3\ICScsiSV.exe [2005-1-1 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;c:\program files\sony\image converter 3\IcVzMonLauncher.exe [2005-1-1 67760]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2005-1-1 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\sony\vaio media integrated server\platform\SV_Httpd.exe [2005-1-1 397312]
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2005-1-1 1089536]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-03-15 01:30:23 -------- d-----w- c:\program files\Smartparts
2012-03-15 01:28:04 -------- d-----w- c:\users\johnny ola\appdata\local\Downloaded Installations
2012-03-14 07:19:44 -------- d-----w- C:\f46c407180ce1877c0c980d0e4
2012-03-14 03:32:25 652296 ----a-w- c:\programdata\microsoft\ehome\packages\sportstemplate\sportstemplatecore\Microsoft.MediaCenter.Sports.UI.dll
2012-03-14 03:32:15 677136 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
2012-03-14 03:32:05 416128 ----a-w- c:\programdata\microsoft\ehome\packages\nettv\browse\NetTVResources.dll
2012-03-13 20:18:01 2044416 ----a-w- c:\windows\system32\win32k.sys
2012-03-13 20:17:59 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-03-13 20:17:59 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-03-13 20:17:59 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-03-13 20:17:59 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-03-13 20:17:59 1068544 ----a-w- c:\windows\system32\DWrite.dll
2012-03-13 20:17:46 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2012-03-13 20:17:43 613376 ----a-w- c:\windows\system32\rdpencom.dll
2012-03-13 20:17:43 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-10 19:06:34 -------- d-----w- c:\program files\iPod
2012-03-10 19:06:20 -------- d-----w- c:\program files\iTunes
2012-03-08 04:15:14 -------- d-----w- c:\users\johnny ola\appdata\roaming\GetRightToGo
2012-03-08 04:02:17 -------- d-----w- c:\users\johnny ola\appdata\roaming\libimobiledevice
2012-03-08 04:00:01 -------- d-----w- c:\program files\Tansee iPhone Transfer SMS
2012-02-15 18:44:42 680448 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-15 16:01:50 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-15 16:01:50 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
.
==================== Find3M ====================
.
2012-03-11 21:13:28 38616 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2012-03-11 21:13:26 491816 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2012-03-11 21:13:25 19600 ----a-w- c:\windows\system32\drivers\cmderd.sys
2012-03-11 21:13:19 33984 ----a-w- c:\windows\system32\cmdcsr.dll
2012-03-11 21:13:18 301224 ----a-w- c:\windows\system32\guard32.dll
2012-02-17 05:24:47 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-10 05:57:22 318904 ----a-w- c:\users\johnny ola\wmpfirefoxplugin.exe
.
============= FINISH: 23:00:00.98 ===============
DDS 2
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 1/1/2005 3:07:20 AM
System Uptime: 3/14/2012 2:05:16 PM (9 hours ago)
.
Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz | N/A | 1801/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 291 GiB total, 225.179 GiB free.
D: is Removable
E: is Removable
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP377: 3/14/2012 3:16:16 AM - Windows Update
RP378: 3/14/2012 3:34:46 AM - Windows Update
RP379: 3/14/2012 5:52:48 PM - Scheduled Checkpoint
RP380: 3/14/2012 9:29:09 PM - Installed OptiPix.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 11 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 8
AIM 7
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AVG 2012
AVG PC Tuneup 2011
Battery Care Function
BitLord 2.0
Bluetooth Stack for Windows by Toshiba
Bonjour
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
CCleaner
Click to DVD 2.0.05 Menu Data
Click to DVD 2.6.00
COMODO Internet Security
Complitly
Dropbox
DSD Direct
DSD Playback Plug-in
Google Chrome
Google Cloud Connect for Microsoft Office
Google Talk Plugin
Google Update Helper
Grouper Screen Saver 1.0
HDAUDIO SoftV92 Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iCloud
Image Converter 3
Instant Mode
Intel(R) Graphics Media Accelerator Driver
iTunes
Java Auto Updater
Java(TM) 6 Update 31
LocationFree Player
Malwarebytes Anti-Malware version 1.60.1.1000
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Mozilla Firefox 10.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
OpenMG Limited Patch 4.7-07-13-24-01
OpenMG Secure Module 4.7.00
OptiPix
QuickBooks Product Listing Service
QuickBooks Simple Start Free Starter Edition
Realtek High Definition Audio Driver
Roxio Easy Media Creator Home
Safari
SeaTools for Windows
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Setting Utility Series
Simple Start Entice
Skype Click to Call
Skype™ 5.5
SonicStage 4.3
SonicStage Mastering Studio
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Audio Filter Custom Preset
SonicStage Mastering Studio Plugins
Sony Utilities DLL
Sony Video Shared Library
Spiderman 3 XXXX
SpywareBlaster 4.6
SUPERAntiSpyware
SupportSoft Assisted Service
Synaptics Pointing Device Driver
Tansee iPhone Transfer SMS 2.8.1.0
TeamSpeak 3 Client
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VAIO AV Mode Launcher
VAIO Azure Float Wallpaper
VAIO Camera Capture Utility
VAIO Camera Utility
VAIO Center Access Bar
VAIO Central
VAIO Entertainment Center
VAIO Entertainment Platform
VAIO Event Service
VAIO Floral Dusk Wallpaper
VAIO Help And Support
VAIO Media
VAIO Media 6.0
VAIO Media AC3 Decoder 1.0
VAIO Media Content Collection 6.0
VAIO Media Integrated Server 6.0
VAIO Media Redistribution 6.0
VAIO Media Registration Tool
VAIO Media Registration Tool 6.0
VAIO OOBE
VAIO Photo 2007
VAIO Power Management
VAIO Productivity Center
VAIO Security Center
VAIO Service Utility
VAIO Survey
VAIO Teal Whisper Wallpaper
VAIO Update 3
VAIO Video & Photo Suite
Veetle TV
Windows Media Player Firefox Plugin
WinDVD for VAIO
Wireless Switch Setting Utility
.
==== Event Viewer Messages From Past Week ========
.
3/9/2012 6:15:53 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the VzCdbSvc service.
3/7/2012 10:52:19 PM, Error: Service Control Manager [7000] - The Windows Font Cache Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
3/7/2012 10:52:16 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Font Cache Service service to connect.
3/7/2012 10:51:21 PM, Error: Service Control Manager [7034] - The Canon Camera Access Library 8 service terminated unexpectedly. It has done this 1 time(s).
3/7/2012 10:50:02 PM, Error: EventLog [6008] - The previous system shutdown at 1:07:56 AM on 3/6/2012 was unexpected.
3/14/2012 3:32:25 AM, Error: srv [2019] - The server was unable to allocate from the system nonpaged pool because the pool was empty.
3/14/2012 3:32:25 AM, Error: srv [2017] - The server was unable to allocate from the system nonpaged pool because the server reached the configured limit for nonpaged pool allocations.
3/14/2012 3:31:33 AM, Error: netbt [4311] - Initialization failed because the driver device could not be created. Use the string "0013E8354465" to identify the interface for which initialization failed. It represents the MAC address of the failed interface or the Globally Unique Interface Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither the MAC address nor the GUID were available, the string represents a cluster device name.
3/14/2012 3:29:13 AM, Error: EventLog [6008] - The previous system shutdown at 3:26:38 AM on 3/14/2012 was unexpected.
3/14/2012 3:12:08 AM, Error: EventLog [6008] - The previous system shutdown at 3:08:38 AM on 3/14/2012 was unexpected.
3/14/2012 3:10:42 AM, Error: volsnap [25] - The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
3/14/2012 2:07:17 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
3/14/2012 11:58:13 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
3/14/2012 11:50:38 AM, Error: EventLog [6008] - The previous system shutdown at 11:47:14 AM on 3/14/2012 was unexpected.
3/10/2012 2:01:53 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
.
==== End Of File ===========================
-
There's nothing showing up in the scans so it starting to look like it's probably your hard drive. Please try running a defrag on that drive.
Slow Computer? It may not be Malware (http://evilfantasy.wordpress.com/2008/05/24/slow-computer-it-may-not-be-malware/) for free cleaning/maintenance tools to help keep your computer running smoothly.
-
I'll go ahead and defrag, if it still acts up, what then?
The hardrive does keep grinding, can I ignore it or should I do something?
-
The hardrive does keep grinding, can I ignore it or should I do something?
You should backup all your important data and be prepared to change the harddrive. You can run this diagnostic. It will give you a good picture of the harddrive. If it's a grinding noise, it sounds like a bearing is going bad.
Run hard drive diagnostics: tacktech.com (http://www.tacktech.com/display.cfm?ttid=287)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn (http://www.imgburn.com/) to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: (http://sdd.toshiba.com/main.aspx?Path=ServicesSupport/FujitsuDrivesUSandCanada/SoftwareUtilities#diagnostic)
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
-
OK, I'll do it. Just so you know, apparently my PC automatically de-frags every week.
You should backup all your important data and be prepared to change the harddrive. You can run this diagnostic. It will give you a good picture of the harddrive. If it's a grinding noise, it sounds like a bearing is going bad.
Run hard drive diagnostics: tacktech.com (http://www.tacktech.com/display.cfm?ttid=287)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn (http://www.imgburn.com/) to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: (http://sdd.toshiba.com/main.aspx?Path=ServicesSupport/FujitsuDrivesUSandCanada/SoftwareUtilities#diagnostic)
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
Then I guess I boot from CD and do what? Post contents here?
-
You should backup all your important data and be prepared to change the harddrive. You can run this diagnostic. It will give you a good picture of the harddrive. If it's a grinding noise, it sounds like a bearing is going bad.
Run hard drive diagnostics: tacktech.com (http://www.tacktech.com/display.cfm?ttid=287)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn (http://www.imgburn.com/) to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: (http://sdd.toshiba.com/main.aspx?Path=ServicesSupport/FujitsuDrivesUSandCanada/SoftwareUtilities#diagnostic)
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
Then I guess I boot from CD and do what? Post contents here?
-
Then I guess I boot from CD and do what? Post contents here?
You boot from the CD and the diagnostic program will run. However, if it is the bearings on the harddrive that is defective it probably won't show on the diagnostic. I don't need to see the log.
-
You should backup all your important data and be prepared to change the harddrive. You can run this diagnostic. It will give you a good picture of the harddrive. If it's a grinding noise, it sounds like a bearing is going bad.
Run hard drive diagnostics: tacktech.com (http://www.tacktech.com/display.cfm?ttid=287)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn (http://www.imgburn.com/) to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: (http://sdd.toshiba.com/main.aspx?Path=ServicesSupport/FujitsuDrivesUSandCanada/SoftwareUtilities#diagnostic)
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
OK, I a bit confused with my options and if I did this right.
1) How do I know who made my harddrive? I thought I had a WDD, so I clicked on Western Digital. However, when I downloaded and ran it showed:
TOSHIBIA M3252GSK (IDE) capacity 320 GB.
On my computer, c drive it says I have 290 GB of memory.
So is the Toshibia my hard drive?
2) If it's a WDD or a Toshiba, which program should I click to install and run since each option has tons!
3) When I clicked "Data Lifeguard Diagnostic for Windows v1.24 (July 2011)" I downloaded it, ran the short scan and it passed.
Should I run the long scan?
I never was asked anything on booting a CD?
Unrelated:
4) When I used my PC today GMAIL and Twitter where quite slow.
5) I have a cooling fan accessory board, would hooking that up to my PC help?
-
How do I know who made my harddrive?
You can look in Device Manager or open the box and look at the drive.
Is this the same computer that Evilfantasy is helping you with?