Problems, Episode II: Attack of the Crash

[Imperial]

My problem has been solved (thank you Soybean, CBMatt, and anyone else I fail to remember ), but my girlfriend has one, so I made a new topic.

[Imperial]

Don't really need this anymore.

Imperial

[doug_funny]

If I were you, I would tell your mom to buy BitDefender Antivirus Plus 10 @
http://www.bitdefender.com/PRODUCT-2143-en--BitDefender-Antivirus-Plus-v10.html
I have been using Bitdefender for years now ever since version 8 first came out. When you buy BitDefender Antivirus Plus 10, it comes with Antivirus, a Firewall, Antispam filter, & Anti spyware remover. It's a excellent program that finds viruses that Norton doesn't find. You can change the way BitDefender acts when it finds a virus or a  suspected virus. I always choose to delete both viruses and suspected viruses. Bitdefender is constantly scanning everything, so if your playing a game or something it will cause you to lag a little bit. You can always disable certain features in bitdefender. Make sure you buy BitDefender Antivirus Plus 10 for $50 for 2 years. It only cost $50 and you get 2 licenses for 2 years and you get 24/7 customer support if you encouter any problems. I have never had any problems with the program.

[Imperial]

And I've told her multiple times that we need to buy protection software.

However, with our current budget, the only software we can afford comes with a Five-Finger Discount.

And now FireFox is losing my internet connection every other page, as if I had none, yet, AIM is still running perfectly =/

[CBMatt]

However, with our current budget, the only software we can afford comes with a Five-Finger Discount.

I wouldn't be so quick to blame your mom.  There is a very good chance that some of this pirated software you're downloading has infected your computer.  And unfortunately, we don't deal with illegal copies of software.

[Imperial]

CBMatt, that was my way of saying that we're too poor to buy hardly anything, much less protection for my computer.

Everything I specified on my computer has been downloaded on the appropriate website for free. Trial versions, Free software (such as Spybot), etc.

Symantec was given to me by an online friend. who hosted it on, I believe MegaUpload. If it was pirated prior to my reception of it, I'm not held responsible for his partaking in illegal activities.

The only actual illegal thing I mentioned was using my wireless adapter to connect to my next-door neighbor's internet. Otherwise, I've done nothing wrong.

In addition, I blame my mom strictly because I've had basically no trouble since she began to use my computer instead of her own. Such happenings is a little too coincidental, don't you think?

Especially when she goes on, does her deal, and let's me back on again. Then I attempt to do whatever I wish to do (I.E go back on a website) and it takes me over a minute to load a page that took a mere 3-4 seconds before she got on, even after restarting my computer.

[patio]

Why is this post so wide ? ?

[soybean]

Why is this post so wide ? ?

Because of one line in his HijackThis report.  Sure is annoying, isn't it!

Imperial, your HijackThis report shows StyleXPService.exe running.  Can you disable or remove that?  It's not a harmful file but, according to some sources, may be using a good bit of memory.

Are you using more than one anti-virus?  I see evidence of both Symantec and AVG.  Do not run two anti-virus programs in resident memory at the same time.  Actually, I suggest you just remove Symantec and use AVG.

Also, are using more than one firewall?  Does your Symantec software include a firewall?  I see evidence of Comodo\Firewall.  And, what about Windows Firewall?  As with anti-virus, don't run two firewalls at the same time.

Do you have a Lexmark printer connected to that computer?

[CBMatt]

I'm sorry, Imperial, I took your comment the wrong way.  I have to go in a few minutes, but there are a few things I'd like you to try.

I'm not spotting anything malicious in your log, but let's address a few things...


1.  To remove Symantec from your computer, follow these steps.

2.  Download CCleaner (install without Yahoo! toolbar) and configure it according to this guide before running it.

3.  Update AVG and scan with it in Safe Mode.  See if it catches anything then.  While you're there, delete C:\Program Files\Spyware Doctor if it still exists.

4.  Download ComboFix and save it to your desktop.  Run the program and read its disclaimer (it's fairly short) and make sure you really pay attention to what it says.  Follow the prompts and when finished, it will produce a log at C:\ComboFix.txt.  Go ahead and post that here.  Note: Don't click on the window while it's running; this may cause stalls.

5.  Disable TeaTimer and open HijackThis (and print out this post or save it in a Notepad file, as you won't have access to it).  Check the following entries...

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://82.98.235.58/trafc-2/rfe.php?nid=go&cmp=mygeek_9&q=music&uid=8D7EA596E77611DA853B000B6AC2AAE3&guid=ecc1ca13+DFF1692788E64EAAA097460B7E65289B&lid=C:%5CDocuments%20and%20Settings%5CAll%20Users%5CDocuments%5CMy%20Music
(Do you recognize this?  If not then check it.)

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
(If you didn't set this with Spybot, check them.  If you did, you can leave them alone.)

Close all windows except for HijackThis and click on Fixed Check.

6.  Your Java is out of date.  You'll want to correct this quickly, as it will help provide further protection for you.  To do so, go here and click on Free Java Download.  You will be given instructions on what to do next.


And because this could also be a hardware issue...

7.  When was the last time you dusted this computer?

8.  Try a free memory diagnostics at www.memtest86.com

9.  You might also want to make sure all of your fans are working properly and that the computer isn't overheating.



Look into these and post back with a new HijackThis log and an update on how things are working.

Why is this post so wide ? ?

It's the link in his last R1 entry in the log.

[Imperial]

I can remove it if I need to. If it's causing a lot of memory to go down the drain surely.

I have Symantec and AVG. As I said, I've been tipped previously of needing only one, and that AVG was the better deal. Hearing it again is only more insurance on what to do.

I downloaded Comodo, and didn't specify anything besides when it started running. However, I believe it took the place of both Symantec's and Windows'.

I apologize for the extensive length caused by my HJT log, it just seems whenever I have a problem that it's asked for so I've been doing it without consent these days

I'm going to go delete these programs now and then I'll come back and let you know if it worked.

Thanks.

And, thanks CBMatt. I'll be sure to follow these steps you've given me.

I'm guessing I can restart my computer into normal mode for step six, so I'll take care of it too.

Oh, and I had a Lexmark product downloaded on my computer at some point.

[soybean]

Re: firewalls, go to Control Panel, open Security Center, and expand the Firewall section to see what it shows as running.

If you have no Lexmark printer, I would remove that Lexmark software.

[Imperial]

Yep, only Comodo.

Ok I'm gonna get to work now

[GX1_Man]

First you need to choose one antivirus and use it alone. Norton is expensive and sucks off too many system resources. AVG is great, and free is certainly cheaper than Norton or Bit Defender.

So do that and post back some improvements. 

[CBMatt]

First you need to choose one antivirus and use it alone. Norton is expensive and sucks off too many system resources. AVG is great, and free is certainly cheaper than Norton or Bit Defender.

Not only that, but it also tends to have more success when it comes to detecting and cleaning infections.


I was very tired this morning, so I left out one important step...
You need to move HijackThis off of your desktop and into its own folder.  Create a special folder for HijackThis and move it there.  And if it created a backup folder, move that also.
And yes, you may restart to Normal Mode after Step 5.


How's everything going?

[Imperial]

NOTE: This is very long so I made it into TWO posts.


After doing 5 of the 8 steps CBMatt gave me, my computer has began to act much faster.

I still need to update Java and things, but here is the ComboFix .txt you said I might as well post:

"Mom" - 2007-05-26 21:22:57    Service Pack 2  [SAFE MODE]
ComboFix 07-05.26.3.V - Running from: "C:\Documents and Settings\Mom\Desktop\"


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


"C:\WINDOWS\system32\drivers\fad.sys"


(((((((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_FAD


(((((((((((((((((((((((((((((((   Files Created from 2007-04-26 to 2007-05-26  ))))))))))))))))))))))))))))))))))


2007-05-26 16:55   <DIR>   d--------   C:\Program Files\CCleaner
2007-05-23 14:45   <DIR>   d----c---   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-05-23 14:45   <DIR>   d--------   C:\DOCUME~1\Mom\APPLIC~1\Comodo
2007-05-23 14:37   <DIR>   d--------   C:\Program Files\Comodo
2007-05-20 21:40   <DIR>   d--------   C:\Program Files\GiPo@Utilities
2007-05-20 21:40   <DIR>   d--------   C:\Program Files\Common Files\Gibinsoft Shared
2007-05-19 15:11   3,968   --a------   C:\WINDOWS\SYSTEM32\DRIVERS\AvgArCln.sys
2007-05-19 15:06   3,968   --a------   C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-05-16 04:12   <DIR>   d--------   C:\Program Files\MSXML 4.0
2007-05-15 21:26   45,056   --a------   C:\WINDOWS\SYSTEM32\KPDDynCC.DLL
2007-05-15 21:26   40,960   --a------   C:\WINDOWS\SYSTEM32\KPDLM.dll
2007-05-15 21:26   2,367,488   --a------   C:\WINDOWS\SYSTEM32\xerces-c_2_7.dll
2007-05-15 21:26   196,608   --a------   C:\WINDOWS\SYSTEM32\KPDRES.dll
2007-05-15 21:25   <DIR>   d--------   C:\WINDOWS\SYSTEM32\BWKDLogs
2007-05-15 21:21   5,632   --a------   C:\WINDOWS\SYSTEM32\ptpusb.dll
2007-05-15 21:21   159,232   --a------   C:\WINDOWS\SYSTEM32\ptpusd.dll
2007-05-15 21:21   15,104   --a------   C:\WINDOWS\SYSTEM32\DRIVERS\usbscan.sys
2007-05-15 21:21   <DIR>   d--------   C:\Program Files\Common Files\Kodak
2007-05-15 21:17   <DIR>   d--------   C:\Program Files\Kodak
2007-05-15 21:16   <DIR>   d----c---   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
2007-05-13 22:15   <DIR>   d--------   C:\Program Files\ArtCursors
2007-05-13 21:00   <DIR>   d--------   C:\Program Files\MTV Networks
2007-05-13 19:59   <DIR>   d--------   C:\Program Files\AIM Music Link
2007-05-13 19:57   <DIR>   d--------   C:\Program Files\AvPropPlugin
2007-05-13 19:53   <DIR>   d--------   C:\Program Files\AIM FightList
2007-05-13 01:58   8,464   --a------   C:\WINDOWS\SYSTEM32\sporder.dll
2007-05-13 01:55   <DIR>   d--------   C:\Program Files\TGTSoft
2007-05-12 20:12   <DIR>   d----c---   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-26 22:14:24   --------   d--h--r   C:\DOCUME~1\Mom\APPLIC~1\yahoo!
2007-05-26 22:13:56   --------   d-----w   C:\Program Files\Yahoo!
2007-05-19 01:15:36   --------   d-----w   C:\Program Files\WordPerfect Office 12
2007-05-13 23:05:06   --------   d-----w   C:\Program Files\AIM6
2007-05-13 00:03:42   --------   d-----w   C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-05-11 02:38:39   --------   d-----w   C:\Program Files\SwiftSwitch
2007-04-18 16:12:23   2,854,400   ----a-w   C:\WINDOWS\system32\msi.dll
2007-03-17 13:43:01   292,864   ----a-w   C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28   577,536   ----a-w   C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28   40,960   ----a-w   C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28   281,600   ----a-w   C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48   1,843,584   ----a-w   C:\WINDOWS\system32\win32k.sys