Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Slow computer, possible replicating virus . . .?  (Read 9496 times)

0 Members and 1 Guest are viewing this topic.

ashton

    Topic Starter


    Rookie
    • Experience: Beginner
    • OS: Windows 7
    Slow computer, possible replicating virus . . .?
    « on: May 31, 2012, 07:44:28 PM »
    I've had this computer for about 4 years now, and it only started to become really slow in the last year. It is constantly freezing, and closing me out of active programs. In addition, the system is very slow now. I've done several virus scans, and although they often find small things, the problem has never been corrected.

    I've followed the steps asked prior to requesting help. The three necessary logs are pasted below:I've had this computer for about 4 years now, and it only started to become really slow in the last year. It is constantly freezing, and closing me out of active programs. In addition, the system is very slow now. I've done several virus scans, and although they often find small things, the problem has never been corrected.

    I've followed the steps asked prior to requesting help. The three necessary logs are pasted below. Thank you for any assistance.

    SAS:


    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 05/31/2012 at 05:04 PM

    Application Version : 5.0.1150

    Core Rules Database Version : 8650
    Trace Rules Database Version: 6462

    Scan type       : Complete Scan
    Total Scan Time : 01:13:50

    Operating System Information
    Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
    UAC On - Administrator

    Memory items scanned      : 592
    Memory threats detected   : 0
    Registry items scanned    : 65464
    Registry threats detected : 0
    File items scanned        : 97554
    File threats detected     : 0

    MBAM:

    Malwarebytes Anti-Malware 1.61.0.1400
    www.malwarebytes.org

    Database version: v2012.05.31.04

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    carol :: CAROL-PC [administrator]

    5/31/2012 5:23:26 PM
    mbam-log-2012-05-31 (17-23-26).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 220257
    Time elapsed: 6 minute(s), 23 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 2
    HKCR\Interface\{77777777-7777-7777-7777-770077227758} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
    HKCR\TypeLib\{44444444-4444-4444-4444-440044224458} (Adware.GamePlayLab) -> Quarantined and deleted successfully.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)

    DDS:


    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.4.1
    Run by carol at 18:42:44 on 2012-05-31
    Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3003.2025 [GMT -7:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    c:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Windows\system32\svchost.exe -k apphost
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    C:\Windows\system32\svchost.exe -k HsfXAudioService
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
    C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\svchost.exe -k iissvcs
    C:\Windows\System32\igfxpers.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\SUPERAntiSpyware\c04aa76d-3d0d-4886-8491-310aaa7437f7.com
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\msiexec.exe
    C:\Windows\System32\svchost.exe -k swprv
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://us.mg6.mail.yahoo.com/neo/launch?.rand=88a4nbcku5gua
    uDefault_Page_URL = hxxp://www.aol.com/?ncid=customie9
    uWindow Title = Windows Internet Explorer provided by AOL
    mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
    uURLSearchHooks: H - No File
    uURLSearchHooks: H - No File
    mURLSearchHooks: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
    BHO: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    TB: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
    uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    mRun: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    dRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex
    dRunOnce: [DeleteEngineAfterUpdate] reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine /f
    uPolicies-system: WallpaperStyle = 2
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    dPolicies-system: WallpaperStyle = 2
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
    DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    TCP: DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C} : DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C}\34C6162796F6E60243 : DhcpNameServer = 204.14.141.218 204.14.138.10
    TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C}\34C6162796F6E60294E6E6 : DhcpNameServer = 10.10.10.254 8.8.8.8
    TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C}\D4F64756C60263 : DhcpNameServer = 10.128.128.128
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
    BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO-X64:     0x1 - No File
    BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO-X64:     HP Print Enhancer - No File
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64:     AcroIEHelperStub - No File
    BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
    BHO-X64: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    BHO-X64:     Zynga - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
    BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    BHO-X64:     HP Smart BHO Class - No File
    TB-X64: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
    mRun-x64: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\carol\AppData\Roaming\Mozilla\Firefox\Profiles\4j11x0zx.default\
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\NP2pEISb.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
    FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
    R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
    R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]
    R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-4-3 63928]
    R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-6-21 85560]
    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]
    R2 HsfXAudioService;HsfXAudioService;C:\Windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 20992]
    R3 CAXHWAZL;CAXHWAZL;C:\Windows\system32\DRIVERS\CAXHWAZL.sys --> C:\Windows\system32\DRIVERS\CAXHWAZL.sys [?]
    R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-8-17 227896]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-18 257696]
    S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-31 129976]
    S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
    S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
    S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
    S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
    .
    =============== Created Last 30 ================
    .
    2012-06-01 01:38:11   --------   d-----w-   C:\Program Files (x86)\Oracle
    2012-06-01 01:37:47   772504   ----a-w-   C:\Windows\SysWow64\npDeployJava1.dll
    2012-05-31 22:33:55   --------   d-----w-   C:\Users\carol\AppData\Roaming\OpenOffice.org
    2012-05-31 22:29:16   --------   d-----w-   C:\Program Files (x86)\OpenOffice.org 3
    2012-05-31 22:24:52   --------   d-----w-   C:\Program Files\OpenOffice.org 3.4 (en-US) Installation Files
    2012-05-31 22:08:14   --------   d-----w-   C:\Program Files\CCleaner
    2012-05-31 20:49:07   --------   d-----w-   C:\Users\carol\AppData\Local\Mozilla
    2012-05-31 20:48:04   --------   d-----w-   C:\Program Files (x86)\Mozilla Maintenance Service
    2012-05-31 20:45:06   8955792   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{16B64A30-F00B-43DB-ABDF-E71D9741DF0D}\mpengine.dll
    2012-05-31 17:44:43   --------   d-----w-   C:\Users\carol\AppData\Roaming\Malwarebytes
    2012-05-31 17:44:24   --------   d-----w-   C:\ProgramData\Malwarebytes
    2012-05-31 17:44:21   24904   ----a-w-   C:\Windows\System32\drivers\mbam.sys
    2012-05-31 17:44:20   --------   d-----w-   C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-05-31 10:19:49   8955792   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2012-05-31 03:56:40   927800   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{022658E1-9CD1-4B44-8B4C-1623FE786263}\gapaengine.dll
    2012-05-31 03:41:31   --------   d-----w-   C:\Program Files (x86)\Microsoft Security Client
    2012-05-31 03:41:12   --------   d-----w-   C:\Program Files\Microsoft Security Client
    2012-05-30 01:19:37   8955792   ----a-w-   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5042BA61-ABBC-4790-8476-F38DAA4E9F60}\mpengine.dll
    2012-05-17 03:28:26   --------   d-----w-   C:\Users\carol\dvd
    2012-05-17 03:25:11   --------   d-----w-   C:\Program Files (x86)\VideoConverter
    2012-05-15 23:35:08   --------   d-----w-   C:\Users\carol\AppData\Roaming\SUPERAntiSpyware.com
    2012-05-15 23:34:29   --------   d-----w-   C:\ProgramData\SUPERAntiSpyware.com
    2012-05-15 23:34:29   --------   d-----w-   C:\Program Files\SUPERAntiSpyware
    2012-05-14 21:33:02   --------   d-----w-   C:\Program Files (x86)\VideoLAN
    2012-05-12 19:43:55   1544704   ----a-w-   C:\Windows\System32\DWrite.dll
    2012-05-12 19:43:55   1077248   ----a-w-   C:\Windows\SysWow64\DWrite.dll
    2012-05-12 19:43:52   5559664   ----a-w-   C:\Windows\System32\ntoskrnl.exe
    2012-05-12 19:43:50   3146240   ----a-w-   C:\Windows\System32\win32k.sys
    2012-05-12 19:43:49   3968368   ----a-w-   C:\Windows\SysWow64\ntkrnlpa.exe
    2012-05-12 19:43:48   3913072   ----a-w-   C:\Windows\SysWow64\ntoskrnl.exe
    2012-05-12 19:40:33   75120   ----a-w-   C:\Windows\System32\drivers\partmgr.sys
    2012-05-12 19:40:09   1918320   ----a-w-   C:\Windows\System32\drivers\tcpip.sys
    2012-05-12 19:39:48   1367552   ----a-w-   C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-12 19:39:47   936960   ----a-w-   C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-12 04:06:21   --------   d-----w-   C:\Windows\SysWow64\Adobe
    2012-05-12 04:05:20   --------   d--h--w-   C:\Windows\AxInstSV
    2012-05-04 19:00:58   8769696   ----a-w-   C:\Windows\SysWow64\FlashPlayerInstaller.exe
    .
    ==================== Find3M  ====================
    .
    2012-05-31 21:00:46   419488   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
    2012-05-31 21:00:44   70304   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-04-05 01:47:02   687504   ----a-w-   C:\Windows\SysWow64\deployJava1.dll
    2012-03-21 03:44:12   98688   ----a-w-   C:\Windows\System32\drivers\NisDrvWFP.sys
    2012-03-21 03:44:12   203888   ----a-w-   C:\Windows\System32\drivers\MpFilter.sys
    .
    ============= FINISH: 18:43:52.09 ===============



    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 996
    • Certifications: List
    • Experience: Expert
    • OS: Windows 8
    Re: Slow computer, possible replicating virus . . .?
    « Reply #1 on: June 01, 2012, 04:08:38 PM »
    Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
    *************************************************************************
    Download Security Check by screen317 from one of the following links and save it to your desktop.

    Link 1
    Link 2

    * Double-click Security Check.bat
    * Follow the on-screen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt
    * Post the contents of that document in your next reply.

    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
    **********************************************************************
    Download Combofix from any of the links below, and save it to your DESKTOP

    Link 1
    Link 2
    Link 3

    To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.
    • Close any open windows and double click ComboFix.exe to run it.

      You will see the following image:


    Click I Agree to start the program.

    ComboFix will then extract the necessary files and you will see this:



    As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7

    It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.

    If you did not have it installed, you will see the prompt below. Choose YES.



    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



    Click on Yes, to continue scanning for malware.

    When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

    Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

    Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
    Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

    ashton

      Topic Starter


      Rookie
      • Experience: Beginner
      • OS: Windows 7
      Re: Slow computer, possible replicating virus . . .?
      « Reply #2 on: June 01, 2012, 05:19:46 PM »
      Hello, Dave.

      Thank you for your help thus far, here are the requested logs:

      Security Check:

       Results of screen317's Security Check version 0.99.41 
       Windows 7 Service Pack 1 x64 (UAC is enabled) 
       Internet Explorer 9 
      ``````````````Antivirus/Firewall Check:``````````````[/u]
       Windows Firewall Enabled! 
      Microsoft Security Essentials   
        (On Access scanning disabled!)
       Error obtaining update status for antivirus! 
      `````````Anti-malware/Other Utilities Check:`````````[/u]
       Malwarebytes Anti-Malware version 1.61.0.1400 
       JavaFX 2.1.0   
       Java(TM) 6 Update 32 
       Java(TM) 7 Update 4 
       Adobe Reader X (10.1.3)
       Mozilla Firefox (12.0)
      ````````Process Check: objlist.exe by Laurent````````[/u] 
       Microsoft Security Essentials MSMpEng.exe
       Microsoft Security Essentials msseces.exe
      `````````````````System Health check`````````````````[/u]
       Total Fragmentation on Drive C: 2%
      ````````````````````End of Log``````````````````````[/u]

      ComboFix:

      ComboFix 12-06-01.03 - carol 06/01/2012  16:09:00.1.2 - x64
      Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3003.1976 [GMT -7:00]
      Running from: c:\users\carol\Desktop\ComboFix.exe
      AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
      SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      .
      (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      C:\Install.exe
      C:\prefs.js
      c:\program files (x86)\CouponAlert_2pEI
      c:\program files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEIPlug.dll
      c:\program files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEZSETP.dll
      c:\program files (x86)\CouponAlert_2pEI\Installr\2.bin\NP2pEISb.dll
      .
      .
      (((((((((((((((((((((((((   Files Created from 2012-05-01 to 2012-06-01  )))))))))))))))))))))))))))))))
      .
      .
      2012-06-01 23:20 . 2012-06-01 23:20   --------   d-----w-   c:\users\DefaultAppPool\AppData\Local\temp
      2012-06-01 23:20 . 2012-06-01 23:20   --------   d-----w-   c:\users\Default\AppData\Local\temp
      2012-06-01 22:50 . 2012-05-08 17:02   8955792   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9402E9B7-FC4F-4886-8578-13530AAB01A4}\mpengine.dll
      2012-06-01 01:38 . 2012-06-01 01:38   --------   d-----w-   c:\program files (x86)\Common Files\Java
      2012-06-01 01:38 . 2012-06-01 01:38   --------   d-----w-   c:\program files (x86)\Oracle
      2012-06-01 01:37 . 2012-04-05 01:47   772504   ----a-w-   c:\windows\SysWow64\npDeployJava1.dll
      2012-05-31 22:33 . 2012-05-31 22:33   --------   d-----w-   c:\users\carol\AppData\Roaming\OpenOffice.org
      2012-05-31 22:29 . 2012-05-31 22:29   --------   d-----w-   c:\program files (x86)\OpenOffice.org 3
      2012-05-31 22:24 . 2012-05-31 22:25   --------   d-----w-   c:\program files\OpenOffice.org 3.4 (en-US) Installation Files
      2012-05-31 22:08 . 2012-05-31 22:08   --------   d-----w-   c:\program files\CCleaner
      2012-05-31 20:49 . 2012-05-31 20:49   --------   d-----w-   c:\users\carol\AppData\Local\Mozilla
      2012-05-31 20:48 . 2012-05-31 20:48   --------   d-----w-   c:\program files (x86)\Mozilla Maintenance Service
      2012-05-31 20:45 . 2012-05-08 17:02   8955792   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
      2012-05-31 17:44 . 2012-05-31 17:44   --------   d-----w-   c:\users\carol\AppData\Roaming\Malwarebytes
      2012-05-31 17:44 . 2012-05-31 17:44   --------   d-----w-   c:\programdata\Malwarebytes
      2012-05-31 17:44 . 2012-04-04 22:56   24904   ----a-w-   c:\windows\system32\drivers\mbam.sys
      2012-05-31 17:44 . 2012-05-31 17:44   --------   d-----w-   c:\program files (x86)\Malwarebytes' Anti-Malware
      2012-05-31 03:56 . 2012-05-31 03:55   927800   ------w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{022658E1-9CD1-4B44-8B4C-1623FE786263}\gapaengine.dll
      2012-05-31 03:41 . 2012-05-31 03:41   --------   d-----w-   c:\program files (x86)\Microsoft Security Client
      2012-05-31 03:41 . 2012-05-31 03:42   --------   d-----w-   c:\program files\Microsoft Security Client
      2012-05-30 01:19 . 2012-05-08 17:02   8955792   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{5042BA61-ABBC-4790-8476-F38DAA4E9F60}\mpengine.dll
      2012-05-17 03:28 . 2012-05-17 03:28   --------   d-----w-   c:\users\carol\dvd
      2012-05-17 03:25 . 2012-05-17 03:25   --------   d-----w-   c:\program files (x86)\VideoConverter
      2012-05-15 23:35 . 2012-05-15 23:35   --------   d-----w-   c:\users\carol\AppData\Roaming\SUPERAntiSpyware.com
      2012-05-15 23:34 . 2012-05-31 22:49   --------   d-----w-   c:\program files\SUPERAntiSpyware
      2012-05-15 23:34 . 2012-05-15 23:34   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
      2012-05-14 22:00 . 2012-05-19 19:18   --------   d-----w-   c:\users\carol\AppData\Roaming\dvdcss
      2012-05-14 21:34 . 2012-05-30 14:30   --------   d-----w-   c:\users\carol\AppData\Roaming\vlc
      2012-05-14 21:33 . 2012-05-14 21:33   --------   d-----w-   c:\program files (x86)\VideoLAN
      2012-05-12 19:43 . 2012-03-03 06:35   1544704   ----a-w-   c:\windows\system32\DWrite.dll
      2012-05-12 19:43 . 2012-03-03 05:31   1077248   ----a-w-   c:\windows\SysWow64\DWrite.dll
      2012-05-12 19:43 . 2012-03-31 06:05   5559664   ----a-w-   c:\windows\system32\ntoskrnl.exe
      2012-05-12 19:43 . 2012-03-31 03:10   3146240   ----a-w-   c:\windows\system32\win32k.sys
      2012-05-12 19:43 . 2012-03-31 04:39   3968368   ----a-w-   c:\windows\SysWow64\ntkrnlpa.exe
      2012-05-12 19:43 . 2012-03-31 04:39   3913072   ----a-w-   c:\windows\SysWow64\ntoskrnl.exe
      2012-05-12 19:40 . 2012-03-17 07:58   75120   ----a-w-   c:\windows\system32\drivers\partmgr.sys
      2012-05-12 19:40 . 2012-03-30 11:35   1918320   ----a-w-   c:\windows\system32\drivers\tcpip.sys
      2012-05-12 19:39 . 2012-03-31 05:40   1367552   ----a-w-   c:\program files\Common Files\Microsoft Shared\ink\journal.dll
      2012-05-12 19:39 . 2012-03-31 04:29   936960   ----a-w-   c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
      2012-05-12 04:06 . 2012-05-12 04:07   --------   d-----w-   c:\windows\SysWow64\Adobe
      2012-05-12 04:05 . 2012-05-12 04:06   --------   d--h--w-   c:\windows\AxInstSV
      2012-05-04 19:00 . 2012-05-04 19:00   8769696   ----a-w-   c:\windows\SysWow64\FlashPlayerInstaller.exe
      .
      .
      .
      ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2012-05-31 21:00 . 2012-04-18 13:48   419488   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
      2012-05-31 21:00 . 2011-06-16 23:48   70304   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
      2012-04-05 01:47 . 2011-03-31 19:33   687504   ----a-w-   c:\windows\SysWow64\deployJava1.dll
      2012-03-21 03:44 . 2012-03-21 03:44   98688   ----a-w-   c:\windows\system32\drivers\NisDrvWFP.sys
      2012-03-21 03:44 . 2012-03-21 03:44   203888   ----a-w-   c:\windows\system32\drivers\MpFilter.sys
      .
      .
      (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4
      .
      [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
      2011-05-09 09:49   176936   ----a-w-   c:\program files (x86)\Zynga\prxtbZyn2.dll
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
      "{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files (x86)\Zynga\prxtbZyn2.dll" [2011-05-09 176936]
      .
      [HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-05-30 4786048]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
      "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
      "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
      .
      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
      "DeleteEngineAfterUpdate"="reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine" [X]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "ConsentPromptBehaviorAdmin"= 5 (0x5)
      "ConsentPromptBehaviorUser"= 3 (0x3)
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
      "WallpaperStyle"= 2
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
      @=""
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
      @="Service"
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"
      .
      R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
      R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
      R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-31 257696]
      R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
      R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys

      R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys

      R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-27 291696]
      R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys

      R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys

      R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS

      R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS

      R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS

      R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys

      R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe

      R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys

      R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys

      S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
      S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
      S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys

      S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
      S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
      S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
      S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-29 94264]
      S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]
      S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys

      S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
      S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys

      S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys

      .
      .
      [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
      iissvcs   REG_MULTI_SZ      w3svc was
      apphost   REG_MULTI_SZ      apphostsvc
      .
      [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
      2009-06-17 19:11   451872   ----a-w-   c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
      .
      Contents of the 'Scheduled Tasks' folder
      .
      2012-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job
      - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 21:00]
      .
      2012-05-30 c:\windows\Tasks\HPCeeScheduleForcarol.job
      - c:\program files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2009-08-17 21:38]
      .
      .
      --------- x86-64 -----------
      .
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-17 171520]
      "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
      "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-27 1271168]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "LoadAppInit_DLLs"=0x0
      .
      ------- Supplementary Scan -------
      .
      uStart Page = hxxp://us.mg6.mail.yahoo.com/neo/launch?.rand=88a4nbcku5gua
      uLocal Page = c:\windows\system32\blank.htm
      mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
      mLocal Page = c:\windows\SysWOW64\blank.htm
      IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
      TCP: DhcpNameServer = 192.168.1.254
      FF - ProfilePath - c:\users\carol\AppData\Roaming\Mozilla\Firefox\Profiles\4j11x0zx.default\
      .
      - - - - ORPHANS REMOVED - - - -
      .
      Wow6432Node-HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe
      WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)
      AddRemove-Video Converter - c:\program files (x86)\VideoConverter\Uninstall\Uninstall.exe
      .
      .
      .
      --------------------- LOCKED REGISTRY KEYS ---------------------
      .
      [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
      @Denied: (2) (LocalSystem)
      "{7B13EC3E-999A-4B70-B9CB-2617B8323822}"=hex:51,66,7a,6c,4c,1d,38,12,50,ef,00,
         7f,a8,d7,1e,0e,c6,dd,65,57,bd,6c,7c,36
      "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
         eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
      "{BA00B7B1-0351-477A-B948-23E3EE5A73D4}"=hex:51,66,7a,6c,4c,1d,38,12,df,b4,13,
         be,63,4d,14,02,c6,5e,60,a3,eb,04,37,c0
      "{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,
         51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11
      "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
         fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
      "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
         b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
      "{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
         06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
      "{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,
         07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75
      "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
         1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
      "{3EF64538-8B54-4573-B48F-4D34B0238AB2}"=hex:51,66,7a,6c,4c,1d,38,12,56,46,e5,
         3a,66,c5,1d,00,cb,99,0e,74,b5,7d,ce,a6
      "{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,
         69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18
      "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
         94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
      "{ABD3B5E1-B268-407B-A150-2641DAB8D898}"=hex:51,66,7a,6c,4c,1d,38,12,8f,b6,c0,
         af,5a,fc,15,05,de,46,65,01,df,e6,9c,8c
      "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
         d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
      "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
         df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
      "{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
         f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
      "{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,
         fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
      "Enabled"=dword:00000001
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
      @Denied: (A 2) (Everyone)
      @="Shockwave Flash Object"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
      "ThreadingModel"="Apartment"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
      @="0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
      @="ShockwaveFlash.ShockwaveFlash.11"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
      @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
      @="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
      @="ShockwaveFlash.ShockwaveFlash"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
      @Denied: (A 2) (Everyone)
      @="Macromedia Flash Factory Object"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
      "ThreadingModel"="Apartment"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
      @="FlashFactory.FlashFactory.1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
      @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
      @="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
      @="FlashFactory.FlashFactory"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker4"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
      @="{00020424-0000-0000-C000-000000000046}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
      @Denied: (Full) (Everyone)
      .
      Completion time: 2012-06-01  16:25:23
      ComboFix-quarantined-files.txt  2012-06-01 23:25
      .
      Pre-Run: 250,109,919,232 bytes free
      Post-Run: 251,596,574,720 bytes free
      .
      - - End Of File - - 4448D23AAE96695D59981DFEF75D1DCD

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 996
      • Certifications: List
      • Experience: Expert
      • OS: Windows 8
      Re: Slow computer, possible replicating virus . . .?
      « Reply #3 on: June 01, 2012, 06:07:58 PM »
      It would appear from the Security Check that your AV program, MSE is not activated. Please check this and make sure it is actually activated.
      You can uninstall Java(TM) 6 Update 32. It's no longer needed since it's been upgraded. Please explain to me about the slowness of your computer? Is it slow all the time or just slow starting up? Is is slow while browsing on the internet? 


      Please download aswMBR.exe ( 511KB ) to your desktop.

      Double click the aswMBR.exe to run it



      Click the "Scan" button to start scan

      Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives



      On completion of the scan click save log, save it to your desktop and post in your next reply
      **********************************************************
      Please download Rooter and Save it to your desktop.
      • Double click it to start the tool.Vista and Windows7 run as administrator.
      • Click Scan.
      • Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
      Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

      ashton

        Topic Starter


        Rookie
        • Experience: Beginner
        • OS: Windows 7
        Re: Slow computer, possible replicating virus . . .?
        « Reply #4 on: June 01, 2012, 06:41:11 PM »
        I temporarily disabled MSE for the ComboFix log, since it says so in the instructions, but it is now enabled again.

        I have also went ahead and removed the old Java update.

        As for the computer's slowness: every program takes a long time to open/load, and oftentimes programs lag, sometimes frozen for several minutes. This computer shares a wi-fi connection with several others in the home, and they have no issues with freezing while online, with the exception of this one, so I know it's not the internet. Also, when the computer is shutting down, it always says that there is a program running. and I have to do a Force Shutdown; the program that is always active says "Task Host."

        Once again, thank you for any help!

        Here are the newly requested logs:

        aswMBR:

        aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
        Run date: 2012-06-01 17:41:08
        -----------------------------
        17:41:08.316    OS Version: Windows x64 6.1.7601 Service Pack 1
        17:41:08.316    Number of processors: 2 586 0x170A
        17:41:08.316    ComputerName: CAROL-PC  UserName: carol
        17:41:08.940    Initialize success
        17:41:12.054    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
        17:41:12.054    Disk 0 Vendor: TOSHIBA_MK3263GSX FG020C Size: 305245MB BusType: 11
        17:41:12.070    Disk 0 MBR read successfully
        17:41:12.070    Disk 0 MBR scan
        17:41:12.070    Disk 0 unknown MBR code
        17:41:12.085    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          199 MB offset 2048
        17:41:12.101    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       292848 MB offset 409600
        17:41:12.132    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        12196 MB offset 600162304
        17:41:12.163    Disk 0 scanning C:\Windows\system32\drivers
        17:41:26.562    Service scanning
        17:41:58.059    Modules scanning
        17:41:58.059    Disk 0 trace - called modules:
        17:41:58.090    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
        17:41:58.106    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800339b060]
        17:41:58.106    3 CLASSPNP.SYS[fffff8800116743f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002ebc060]
        17:41:58.121    Scan finished successfully
        17:42:06.171    Disk 0 MBR has been saved successfully to "C:\Users\carol\Desktop\MBR.dat"
        17:42:06.171    The log file has been saved successfully to "C:\Users\carol\Desktop\aswMBR.txt"

        Rooter:

        Rooter.exe (v1.0.2) by Eric_71
        .
        SeDebugPrivilege granted successfully ...
        .
        Windows 7 Home Edition (6.1.7601) Service Pack 1
        [32_bits] - Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
        .
        [wscsvc] (Security Center) RUNNING (state:4)
        [MpsSvc] RUNNING (state:4)
        Windows Firewall -> Enabled
        Windows Defender -> Enabled
        User Account Control (UAC) -> Enabled
        .
        Internet Explorer 9.0.8112.16421
        Mozilla Firefox 12.0 (en-US)
        .
        C:\  [Fixed-NTFS] .. ( Total:285 Go - Free:234 Go )
        D:\  [Fixed-NTFS] .. ( Total:11 Go - Free:1 Go )
        E:\  [CD_Rom]
        .
        Scan : 17:42.25
        Path : C:\Users\carol\Desktop\Rooter.exe
        User : carol ( Administrator -> YES )
        .
        ----------------------\\ Processes
        .
        Locked [System Process] (0)
        Locked System (4)
        ______ ????????? (280)
        ______ ????????? (392)
        ______ ????????? (444)
        ______ ????????? (456)
        ______ ????????? (500)
        ______ ????????? (516)
        ______ ????????? (524)
        ______ ????????? (608)
        ______ ????????? (676)
        ______ ????????? (752)
        ______ ????????? (800)
        ______ ????????? (912)
        ______ ????????? (944)
        ______ ????????? (988)
        ______ ????????? (596)
        ______ ????????? (852)
        ______ ????????? (1188)
        ______ ????????? (1212)
        ______ ????????? (1300)
        ______ ????????? (1308)
        ______ ????????? (1404)
        ______ ????????? (1432)
        ______ ????????? (1468)
        ______ ????????? (1544)
        ______ C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1576)
        ______ ????????? (1632)
        ______ ????????? (1640)
        ______ ????????? (1672)
        ______ ????????? (1768)
        ______ ????????? (1876)
        ______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (1892)
        ______ C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (1972)
        ______ ????????? (2008)
        ______ C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (968)
        ______ ????????? (2060)
        ______ C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (2480)
        ______ ????????? (2544)
        ______ ????????? (2592)
        ______ ????????? (2052)
        ______ C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (296)
        ______ ????????? (1732)
        ______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (2076)
        ______ ????????? (1916)
        ______ ????????? (748)
        Locked audiodg.exe (3372)
        ______ ????????? (2932)
        ______ ????????? (3684)
        ______ ????????? (3672)
        ______ ????????? (3396)
        ______ C:\Users\carol\Desktop\Rooter.exe (3616)
        .
        ----------------------\\ Device\Harddisk0\
        .
        \Device\Harddisk0 [Sectors : 63 x 512 Bytes]
        .
        \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:208666624)
        \Device\Harddisk0\Partition2 (Start_Offset:209715200 | Length:307073384448)
        \Device\Harddisk0\Partition3 (Start_Offset:307283099648 | Length:12788432896)
        .
        ----------------------\\ Scheduled Tasks
        .
        C:\Windows\Tasks\Adobe Flash Player Updater.job
        C:\Windows\Tasks\HPCeeScheduleForcarol.job
        C:\Windows\Tasks\SA.DAT
        C:\Windows\Tasks\SCHEDLGU.TXT
        .
        ----------------------\\ Registry
        .
        .
        ----------------------\\ Files & Folders
        .
        ----------------------\\ Scan completed at 17:42.27
        .
        C:\Rooter$\Rooter_2.txt - (01/06/2012 | 17:42.27)

        ashton

          Topic Starter


          Rookie
          • Experience: Beginner
          • OS: Windows 7
          Re: Slow computer, possible replicating virus . . .?
          « Reply #5 on: June 01, 2012, 06:44:10 PM »
          Sorry, here is the Rooter log, without smileys:

          Rooter.exe (v1.0.2) by Eric_71
          .
          SeDebugPrivilege granted successfully ...
          .
          Windows 7 Home Edition (6.1.7601) Service Pack 1
          [32_bits] - Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
          .
          [wscsvc] (Security Center) RUNNING (state:4)
          [MpsSvc] RUNNING (state:4)
          Windows Firewall -> Enabled
          Windows Defender -> Enabled
          User Account Control (UAC) -> Enabled
          .
          Internet Explorer 9.0.8112.16421
          Mozilla Firefox 12.0 (en-US)
          .
          C:\  [Fixed-NTFS] .. ( Total:285 Go - Free:234 Go )
          D:\  [Fixed-NTFS] .. ( Total:11 Go - Free:1 Go )
          E:\  [CD_Rom]
          .
          Scan : 17:42.25
          Path : C:\Users\carol\Desktop\Rooter.exe
          User : carol ( Administrator -> YES )
          .
          ----------------------\\ Processes
          .
          Locked [System Process] (0)
          Locked System (4)
          ______ ????????? (280)
          ______ ????????? (392)
          ______ ????????? (444)
          ______ ????????? (456)
          ______ ????????? (500)
          ______ ????????? (516)
          ______ ????????? (524)
          ______ ????????? (608)
          ______ ????????? (676)
          ______ ????????? (752)
          ______ ????????? (800)
          ______ ????????? (912)
          ______ ????????? (944)
          ______ ????????? (988)
          ______ ????????? (596)
          ______ ????????? (852)
          ______ ????????? (1188)
          ______ ????????? (1212)
          ______ ????????? (1300)
          ______ ????????? (1308)
          ______ ????????? (1404)
          ______ ????????? (1432)
          ______ ????????? (1468)
          ______ ????????? (1544)
          ______ C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1576)
          ______ ????????? (1632)
          ______ ????????? (1640)
          ______ ????????? (1672)
          ______ ????????? (1768)
          ______ ????????? (1876)
          ______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (1892)
          ______ C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (1972)
          ______ ????????? (2008)
          ______ C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (968)
          ______ ????????? (2060)
          ______ C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (2480)
          ______ ????????? (2544)
          ______ ????????? (2592)
          ______ ????????? (2052)
          ______ C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (296)
          ______ ????????? (1732)
          ______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (2076)
          ______ ????????? (1916)
          ______ ????????? (748)
          Locked audiodg.exe (3372)
          ______ ????????? (2932)
          ______ ????????? (3684)
          ______ ????????? (3672)
          ______ ????????? (3396)
          ______ C:\Users\carol\Desktop\Rooter.exe (3616)
          .
          ----------------------\\ Device\Harddisk0\
          .
          \Device\Harddisk0 [Sectors : 63 x 512 Bytes]
          .
          \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:208666624)
          \Device\Harddisk0\Partition2 (Start_Offset:209715200 | Length:307073384448)
          \Device\Harddisk0\Partition3 (Start_Offset:307283099648 | Length:12788432896)
          .
          ----------------------\\ Scheduled Tasks
          .
          C:\Windows\Tasks\Adobe Flash Player Updater.job
          C:\Windows\Tasks\HPCeeScheduleForcarol.job
          C:\Windows\Tasks\SA.DAT
          C:\Windows\Tasks\SCHEDLGU.TXT
          .
          ----------------------\\ Registry
          .
          .
          ----------------------\\ Files & Folders
          .
          ----------------------\\ Scan completed at 17:42.27
          .
          C:\Rooter$\Rooter_2.txt - (01/06/2012 | 17:42.27)

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 996
          • Certifications: List
          • Experience: Expert
          • OS: Windows 8
          Re: Slow computer, possible replicating virus . . .?
          « Reply #6 on: June 01, 2012, 07:42:21 PM »
          i think I see one problem.

          Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

          Link 1
          Link 2
          Link 3

          •Double-click on MBRCheck.exe to run it.

          •It will open a black window...please do not fix anything (if it gives you an option).

          •When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.

          •A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
          •Please copy and paste the contents of that log in your next reply.
          Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

          ashton

            Topic Starter


            Rookie
            • Experience: Beginner
            • OS: Windows 7
            Re: Slow computer, possible replicating virus . . .?
            « Reply #7 on: June 01, 2012, 08:30:23 PM »
            All right~ the log is pasted below:

            MBRCheck, version 1.2.3
            (c) 2010, AD

            Command-line:         
            Windows Version:      Windows 7 Home Premium Edition
            Windows Information:      Service Pack 1 (build 7601), 64-bit
            Base Board Manufacturer:   Wistron
            BIOS Manufacturer:      Hewlett-Packard
            System Manufacturer:      Hewlett-Packard
            System Product Name:      HP G60 Notebook PC
            Logical Drives Mask:      0x0000001c

            Kernel Drivers (total 228):
              0x02C11000 \SystemRoot\system32\ntoskrnl.exe
              0x031F9000 \SystemRoot\system32\hal.dll
              0x00B96000 \SystemRoot\system32\kdcom.dll
              0x00CF2000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
              0x00D41000 \SystemRoot\system32\PSHED.dll
              0x00D55000 \SystemRoot\system32\CLFS.SYS
              0x00C00000 \SystemRoot\system32\CI.dll
              0x00EE9000 \SystemRoot\system32\drivers\Wdf01000.sys
              0x00F8D000 \SystemRoot\system32\drivers\WDFLDR.SYS
              0x00F9C000 \SystemRoot\system32\drivers\ACPI.sys
              0x00FF3000 \SystemRoot\system32\drivers\WMILIB.SYS
              0x00E00000 \SystemRoot\system32\drivers\msisadrv.sys
              0x00E0A000 \SystemRoot\system32\drivers\pci.sys
              0x00E3D000 \SystemRoot\system32\drivers\vdrvroot.sys
              0x00E4A000 \SystemRoot\system32\drivers\isapnp.sys
              0x00E53000 \SystemRoot\system32\drivers\mpio.sys
              0x00E7D000 \SystemRoot\System32\drivers\partmgr.sys
              0x00E92000 \SystemRoot\system32\DRIVERS\compbatt.sys
              0x00E9B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
              0x00EA7000 \SystemRoot\system32\drivers\volmgr.sys
              0x01028000 \SystemRoot\System32\drivers\volmgrx.sys
              0x01084000 \SystemRoot\system32\drivers\intelide.sys
              0x0108C000 \SystemRoot\system32\drivers\PCIIDEX.SYS
              0x0109C000 \SystemRoot\system32\drivers\aliide.sys
              0x010A3000 \SystemRoot\system32\drivers\amdide.sys
              0x010AA000 \SystemRoot\system32\drivers\cmdide.sys
              0x010B2000 \SystemRoot\System32\drivers\mountmgr.sys
              0x010CC000 \SystemRoot\system32\drivers\msdsm.sys
              0x010F2000 \SystemRoot\system32\drivers\nvraid.sys
              0x0111A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
              0x0114A000 \SystemRoot\system32\drivers\pciide.sys
              0x01151000 \SystemRoot\system32\drivers\viaide.sys
              0x01206000 \SystemRoot\system32\drivers\iaStorV.sys
              0x01324000 \SystemRoot\system32\drivers\atapi.sys
              0x0132D000 \SystemRoot\system32\drivers\ataport.SYS
              0x01357000 \SystemRoot\system32\DRIVERS\lsi_sas.sys
              0x01374000 \SystemRoot\system32\DRIVERS\storport.sys
              0x013D7000 \SystemRoot\system32\drivers\msahci.sys
              0x013E2000 \SystemRoot\system32\drivers\HpSAMD.sys
              0x01159000 \SystemRoot\system32\DRIVERS\adp94xx.sys
              0x014DB000 \SystemRoot\system32\DRIVERS\adpahci.sys
              0x01531000 \SystemRoot\system32\DRIVERS\adpu320.sys
              0x01560000 \SystemRoot\system32\drivers\amdsata.sys
              0x0157E000 \SystemRoot\system32\DRIVERS\amdsbs.sys
              0x015C5000 \SystemRoot\system32\drivers\amdxata.sys
              0x015D0000 \SystemRoot\system32\DRIVERS\arc.sys
              0x01400000 \SystemRoot\system32\DRIVERS\arcsas.sys
              0x0141B000 \SystemRoot\system32\DRIVERS\elxstor.sys
              0x014A2000 \SystemRoot\system32\DRIVERS\iirsp.sys
              0x014B3000 \SystemRoot\system32\DRIVERS\lsi_fc.sys
              0x015E9000 \SystemRoot\system32\DRIVERS\lsi_sas2.sys
              0x011D4000 \SystemRoot\system32\DRIVERS\lsi_scsi.sys
              0x011F3000 \SystemRoot\system32\DRIVERS\megasas.sys
              0x016FD000 \SystemRoot\system32\DRIVERS\MegaSR.sys
              0x017A1000 \SystemRoot\system32\DRIVERS\nfrd960.sys
              0x017B1000 \SystemRoot\system32\drivers\nvstor.sys
              0x01837000 \SystemRoot\system32\DRIVERS\ql2300.sys
              0x01600000 \SystemRoot\system32\DRIVERS\ql40xx.sys
              0x019DB000 \SystemRoot\system32\DRIVERS\SiSRaid2.sys
              0x01800000 \SystemRoot\system32\DRIVERS\sisraid4.sys
              0x01818000 \SystemRoot\system32\DRIVERS\stexstor.sys
              0x0165F000 \SystemRoot\system32\DRIVERS\vsmraid.sys
              0x01689000 \SystemRoot\system32\drivers\fltmgr.sys
              0x01822000 \SystemRoot\system32\drivers\fileinfo.sys
              0x00DB3000 \SystemRoot\system32\DRIVERS\MpFilter.sys
              0x01A0A000 \SystemRoot\System32\Drivers\Ntfs.sys
              0x01C22000 \SystemRoot\System32\Drivers\msrpc.sys
              0x01C80000 \SystemRoot\System32\Drivers\ksecdd.sys
              0x01C9B000 \SystemRoot\System32\Drivers\cng.sys
              0x01D0D000 \SystemRoot\System32\drivers\pcw.sys
              0x01D1E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
              0x01ECB000 \SystemRoot\system32\drivers\ndis.sys
              0x01E00000 \SystemRoot\system32\drivers\NETIO.SYS
              0x01E60000 \SystemRoot\System32\Drivers\ksecpkg.sys
              0x020B1000 \SystemRoot\System32\drivers\tcpip.sys
              0x022B4000 \SystemRoot\System32\drivers\fwpkclnt.sys
              0x022FE000 \SystemRoot\system32\DRIVERS\wd.sys
              0x02306000 \SystemRoot\system32\drivers\volsnap.sys
              0x02352000 \SystemRoot\System32\Drivers\spldr.sys
              0x0235A000 \SystemRoot\system32\drivers\sbp2port.sys
              0x02377000 \SystemRoot\System32\drivers\rdyboost.sys
              0x023B1000 \SystemRoot\System32\Drivers\mup.sys
              0x023C3000 \SystemRoot\System32\drivers\hwpolicy.sys
              0x02000000 \SystemRoot\System32\DRIVERS\fvevol.sys
              0x0203A000 \SystemRoot\system32\DRIVERS\disk.sys
              0x023CC000 \SystemRoot\system32\drivers\cdrom.sys
              0x023F6000 \SystemRoot\System32\Drivers\Null.SYS
              0x02088000 \SystemRoot\System32\Drivers\Beep.SYS
              0x0208F000 \SystemRoot\System32\drivers\vga.sys
              0x01E8B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
              0x0209D000 \SystemRoot\System32\drivers\watchdog.sys
              0x01EB0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
              0x01EB9000 \SystemRoot\system32\drivers\rdpencdd.sys
              0x01EC2000 \SystemRoot\system32\drivers\rdprefmp.sys
              0x01FBE000 \SystemRoot\System32\Drivers\Msfs.SYS
              0x01FC9000 \SystemRoot\System32\Drivers\Npfs.SYS
              0x01FDA000 \SystemRoot\system32\DRIVERS\tdx.sys
              0x01D28000 \SystemRoot\system32\DRIVERS\TDI.SYS
              0x01D35000 \SystemRoot\system32\drivers\afd.sys
              0x01BAD000 \SystemRoot\System32\DRIVERS\netbt.sys
              0x01DBE000 \SystemRoot\system32\drivers\ws2ifsl.sys
              0x01DC9000 \SystemRoot\system32\DRIVERS\wfplwf.sys
              0x01DD2000 \SystemRoot\system32\DRIVERS\pacer.sys
              0x01C00000 \SystemRoot\system32\DRIVERS\vwififlt.sys
              0x019E9000 \SystemRoot\system32\DRIVERS\netbios.sys
              0x017DC000 \SystemRoot\system32\DRIVERS\wanarp.sys
              0x016D5000 \SystemRoot\system32\drivers\termdd.sys
              0x01C16000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
              0x01BF2000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
              0x0463F000 \SystemRoot\system32\DRIVERS\rdbss.sys
              0x04690000 \SystemRoot\system32\drivers\nsiproxy.sys
              0x0469C000 \SystemRoot\system32\drivers\mssmbios.sys
              0x046A7000 \SystemRoot\System32\drivers\discache.sys
              0x046B6000 \SystemRoot\System32\Drivers\dfsc.sys
              0x046D4000 \SystemRoot\system32\DRIVERS\blbdrive.sys
              0x046E5000 \SystemRoot\system32\DRIVERS\tunnel.sys
              0x0470B000 \SystemRoot\system32\DRIVERS\intelppm.sys
              0x04721000 \SystemRoot\system32\drivers\wmiacpi.sys
              0x05229000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
              0x05C4C000 \SystemRoot\System32\drivers\dxgkrnl.sys
              0x05D40000 \SystemRoot\System32\drivers\dxgmms1.sys
              0x05D86000 \SystemRoot\system32\drivers\usbuhci.sys
              0x05D93000 \SystemRoot\system32\drivers\USBPORT.SYS
              0x05DE9000 \SystemRoot\system32\drivers\usbehci.sys
              0x05200000 \SystemRoot\system32\drivers\HDAudBus.sys
              0x0472A000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
              0x04818000 \SystemRoot\system32\DRIVERS\athrx.sys
              0x04A62000 \SystemRoot\system32\DRIVERS\vwifibus.sys
              0x04A6F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
              0x04A8D000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
              0x04A99000 \SystemRoot\system32\DRIVERS\kbdclass.sys
              0x04AA8000 \SystemRoot\system32\DRIVERS\SynTP.sys
              0x04AF1000 \SystemRoot\system32\DRIVERS\USBD.SYS
              0x04AF3000 \SystemRoot\system32\drivers\mouclass.sys
              0x04B02000 \SystemRoot\system32\DRIVERS\CmBatt.sys
              0x04B07000 \SystemRoot\system32\drivers\CompositeBus.sys
              0x04B17000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
              0x04B2D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
              0x04B51000 \SystemRoot\system32\DRIVERS\ndistapi.sys
              0x04B5D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
              0x04B8C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
              0x04BA7000 \SystemRoot\system32\DRIVERS\raspptp.sys
              0x04BC8000 \SystemRoot\system32\DRIVERS\rassstp.sys
              0x04BE2000 \SystemRoot\system32\drivers\swenum.sys
              0x04763000 \SystemRoot\system32\drivers\ks.sys
              0x04BE4000 \SystemRoot\system32\DRIVERS\umbus.sys
              0x047A6000 \SystemRoot\system32\DRIVERS\usbhub.sys
              0x04800000 \SystemRoot\System32\Drivers\NDProxy.SYS
              0x03688000 \SystemRoot\system32\drivers\CHDRT64.sys
              0x03736000 \SystemRoot\system32\drivers\portcls.sys
              0x03773000 \SystemRoot\system32\drivers\drmk.sys
              0x03795000 \SystemRoot\system32\drivers\ksthunk.sys
              0x0379B000 \SystemRoot\system32\DRIVERS\CAXHWAZL.sys
              0x04C0E000 \SystemRoot\system32\DRIVERS\CAX_DPV.sys
              0x04E29000 \SystemRoot\system32\DRIVERS\CAX_CNXT.sys
              0x04EF4000 \SystemRoot\system32\drivers\modem.sys
              0x04F03000 \SystemRoot\system32\drivers\IntcHdmi.sys
              0x04F2A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
              0x04F47000 \SystemRoot\System32\Drivers\usbvideo.sys
              0x04F75000 \SystemRoot\System32\Drivers\crashdmp.sys
              0x04F83000 \SystemRoot\System32\Drivers\dump_dumpata.sys
              0x04F8F000 \SystemRoot\System32\Drivers\dump_msahci.sys
              0x04F9A000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
              0x00080000 \SystemRoot\System32\win32k.sys
              0x04FAD000 \SystemRoot\System32\drivers\Dxapi.sys
              0x04FB9000 \SystemRoot\system32\DRIVERS\monitor.sys
              0x00450000 \SystemRoot\System32\TSDDD.dll
              0x006F0000 \SystemRoot\System32\cdd.dll
              0x008A0000 \SystemRoot\System32\ATMFD.DLL
              0x04FC7000 \SystemRoot\system32\drivers\luafv.sys
              0x04E00000 \SystemRoot\system32\drivers\WudfPf.sys
              0x04FEA000 \SystemRoot\system32\DRIVERS\lltdio.sys
              0x04D82000 \SystemRoot\system32\DRIVERS\nwifi.sys
              0x04DD5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
              0x04DE8000 \SystemRoot\system32\DRIVERS\rspndr.sys
              0x032B3000 \SystemRoot\system32\drivers\HTTP.sys
              0x0337C000 \SystemRoot\system32\DRIVERS\bowser.sys
              0x0339A000 \SystemRoot\System32\drivers\mpsdrv.sys
              0x033B2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
              0x03200000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
              0x0324E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
              0x03272000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
              0x06A83000 \SystemRoot\system32\drivers\peauth.sys
              0x06B29000 \SystemRoot\System32\Drivers\secdrv.SYS
              0x06B34000 \SystemRoot\System32\DRIVERS\srvnet.sys
              0x06B65000 \SystemRoot\System32\drivers\tcpipreg.sys
              0x06B77000 \SystemRoot\system32\DRIVERS\XAudio64.sys
              0x06B7F000 \SystemRoot\System32\DRIVERS\srv2.sys
              0x0700B000 \SystemRoot\System32\DRIVERS\srv.sys
              0x77AC0000 \Windows\System32\ntdll.dll
              0x47F50000 \Windows\System32\smss.exe
              0xFFDE0000 \Windows\System32\apisetschema.dll
              0xFF9A0000 \Windows\System32\autochk.exe
              0xFFCF0000 \Windows\System32\advapi32.dll
              0xFEF60000 \Windows\System32\shell32.dll
              0xFEE50000 \Windows\System32\msctf.dll
              0xFEE00000 \Windows\System32\ws2_32.dll
              0x778B0000 \Windows\System32\iertutil.dll
              0xFED60000 \Windows\System32\msvcrt.dll
              0xFED50000 \Windows\System32\nsi.dll
              0xFED40000 \Windows\System32\lpk.dll
              0x77750000 \Windows\System32\wininet.dll
              0xFED20000 \Windows\System32\sechost.dll
              0xFEC50000 \Windows\System32\usp10.dll
              0x77650000 \Windows\System32\user32.dll
              0xFEBE0000 \Windows\System32\gdi32.dll
              0x77500000 \Windows\System32\urlmon.dll
              0x773E0000 \Windows\System32\kernel32.dll
              0xFEA00000 \Windows\System32\setupapi.dll
              0xFE9E0000 \Windows\System32\imagehlp.dll
              0xFE960000 \Windows\System32\difxapi.dll
              0xFE8E0000 \Windows\System32\shlwapi.dll
              0xFE7B0000 \Windows\System32\rpcrt4.dll
              0x77C90000 \Windows\System32\normaliz.dll
              0xFE780000 \Windows\System32\imm32.dll
              0x77C80000 \Windows\System32\psapi.dll
              0xFE720000 \Windows\System32\Wldap32.dll
              0xFE680000 \Windows\System32\comdlg32.dll
              0xFE5A0000 \Windows\System32\oleaut32.dll
              0xFE500000 \Windows\System32\clbcatq.dll
              0xFE2F0000 \Windows\System32\ole32.dll
              0xFE180000 \Windows\System32\crypt32.dll
              0xFE140000 \Windows\System32\wintrust.dll
              0xFE120000 \Windows\System32\devobj.dll
              0xFE0E0000 \Windows\System32\cfgmgr32.dll
              0xFE070000 \Windows\System32\KernelBase.dll
              0xFDFD0000 \Windows\System32\comctl32.dll
              0xFDFC0000 \Windows\System32\msasn1.dll

            Processes (total 51):
                   0 System Idle Process
                   4 System
                 280 C:\Windows\System32\smss.exe
                 396 csrss.exe
                 448 C:\Windows\System32\wininit.exe
                 460 csrss.exe
                 504 C:\Windows\System32\services.exe
                 520 C:\Windows\System32\lsass.exe
                 532 C:\Windows\System32\lsm.exe
                 612 C:\Windows\System32\winlogon.exe
                 676 C:\Windows\System32\svchost.exe
                 756 C:\Windows\System32\svchost.exe
                 804 C:\Program Files\Microsoft Security Client\MsMpEng.exe
                 900 C:\Windows\System32\svchost.exe
                 948 C:\Windows\System32\svchost.exe
                 992 C:\Windows\System32\svchost.exe
                 596 C:\Windows\System32\svchost.exe
                 440 C:\Windows\System32\svchost.exe
                1172 C:\Windows\System32\dwm.exe
                1308 C:\Windows\explorer.exe
                1356 C:\Windows\System32\wlanext.exe
                1364 C:\Windows\System32\conhost.exe
                1428 C:\Windows\System32\spoolsv.exe
                1456 C:\Windows\System32\svchost.exe
                1520 C:\Program Files\SUPERAntiSpyware\SASCore64.exe
                1584 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                1620 C:\Windows\System32\svchost.exe
                1656 C:\Windows\System32\svchost.exe
                1708 C:\Windows\System32\taskhost.exe
                1860 C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
                1912 C:\Windows\System32\svchost.exe
                1956 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
                1996 C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
                1304 C:\Program Files\Java\jre6\bin\jusched.exe
                1276 C:\Windows\System32\igfxpers.exe
                1264 C:\Program Files\Microsoft Security Client\msseces.exe
                1492 C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
                1828 C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
                2256 C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
                2292 C:\Windows\System32\svchost.exe
                2336 C:\Windows\System32\svchost.exe
                3052 C:\Windows\System32\SearchIndexer.exe
                2128 C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
                 972 WmiPrvSE.exe
                3152 C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
                3672 C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
                2512 C:\Program Files\Windows Media Player\wmpnetwk.exe
                1048 C:\Windows\System32\audiodg.exe
                 740 C:\Users\carol\Desktop\MBRCheck.exe
                1108 C:\Windows\System32\conhost.exe
                3764 C:\Windows\System32\dllhost.exe

            \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c800000  (NTFS)
            \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000047`8b800000  (NTFS)

            PhysicalDrive0 Model Number: TOSHIBAMK3263GSX, Rev: FG020C 

                  Size  Device Name          MBR Status
              --------------------------------------------
                298 GB  \\.\PhysicalDrive0   Unknown MBR code
                        SHA1: AC2C3A9AC297D1BBF7F1A54596ACBEDDD7F164E 6


            Found non-standard or infected MBR.
            Enter 'Y' and hit ENTER for more options, or 'N' to exit:

            Done!

            SuperDave

            • Malware Removal Specialist


            • Genius
            • Thanked: 996
            • Certifications: List
            • Experience: Expert
            • OS: Windows 8
            Re: Slow computer, possible replicating virus . . .?
            « Reply #8 on: June 02, 2012, 01:29:36 PM »
            We need to fix the Master Boot Record using aswMBR now.

            • Double click aswMBR.exe to run it like before
            • Once the scan finishes click FixMBR to remove the infection as illustrated below


            • Once the scan finishes click Save log to save the log to your Desktop



            • Copy and paste the contents of aswMBR.txt back here for review
            .
            Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

            ashton

              Topic Starter


              Rookie
              • Experience: Beginner
              • OS: Windows 7
              Re: Slow computer, possible replicating virus . . .?
              « Reply #9 on: June 02, 2012, 01:45:41 PM »
              The new log:

              aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
              Run date: 2012-06-02 12:52:40
              -----------------------------
              12:52:40.841    OS Version: Windows x64 6.1.7601 Service Pack 1
              12:52:40.841    Number of processors: 2 586 0x170A
              12:52:40.857    ComputerName: CAROL-PC  UserName: carol
              12:52:41.668    Initialize success
              12:52:44.725    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
              12:52:44.725    Disk 0 Vendor: TOSHIBA_MK3263GSX FG020C Size: 305245MB BusType: 11
              12:52:44.757    Disk 0 MBR read successfully
              12:52:44.757    Disk 0 MBR scan
              12:52:44.757    Disk 0 Windows 7 default MBR code
              12:52:44.772    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          199 MB offset 2048
              12:52:44.788    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       292848 MB offset 409600
              12:52:44.803    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        12196 MB offset 600162304
              12:52:44.850    Disk 0 scanning C:\Windows\system32\drivers
              12:52:52.900    Service scanning
              12:53:22.899    Modules scanning
              12:53:22.899    Disk 0 trace - called modules:
              12:53:22.945    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
              12:53:22.945    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003379060]
              12:53:23.460    3 CLASSPNP.SYS[fffff8800111b43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002e8f680]
              12:53:23.460    Scan finished successfully
              12:53:27.643    Verifying
              12:53:37.689    Disk 0 Windows 601 MBR fixed successfully
              12:55:15.002    Disk 0 MBR has been saved successfully to "C:\Users\carol\Desktop\MBR.dat"
              12:55:15.080    The log file has been saved successfully to "C:\Users\carol\Desktop\aswMBR2.txt"

              SuperDave

              • Malware Removal Specialist


              • Genius
              • Thanked: 996
              • Certifications: List
              • Experience: Expert
              • OS: Windows 8
              Re: Slow computer, possible replicating virus . . .?
              « Reply #10 on: June 02, 2012, 04:21:26 PM »
              That looks good. How's your computer running now?

              I'd like to scan your machine with ESET OnlineScan

              •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
              ESET OnlineScan
              •Click the button.
              •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
              • Click on to download the ESET Smart Installer. Save it to your desktop.
              • Double click on the icon on your desktop.
              •Check
              •Click the button.
              •Accept any security warnings from your browser.
              •Check
              •Push the Start button.
              •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
              •When the scan completes, push
              •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
              •Push the button.
              •Push
              A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
              Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

              ashton

                Topic Starter


                Rookie
                • Experience: Beginner
                • OS: Windows 7
                Re: Slow computer, possible replicating virus . . .?
                « Reply #11 on: June 02, 2012, 07:01:02 PM »
                Thanks, Dave. Here is the list of threats that I saved from the scan:

                ESETScan:

                C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll   a variant of Win32/Adware.Yontoo.B application   cleaned by deleting - quarantined
                C:\Qoobox\Quarantine\C\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEIPlug.dll.vir   Win32/Toolbar.MyWebSearch application   cleaned by deleting - quarantined
                C:\Qoobox\Quarantine\C\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEZSETP.dll.vir   Win32/Toolbar.MyWebSearch application   cleaned by deleting - quarantined
                C:\Qoobox\Quarantine\C\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\NP2pEISb.dll.vir   Win32/Toolbar.MyWebSearch application   cleaned by deleting - quarantined

                SuperDave

                • Malware Removal Specialist


                • Genius
                • Thanked: 996
                • Certifications: List
                • Experience: Expert
                • OS: Windows 8
                Re: Slow computer, possible replicating virus . . .?
                « Reply #12 on: June 03, 2012, 12:36:08 PM »
                That looks good. If there are no other issues, we can do some cleanup.

                To uninstall ComboFix

                • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
                • In the field, type in ComboFix /uninstall


                (Note: Make sure there's a space between the word ComboFix and the forward-slash.)

                • Then, press Enter, or click OK.
                • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
                ***************************************************
                Clean out your temporary internet files and temp files.

                Download TFC by OldTimer to your desktop.

                Double-click TFC.exe to run it.

                Note: If you are running on Vista, right-click on the file and choose Run As Administrator

                TFC will close all programs when run, so make sure you have saved all your work before you begin.

                * Click the Start button to begin the cleaning process.
                * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
                * Please let TFC run uninterrupted until it is finished.

                Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
                ***************************************************
                Looking over your log it seems you don't have any evidence of a third party firewall.

                Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

                Remember only install ONE firewall

                1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
                2) Online Armor
                3) Agnitum Outpost
                4) PC Tools Firewall Plus

                If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
                ****************************************************
                Go to Microsoft Windows Update and get all critical updates.

                ----------

                I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

                SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
                * Using SpywareBlaster to protect your computer from Spyware and Malware
                * If you don't know what ActiveX controls are, see here

                Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

                Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

                Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
                Safe Surfing!
                Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

                ashton

                  Topic Starter


                  Rookie
                  • Experience: Beginner
                  • OS: Windows 7
                  Re: Slow computer, possible replicating virus . . .?
                  « Reply #13 on: June 03, 2012, 07:37:59 PM »
                  Thanks for all your help, Dave, I really appreciate it~

                  SuperDave

                  • Malware Removal Specialist


                  • Genius
                  • Thanked: 996
                  • Certifications: List
                  • Experience: Expert
                  • OS: Windows 8
                  Re: Slow computer, possible replicating virus . . .?
                  « Reply #14 on: June 04, 2012, 04:32:09 PM »
                  Thanks for all your help, Dave, I really appreciate it~
                  You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.
                  Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender