System Running Slow

cxsnut · February 8, 2009

My system is running slow and I suspect there are problems. Following the instructions from "I'm infected - What do I do now?", here are the Log files.

Thanks in advance for your help,

Cxsnut.

Note: When I run MBAM, Scan Results show 7 Hijack.Search registry data entries. Under the Action Taken header displays No Action Taken.

Malwarebytes' Anti-Malware 1.33

Database version: 1733

Windows 5.1.2600 Service Pack 3

2/8/2009 3:18:17 PM

mbam-log-2009-02-08 (15-18-17).txt

Scan type: Quick Scan

Objects scanned: 43352

Time elapsed: 1 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 7

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://*.mcafee.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1210903343375

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1224957338593

O17 - HKLM\System\CCS\Services\Tcpip\..\{950794EE-CEF8-41A1-82C7-8FB40A6A5059}: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 10.0.0.1

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

--

End of file - 9426 bytes

cxsnut · February 10, 2009

Greetings,

I suspect I have problems with my system. Following instructions I used the Antivirius software I already had and removed all that was detected. Additionally I downloaded and used AntiVir. Following that I used HijackThis and posted the required HJT and MBM logs. Have I missed something?

With the latest downloads I have the following in use:

Avast - main use anti virius

Ad Aware

C Cleaner

MBM

SpyBot

HJT

AntiVir

Thanks for any help you may offer,

Bob

AdvancedSetup · February 11, 2009

Did you set these name server entries?

NameServer = 10.0.0.1

NameServer = 208.67.220.220,208.67.222.222

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

cxsnut · February 13, 2009

Thanks for your response. I will follow your instructions on ComboFix and post the results. Sorry, I dont understand the question: Did you set these name server entries?

NameServer = 10.0.0.1

NameServer = 208.67.220.220,208.67.222.222

I am not sure what or where these entries are.

Bob

AdvancedSetup · February 13, 2009

No problem, if this is not a work computer and you don't know what they are then we'll remove them as these entries are often manipulated by Malware.

If you later find you do need them, we can put them back. Go ahead and run the Combofix (making sure to disable your Anti-Virus so that it does not stop CF from working)

Thanks.

cxsnut · February 14, 2009

Thanks. I have the CD-R's needed to upload the Recovery Console. Next post will be the results of ComboFix.

Bob

cxsnut · February 14, 2009

OK. I have finished the instructions. However I am unsure if the Recovery Console was downloaded properly. ComboFix prompted the download, but I did not see the blue screen" The Recovery Console was successfully installed." Here are the ComboFix and HJT logs.

Thank You, Bob

ComboFix 09-02-12.03 - Bob 2009-02-14 12:15:23.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.475 [GMT -5:00]

Running from: c:\documents and settings\Bob\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Bob\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

AV: avast! antivirus 4.8.1335 [VPS 090213-0] *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 )))))))))))))))))))))))))))))))

.

2009-02-05 19:41 . 2009-02-05 18:46 15,688 --a------ c:\windows\system32\lsdelete.exe

2009-02-05 18:47 . 2009-02-05 18:46 64,160 --a------ c:\windows\system32\drivers\Lbd.sys

2009-02-05 18:44 . 2009-02-05 18:44 <DIR> d-------- c:\program files\Lavasoft

2009-02-05 18:44 . 2009-02-05 18:44 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-01-18 12:49 . 2009-01-18 12:49 <DIR> d-------- c:\documents and settings\Bob\Application Data\TaxCut

2009-01-18 12:46 . 2009-01-18 12:47 <DIR> d-------- c:\program files\TaxCut08

2009-01-18 12:46 . 2009-01-18 12:46 <DIR> d-------- c:\program files\PDF995

2009-01-18 12:42 . 2009-01-18 12:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\TaxCut

2009-01-17 20:15 . 2009-01-17 20:16 <DIR> d-------- c:\program files\RogueRemover FREE

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-13 07:17 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-01-15 23:27 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-01-15 23:23 --------- d-----w c:\program files\CCleaner

2009-01-14 21:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-14 21:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-01-01 20:07 --------- d-----w c:\program files\Trend Micro

2008-04-07 06:59 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-04-07 06:59 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-04-07 06:59 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-08-20 23:53 61,952 ----a-w c:\program files\mozilla firefox\components\nmrowfkt.dll

2008-04-07 06:59 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-04-07 06:59 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-02-14_11.55.05.68 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-02-14 17:11:13 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_480.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-12-31 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 65536]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-05 509784]

"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Lavasoft\\Ad-Aware\\Ad-Aware.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-05 64160]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-05-17 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-05-17 20560]

R2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [2008-02-28 18944]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]

.

Contents of the 'Scheduled Tasks' folder

2009-02-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-05 18:46]

2009-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-01-22 c:\windows\Tasks\EasyShare Registration Task.job

- c:\docume~1\ALLUSE~1\APPLIC~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.6.20.1.sxt _RegistrationOffer@16 []

2008-05-24 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job

- c:\program files\Microsoft IntelliPoint\ipoint.exe [2007-08-31 14:01]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.rr.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/

mSearchMigratedDefaultURL = hxxp://www.google.com/

mSearch Bar = hxxp://windiwsfsearch.com/ie6.html

mSearchURL = hxxp://windiwsfsearch.com

IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

Trusted Zone: internet

Trusted Zone: mcafee.com

Trusted Zone: microsoft.com

Trusted Zone: microsoft.com\download.windowsupdate

Trusted Zone: microsoft.com\update

Trusted Zone: microsoft.com\www.update

TCP: {950794EE-CEF8-41A1-82C7-8FB40A6A5059} = 208.67.220.220,208.67.222.222

FF - ProfilePath -

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://*.mcafee.com