Jump to content

Please help, PC running very slowly, can't seem to find the culprit

equaltemp
 Share

Recommended Posts

equaltemp

equaltemp

Posted
Posted

Hello,

 

About a week ago my laptop performance began to slow down, and it's progressively gotten worse. Many pages time-out and won't load at all. The only programs I've downloaded and/or installed within the past few months was SUPERAntiSpyware. In the past when my PC's performance started slowing down, it was either a program draining a lot of memory or a virus, and the fix was fairly easy. But I'm stumped as to why it's running so slowly now. I've pasted below the 2 files (FRST.txt and Addition.txt) which the instructions asked for.

 

Here's a list of everything I've tried thus far:

 

Malwarebytes Anti-Malware - I ran a full scan (including rootkits) and it came up clean.

 

Bitdefender (my current anti-virus program) - I ran a full scan and it found 25 infected files, but still the performance didn't improve any.

 

Combofix - After running, performance did not improve.

 

SUPERAntiSpyware - I ran a full scan and it came up clean.

 

Adwcleaner - Scan came up clean

 

I also checked task manager for any services/programs that might be using an inordinate amount of memory, but everything was as it normally is. Opera 29 is my primary browser, but even when using Firefox or Internet Explorer, the performance is just as slow.

 

I'm using an HP laptop, Win XP Pro, Opera 29 (primary browser), 2GB memory, 60GB Hard Drive (only using about 30%). 

 

Any help would be very much appreciated.

 

-------------------------------------------------------------------------------------------------------------

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by User (administrator) on COMPUTER_1 on 19-05-2015 08:20:09
Running from C:\Documents and Settings\User\Desktop
Loaded Profiles: User (Available profiles: User & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: Opera)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
(Microsoft Corporation) C:\WINDOWS\system32\locator.exe
(Microsoft Corporation) C:\WINDOWS\system32\tcpsvcs.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Zhorn Software) C:\Program Files\Stickies\stickies.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.47\opera.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Stickies.lnk [2014-01-09]
ShortcutTarget: Stickies.lnk -> C:\Program Files\Stickies\stickies.exe (Zhorn Software)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-329068152-1935655697-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-329068152-1935655697-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-329068152-1935655697-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll [2014-03-06] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll [2014-03-06] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.3.254
 
FireFox:
========
FF ProfilePath: C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tftha0il.default-1414334938406
FF SelectedSearchEngine: Yahoo.co.uk
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-05-03] ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2003-07-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-05-11] (Adobe Systems Inc.)
FF Extension: LastPass - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tftha0il.default-1414334938406\Extensions\support@lastpass.com [2014-10-26]
FF Extension: 1-Click YouTube Video Downloader - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tftha0il.default-1414334938406\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2014-11-06]
FF Extension: Adblock Plus - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tftha0il.default-1414334938406\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-26]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-10-21]
 
Opera: 
=======
OPR StartupUrls: "hxxp://www.indeed.com/"
OPR Extension: (AdBlock) - C:\Documents and Settings\User\Application Data\Opera Software\Opera Stable\Extensions\aobdicepooefnbaeokijohmhjlleamfj [2013-09-03]
OPR Extension: (LastPass) - C:\Documents and Settings\User\Application Data\Opera Software\Opera Stable\Extensions\hnjalnkldgigidggphhmacmimbdlafdo [2014-05-02]
OPR Extension: (YouTube Downloader) - C:\Documents and Settings\User\Application Data\Opera Software\Opera Stable\Extensions\kclijeogghhkmenkommbnjobhnndpfba [2015-04-18]
OPR Extension: (Bookmarks Manager) - C:\Documents and Settings\User\Application Data\Opera Software\Opera Stable\Extensions\nkgbeagkihphgjnlkclfjjjplmefndnm [2014-05-03]
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera Old Version\Opera.exe
StartMenuInternet: (HKU\S-1-5-21-329068152-1935655697-1417001333-1003) Opera - "C:\Program Files\Opera\Opera.exe"
 
========================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S4 BackupService; C:\Documents and Settings\User\Application Data\HP SimpleSave Application\uUACTokenSvc.exe [67104 2013-02-21] (ArcSoft, Inc.)
R2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [57520 2013-10-23] (Bitdefender)
S4 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2009-10-16] (Hewlett-Packard Company) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 avc3; C:\WINDOWS\System32\DRIVERS\avc3.sys [633344 2013-04-17] (BitDefender)
R3 avchv; C:\WINDOWS\System32\DRIVERS\avchv.sys [242504 2012-11-02] (BitDefender)
R3 avckf; C:\WINDOWS\System32\DRIVERS\avckf.sys [486536 2013-04-17] (BitDefender)
R1 bdftdif; C:\Program Files\Bitdefender\Antivirus Free Edition\bdftdif.sys [148600 2013-04-17] (Bitdefender SRL)
R1 bdselfpr; C:\Program Files\Bitdefender\Antivirus Free Edition\bdselfpr.sys [135472 2013-07-16] (BitDefender LLC)
S3 eabfiltr; C:\WINDOWS\System32\DRIVERS\eabfiltr.sys [7808 2006-10-29] (Hewlett-Packard Development Company, L.P.)
S3 eabusb; C:\WINDOWS\System32\DRIVERS\eabusb.sys [5760 2006-10-29] (Hewlett-Packard Development Company, L.P.)
R1 gzflt; C:\WINDOWS\System32\DRIVERS\gzflt.sys [164952 2013-04-22] (BitDefender LLC)
S3 HP24X; C:\WINDOWS\System32\DRIVERS\HP24X.sys [33024 2006-10-19] (Hewlett Packard)
R3 IFXTPM; C:\WINDOWS\System32\DRIVERS\IFXTPM.SYS [36352 2006-10-29] (Infineon Technologies AG)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 NETw5x32; C:\WINDOWS\System32\DRIVERS\NETw5x32.sys [3634688 2009-01-05] (Intel Corporation)
R3 NETwLx32; C:\WINDOWS\System32\DRIVERS\NETwLx32.sys [6616816 2013-05-02] (Intel Corporation)
S3 SWDUMon; C:\WINDOWS\System32\DRIVERS\SWDUMon.sys [13464 2014-05-15] ()
R0 trufos; C:\WINDOWS\System32\DRIVERS\trufos.sys [355744 2013-05-28] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 CFcatchme; \??\C:\ComboFix\CFcatchme.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-05-19 08:20 - 2015-05-19 08:20 - 00009958 _____ () C:\Documents and Settings\User\Desktop\FRST.txt
2015-05-19 08:18 - 2015-05-19 08:18 - 01146368 _____ (Farbar) C:\Documents and Settings\User\Desktop\FRST.exe
2015-05-18 15:22 - 2015-05-18 15:22 - 00010510 _____ () C:\ComboFix.txt
2015-05-18 15:22 - 2015-05-18 15:22 - 00000000 ____D () C:\Documents and Settings\NetworkService\Local Settings\temp
2015-05-18 15:22 - 2015-05-18 15:22 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\temp
2015-05-18 15:22 - 2015-05-18 15:22 - 00000000 ____D () C:\Documents and Settings\Default User.WINDOWS.0\Local Settings\temp
2015-05-18 15:22 - 2015-05-18 15:22 - 00000000 ____D () C:\Documents and Settings\David Balsamo\Local Settings\temp
2015-05-18 15:22 - 2015-05-18 15:22 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\temp
2015-05-18 15:06 - 2011-06-26 02:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2015-05-18 15:06 - 2010-11-07 13:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2015-05-18 15:06 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2015-05-18 15:06 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2015-05-18 15:06 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2015-05-18 15:06 - 2000-08-30 20:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2015-05-18 15:06 - 2000-08-30 20:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2015-05-18 15:06 - 2000-08-30 20:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2015-05-18 15:06 - 2000-08-30 20:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2015-05-18 15:05 - 2015-05-18 15:22 - 00000000 ____D () C:\Qoobox
2015-05-18 15:00 - 2015-05-18 15:00 - 00000372 _____ () C:\Documents and Settings\User\Desktop\Shortcut to ComboFix.lnk
2015-05-11 13:56 - 2015-05-11 13:56 - 02204160 _____ () C:\Documents and Settings\User\Desktop\adwcleaner_4.203.exe
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-05-19 08:20 - 2015-02-26 20:46 - 00000000 ____D () C:\FRST
2015-05-19 08:20 - 2014-10-21 11:45 - 00000000 ____D () C:\Documents and Settings\User\Local Settings\temp
2015-05-19 08:08 - 2014-10-31 18:27 - 00000398 _____ () C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1414794453.job
2015-05-19 07:29 - 2014-10-14 12:44 - 01487075 _____ () C:\WINDOWS\WindowsUpdate.log
2015-05-19 07:28 - 2014-03-04 11:10 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-05-19 07:28 - 2014-03-04 11:10 - 00000049 _____ () C:\WINDOWS\wiaservc.log
2015-05-19 07:28 - 2013-02-07 20:33 - 00000000 ____D () C:\Documents and Settings\User\Application Data\stickies
2015-05-19 07:27 - 2012-09-12 17:37 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-05-19 06:55 - 2014-03-04 11:10 - 00032500 _____ () C:\WINDOWS\SchedLgU.Txt
2015-05-19 06:55 - 2012-09-12 17:38 - 00000278 ___SH () C:\Documents and Settings\User\ntuser.ini
2015-05-18 19:55 - 2015-03-03 21:57 - 00000000 ____D () C:\AdwCleaner
2015-05-18 16:17 - 2013-01-19 15:40 - 00002497 _____ () C:\Documents and Settings\User\Desktop\Microsoft Office Word 2003.lnk
2015-05-18 15:18 - 2001-08-23 07:00 - 00000327 _____ () C:\WINDOWS\system.ini
2015-05-18 15:17 - 2012-09-12 17:30 - 00000000 ____D () C:\WINDOWS\system32\Restore
2015-05-18 15:05 - 1980-01-13 17:54 - 00000000 ____D () C:\WINDOWS\erdnt
2015-05-18 12:43 - 2014-06-04 21:31 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-05-18 08:35 - 2014-06-04 21:30 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-18 08:35 - 2013-07-05 22:36 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-17 18:38 - 2014-09-10 05:13 - 00000191 _____ () C:\Documents and Settings\All Users\Application Data\LockFilePath.ini
2015-05-17 18:35 - 2013-01-12 20:11 - 00448043 _____ () C:\Documents and Settings\User\Desktop\TD Checking.amj
2015-05-16 17:47 - 2014-12-11 18:42 - 00000892 _____ () C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-05-16 10:04 - 2014-10-21 17:33 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-05-16 10:04 - 2001-08-23 07:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2015-05-16 09:59 - 2013-08-10 13:30 - 137310008 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-14 09:58 - 2012-09-12 17:37 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2015-05-13 10:16 - 2015-03-05 11:14 - 00074237 _____ () C:\WINDOWS\setupapi.log
2015-05-11 13:59 - 2012-09-12 17:37 - 00000178 ___SH () C:\Documents and Settings\LocalService\ntuser.ini
2015-05-03 05:00 - 2013-01-15 12:09 - 00778416 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-05-03 05:00 - 2013-01-15 12:09 - 00142512 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-05-02 19:25 - 2015-01-24 05:58 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-05-01 18:27 - 2013-01-28 20:20 - 00000000 ____D () C:\Documents and Settings\User\Application Data\vlc
2015-04-28 08:08 - 2014-01-07 16:24 - 00000000 ____D () C:\Program Files\Opera
2015-04-23 17:28 - 2014-08-18 03:44 - 00000000 ____D () C:\Documents and Settings\User\Local Settings\Application Data\Adobe
 
==================== Files in the root of some directories =======
 
2013-08-19 05:08 - 2013-08-19 05:18 - 0003891 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash
2013-08-19 05:08 - 2013-08-19 05:17 - 0003663 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash.20130819050809.log
2013-08-19 05:18 - 2013-08-19 05:18 - 0003697 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash.20130819051807.gnucash
2013-08-19 05:18 - 2013-08-19 05:18 - 0000904 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash.20130819051807.log
2013-08-19 08:41 - 2013-08-19 09:20 - 0000976 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash.20130819084102.log
2013-08-19 09:46 - 2013-08-19 09:46 - 0000976 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash.20130819094628.log
2013-08-19 09:47 - 2013-08-19 09:51 - 0003075 _____ () C:\Documents and Settings\User\Local Settings\Application Data\Dave's Financial Accounts.gnucash.20130819094745.log
2014-01-17 05:56 - 2014-08-02 21:01 - 0059904 _____ () C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-19 09:36 - 2013-08-19 09:36 - 0000218 _____ () C:\Documents and Settings\User\Local Settings\Application Data\recently-used.xbel
 
Some content of TEMP:
====================
C:\Documents and Settings\User\Local Settings\temp\Quarantine.exe
C:\Documents and Settings\User\Local Settings\temp\sqlite3.dll
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
==================== End Of Log ============================
 
 
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-05-2015 02
Ran by User at 2015-05-19 08:21:00
Running from C:\Documents and Settings\User\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-329068152-1935655697-1417001333-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
ASPNET (S-1-5-21-329068152-1935655697-1417001333-1004 - Limited - Disabled)
Guest (S-1-5-21-329068152-1935655697-1417001333-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-329068152-1935655697-1417001333-1000 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-329068152-1935655697-1417001333-1002 - Limited - Disabled)
User (S-1-5-21-329068152-1935655697-1417001333-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\User
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Bitdefender Antivirus Free Edition (Enabled - Up to date) {9488E0FA-F058-4673-850E-E755F112BABC}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
AceMoney (HKLM\...\AceMoney_is1) (Version:  - MechCAD Software)
AceMoney Lite (HKLM\...\AceMoney Lite_is1) (Version:  - MechCAD Software)
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Bitdefender Antivirus Free Edition (HKLM\...\BitDefender Gonzales) (Version: 1.0.21.1099 - Bitdefender)
Broadcom NetXtreme Ethernet Controller (HKLM\...\{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}) (Version: 10.15.01 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
HP PCMCIA Smart Card Reader (HKLM\...\{24B3DF86-75B9-4DBD-AC39-C0C041583E6F}) (Version: 1.01.0001 - HP)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 6.14.10.5218 - Intel Corporation)
Itibiti RTC (Version: 0.0.1 - Itibiti Inc) Hidden
LastPass (uninstall only) (HKLM\...\LastPass) (Version:  - LastPass)
LightScribe System Software (HKLM\...\{10CCF16B-F1C9-4B24-9570-B4CCEE42392D}) (Version: 1.18.9.1 - LightScribe)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 36.0 (x86 en-US) (HKLM\...\Mozilla Firefox 36.0 (x86 en-US)) (Version: 36.0 - Mozilla)
Opera 12.17 (HKLM\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
Opera Stable 29.0.1795.47 (HKLM\...\Opera 29.0.1795.47) (Version: 29.0.1795.47 - Opera Software ASA)
Paint Shop Pro 6.0 (ESD) (HKLM\...\Paint Shop Pro 6.0) (Version:  - )
Sonic Activation Module (Version: 1.0 - Sonic Solutions) Hidden
SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 5.10.01.5240 - Analog Devices)
Stickies 7.1e (HKLM\...\ZhornStickies) (Version:  - Zhorn Software)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version:  - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows PowerShell 1.0 (HKLM\...\KB926139-v2) (Version: 2 - Microsoft Corporation)
WinZip (HKLM\...\WinZip) (Version:  8.1  (4331) - WinZip Computing, Inc.)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 
==================== Restore Points  =========================
 
18-05-2015 15:18:00 System Checkpoint
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2007-08-11 02:58 - 2015-05-18 15:17 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_17_0_0_169_pepper.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1399038432.job.bak => C:\Program Files\Opera\launcher.exe
Task: C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1414794453.job => C:\Program Files\Opera\launcher.exe
 
==================== Loaded Modules (Whitelisted) ==============
 
2014-10-29 19:44 - 2013-03-19 12:07 - 00508136 _____ () C:\Program Files\Bitdefender\Antivirus Free Edition\sqlite3.dll
2014-10-29 19:44 - 2013-09-03 14:29 - 00095088 _____ () C:\Program Files\Bitdefender\Antivirus Free Edition\BDMetrics.dll
2014-01-09 10:25 - 2014-01-09 10:25 - 00049152 _____ () C:\Program Files\Stickies\shook70.dll
2008-04-14 00:41 - 2008-04-14 00:41 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll
2008-04-14 00:42 - 2008-04-14 00:42 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
AlternateDataStreams: C:\Documents and Settings\User\Desktop\adwcleaner_4.203.exe:BDU
AlternateDataStreams: C:\Documents and Settings\User\Desktop\FRST.exe:BDU
AlternateDataStreams: C:\Documents and Settings\User\Desktop\SUPERAntiSpyware.exe:BDU
 
==================== Safe Mode (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
 
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-329068152-1935655697-1417001333-1003\...\100sexlinks.com -> 100sexlinks.com
 
There are 5317 more restricted sites.
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-329068152-1935655697-1417001333-1003\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.3.254
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupfolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk => C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
MSCONFIG\startupfolder: C:^Documents and Settings^User^Start Menu^Programs^Startup^Dropbox.lnk => C:\WINDOWS\pss\Dropbox.lnkStartup
MSCONFIG\startupfolder: C:^Documents and Settings^User^Start Menu^Programs^Startup^HP SimpleSave Monitor.lnk => C:\WINDOWS\pss\HP SimpleSave Monitor.lnkStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ctfmon.exe => C:\WINDOWS\system32\ctfmon.exe
MSCONFIG\startupreg: HotKeysCmds => C:\WINDOWS\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\WINDOWS\system32\igfxtray.exe
MSCONFIG\startupreg: Persistence => C:\WINDOWS\system32\igfxpers.exe
MSCONFIG\startupreg: SoundMAXPnP => C:\Program Files\Analog Devices\Core\smax4pnp.exe
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\mmc.exe] => Enabled:Microsoft Management Console
StandardProfile\AuthorizedApplications: [C:\Program Files\Opera Old Version\opera.exe] => Enabled:Opera Internet Browser
StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)
DomainProfile\GloballyOpenPorts: [1723:TCP] => Enabled:@xpsp2res.dll,-22015
DomainProfile\GloballyOpenPorts: [1701:UDP] => Enabled:@xpsp2res.dll,-22016
DomainProfile\GloballyOpenPorts: [500:UDP] => Enabled:@xpsp2res.dll,-22017
StandardProfile\GloballyOpenPorts: [1723:TCP] => Enabled:@xpsp2res.dll,-22015
StandardProfile\GloballyOpenPorts: [1701:UDP] => Enabled:@xpsp2res.dll,-22016
StandardProfile\GloballyOpenPorts: [500:UDP] => Enabled:@xpsp2res.dll,-22017
StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22004
StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22005
StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22001
StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22002
StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22007
StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
==================== Faulty Device Manager Devices =============
 
Name: BitDefender AVC HV
Description: BitDefender AVC HV
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: avchv
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/19/2015 08:20:15 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:46 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:45 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.
 
 
System errors:
=============
Error: (05/19/2015 04:30:42 AM) (Source: Dhcp) (EventID: 1001) (User: )
Description: Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 001B77B4F8AD.  The following error
occurred: 
%%1223.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.
 
Error: (05/18/2015 03:08:59 PM) (Source: PlugPlayManager) (EventID: 11) (User: )
Description: The device Root\LEGACY_SASKUTIL\0000 disappeared from the system without first being prepared for removal.
 
Error: (05/18/2015 03:08:59 PM) (Source: PlugPlayManager) (EventID: 11) (User: )
Description: The device Root\LEGACY_SASDIFSV\0000 disappeared from the system without first being prepared for removal.
 
Error: (05/15/2015 11:51:51 AM) (Source: Windows Update Agent) (EventID: 16) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.
 
Error: (05/13/2015 10:13:41 AM) (Source: Windows Update Agent) (EventID: 16) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.
 
Error: (05/11/2015 01:59:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Application Layer Gateway Service service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (05/11/2015 01:59:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Simple TCP/IP Services service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (05/11/2015 01:59:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Remote Procedure Call (RPC) Locator service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (04/30/2015 00:49:25 PM) (Source: PlugPlayManager) (EventID: 11) (User: )
Description: The device Root\LEGACY_SASKUTIL\0000 disappeared from the system without first being prepared for removal.
 
Error: (04/30/2015 00:49:25 PM) (Source: PlugPlayManager) (EventID: 11) (User: )
Description: The device Root\LEGACY_SASDIFSV\0000 disappeared from the system without first being prepared for removal.
 
 
Microsoft Office Sessions:
=========================
Error: (05/19/2015 08:20:15 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:46 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:45 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
Error: (05/19/2015 04:51:40 AM) (Source: crypt32) (EventID: 11) (User: )
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core2 Duo CPU T7300 @ 2.00GHz
Percentage of memory in use: 41%
Total physical RAM: 2039.23 MB
Available physical RAM: 1198.97 MB
Total Pagefile: 3924.36 MB
Available Pagefile: 2849.03 MB
Total Virtual: 2047.88 MB
Available Virtual: 1921.65 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:74.52 GB) (Free:56.5 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive e: (KINGSTON) (Removable) (Total:3.78 GB) (Free:1.7 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: 5363540D)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (Size: 3.8 GB) (Disk ID: 004FC0B3)
Partition 1: (Active) - (Size=3.8 GB) - (Type=0B)
 
==================== End Of Log ============================

 

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll try to help your with your issue.
 
     
    
Before we start please read and note the following:

  • We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • I volunteer to help you, so please, do not ask for help for your company/business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

:excl: I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!
:excl: There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  warning.gif Rules and policies
 
We won't support any piracy. 
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

 

 

Please upload reports instead of pasting. Thanks :)

Link to post
Share on other sites
equaltemp

equaltemp

Posted
  • Author
Posted

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

  • We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • I volunteer to help you, so please, do not ask for help for your company/business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

:excl: I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

:excl: There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  warning.gif Rules and policies

 

We won't support any piracy. 

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

 

 

Please upload reports instead of pasting. Thanks :)

Twinheadedeagle,

 

Thank you for offering to help me with my PC issue. You mentioned that I should attach all requested files from here on in. Did you want me to resend the FRST.txt and Addition.txt files as attachments?

 

equaltemp

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

FRST.gif Fix with Farbar Recovery Scan Tool
 


icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif
icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

Link to post
Share on other sites
equaltemp

equaltemp

Posted
  • Author
Posted

FRST.gif Fix with Farbar Recovery Scan Tool

 

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif

icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

 

Download attached fixlist.txt file and save it to the Desktop:

 

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Twinheadedeagle,

 

I downloading fixlist.txt to my desktop, opened FRST file and pressed "fix". After about 10 seconds a window popped up saying that a problem was encounter and file needs to close, so I clicked the "close" button. You said if FRST needs to restart for some reason that I should try running it again. I opened FRST again, pressed "fix" and the same thing happened with the pop up window. It did create a "fixlog" despite the problem so I attached it.

 

Any idea why this may have happened? What I should do at this point?

Fixlog.txt

Link to post
Share on other sites
equaltemp

equaltemp

Posted
  • Author
Posted

Can you reboot and try again?

Twinheadedeagle,

 

I rebooted and tried again but got the same result. But just to be clear that I understand your instructions correctly, the FRST file you're referring to is the one you had me download and run yesterday, correct? And after opening FRST I'm only supposed to press "fix" and not run a scan first, correct?  

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware
 
Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

  • First of all, select update.
  • Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
  • Click the Scan tab, choose Threat Scan is checked and click Scan Now.
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the newest Scan Log.
  • At the bottom click Export and choose Text file.

Save the file to your desktop and upload your next reply.
 


FRST.gif Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please upload them into your next reply.

Link to post
Share on other sites
equaltemp

equaltemp

Posted
  • Author
Posted

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware

 

Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

  • First of all, select update.
  • Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
  • Click the Scan tab, choose Threat Scan is checked and click Scan Now.
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the newest Scan Log.
  • At the bottom click Export and choose Text file.

Save the file to your desktop and upload your next reply.

 

FRST.gif Scan with Farbar Recovery Scan Tool

 

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please upload them into your next reply

I attached the 3 files you requested. Note: when I went to save the Malwarebytes scan file, the "file name" section was empty so I named it "malwarebytes scan" 

malwarebytes scan.txt

FRST.txt

Addition.txt

Link to post
Share on other sites
equaltemp

equaltemp

Posted
  • Author
Posted

This is pretty old PC and pretty outdated operating system, and I don't know how to help you. PC seems clean, and I do not see anything that could cause it to work slow.

Twinheadedeagle,

 

I'll likely be upgrading as soon as it's financially feasible. In any case, I appreciate all your help. Thank you very much.

 

equaltemp

Link to post
Share on other sites
  • 2 weeks later...
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.