Jump to content

Dell 8250 way too slow...2nd user account

michigangator
 Share

Recommended Posts

michigangator

michigangator

Posted
Posted

I used this forum a couple of weeks ago to clean up my wife's pc, a Dell 8250. I did not realize at the time that I really should clean up each person's user account. My daughter, Hillary, also has a login account on the pc, and now it is running terribly slow for her. What can I do to try to speed things up? She is a teenager, and I'm sure she's gotten the system "clogged" with junk from Myspace.com, etc... B)

Any help is appreciated...thx...

BTW...in case it helps here is the AVG scan log and I will follow that with the Panda Active Scan log and finally, an HJT log.

C:\Documents and Settings\Hillary\Local Settings\Temp\ZangoAX.cab/clientax.dll -> Adware.180Solutions : Cleaned.

C:\Program Files\Trend Micro\HijackThis\backups\backup-20071107-204450-193.dll -> Not-A-Virus.Adware.BHO : Cleaned.

C:\WINDOWS\SYSTEM32\l3acdb2.dll -> Not-A-Virus.Adware.BHO : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@alexanderinteractive.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@brightcove.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@classifiedventures1.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@cupolaventures.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@heavycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@marthastewart.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@usatoday1.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@northwestairlines.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@adc.aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@advertisersclearinghouse.aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@4.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@bridge.admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@roi.admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@ads.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@citi.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@ge.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@centrport[1].txt -> TrackingCookie.Centrport : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@enhance[2].txt -> TrackingCookie.Enhance : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@e-2dj6wfkoqpdzibp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@fortunecity[2].txt -> TrackingCookie.Fortunecity : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@searchportal.information[2].txt -> TrackingCookie.Information : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@auto.search.msn[2].txt -> TrackingCookie.Msn : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@data4.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@overture[1].txt -> TrackingCookie.Overture : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@pro-market[1].txt -> TrackingCookie.Pro-market : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@guide.real[2].txt -> TrackingCookie.Real : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@music.guide.real[2].txt -> TrackingCookie.Real : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@radio.real[1].txt -> TrackingCookie.Real : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@real[2].txt -> TrackingCookie.Real : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@realguide.real[1].txt -> TrackingCookie.Real : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@h.starware[1].txt -> TrackingCookie.Starware : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@anat.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned.

C:\Documents and Settings\Kay\Cookies\kay@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.

C:\Documents and Settings\Hillary\Cookies\hillary@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.

C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.

::Report end

Panda log:

Incident Status Location

Adware:adware/24-7-search Not disinfected c:\windows\system32\unPPC.exe

Spyware:spyware/bridge Not disinfected c:\windows\downloaded program files\bridge.inf

Adware:adware/sidesearch Not disinfected c:\program files\Lycos

Adware:adware/searchexe Not disinfected Windows Registry

Virus:Trj/Downloader.MDW Not disinfected C:\11.tmp[bndDrive.dll]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Brian\Cookies\brian@advertising[2].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Brian\Cookies\brian@doubleclick[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Brian\Cookies\brian@go[1].txt

Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Guest\Cookies\guest@adopt.hbmediapro[2].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Guest\Cookies\guest@adrevolver[2].txt

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Guest\Cookies\guest@apmebf[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Guest\Cookies\guest@ath.belnk[1].txt

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Guest\Cookies\guest@atwola[2].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Guest\Cookies\guest@belnk[2].txt

Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Guest\Cookies\guest@bravenet[1].txt

Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Guest\Cookies\guest@cgi-bin[1].txt

Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Guest\Cookies\guest@cgi-bin[2].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Guest\Cookies\guest@com[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Guest\Cookies\guest@dist.belnk[2].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[10].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[11].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[12].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[13].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[2].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[3].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[4].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[5].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[6].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[7].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[8].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Guest\Cookies\guest@go[9].txt

Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Guest\Cookies\guest@landing.domainsponsor[1].txt

Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Guest\Cookies\guest@maxserving[1].txt

Spyware:Cookie/Qsrch Not disinfected C:\Documents and Settings\Guest\Cookies\guest@qsrch[1].txt

Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Guest\Cookies\guest@target[1].txt

Spyware:Cookie/Affiliate fuel Not disinfected C:\Documents and Settings\Guest\Cookies\guest@www.affiliatefuel[1].txt

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Guest\Cookies\guest@xiti[1].txt

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Guest\Local Settings\Temp\Cookies\guest@atwola[1].txt

Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@adserver.easyad[1].txt

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@atwola[1].txt

Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@azjmp[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[10].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[2].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[3].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[4].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[5].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[6].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[7].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@go[9].txt

Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@landing.domainsponsor[1].txt

Spyware:Cookie/Pollstar Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@pollstar[1].txt

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Hillary\Cookies\hillary@xiti[1].txt

Adware:Adware/Adband Not disinfected C:\Documents and Settings\Hillary\Local Settings\Temp\bndupd4.exe[bndDrive3.dll]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Hillary\Local Settings\Temp\Cookies\hillary@adrevolver[3].txt

Virus:Trj/Downloader.MDW Not disinfected C:\Documents and Settings\Hillary\Local Settings\Temp\ismtpa2.exe[iSMPack7.exe]

Virus:Generic Trojan Disinfected C:\Documents and Settings\Hillary\Local Settings\Temporary Internet Files\Content.IE5\XZCBXOXF\file[1].exe

Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Kay\Cookies\kay@did-it[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Kay\Cookies\kay@go[2].txt

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Laura\Cookies\laura@247realmedia[2].txt

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Laura\Cookies\laura@ad.yieldmanager[1].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Laura\Cookies\laura@adrevolver[1].txt

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Laura\Cookies\laura@ads.pointroll[1].txt

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Laura\Cookies\laura@adtech[2].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Laura\Cookies\laura@advertising[2].txt

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Laura\Cookies\laura@apmebf[1].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Laura\Cookies\laura@atdmt[2].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Laura\Cookies\laura@ath.belnk[1].txt

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Laura\Cookies\laura@atwola[1].txt

Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Laura\Cookies\laura@azjmp[1].txt

Spyware:Cookie/Banner Not disinfected C:\Documents and Settings\Laura\Cookies\laura@banner[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Laura\Cookies\laura@belnk[1].txt

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Laura\Cookies\laura@bluestreak[1].txt

Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Laura\Cookies\laura@bravenet[1].txt

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Laura\Cookies\laura@bs.serving-sys[2].txt

Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Laura\Cookies\laura@burstnet[1].txt

Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Laura\Cookies\laura@c.enhance[1].txt

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Laura\Cookies\laura@c5.zedo[1].txt

Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Laura\Cookies\laura@casalemedia[1].txt

Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\Laura\Cookies\laura@centrport[1].txt

Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Laura\Cookies\laura@cgi-bin[1].txt

Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Laura\Cookies\laura@citi.bridgetrack[2].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Laura\Cookies\laura@com[1].txt

Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Laura\Cookies\laura@counter.hitslink[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Laura\Cookies\laura@dist.belnk[2].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Laura\Cookies\laura@doubleclick[1].txt

Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Laura\Cookies\laura@ehg-dig.hitbox[2].txt

Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Laura\Cookies\laura@ehg.hitbox[2].txt

Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Laura\Cookies\laura@entrepreneur[1].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Laura\Cookies\laura@fastclick[1].txt

Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Laura\Cookies\laura@fe.lea.lycos[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Laura\Cookies\laura@go[1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Laura\Cookies\laura@go[2].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Laura\Cookies\laura@go[3].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Laura\Cookies\laura@go[4].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Laura\Cookies\laura@go[6].txt

Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Laura\Cookies\laura@hotlog[1].txt

Spyware:Cookie/Kmpads Not disinfected C:\Documents and Settings\Laura\Cookies\laura@kmpads[1].txt

Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Laura\Cookies\laura@maxserving[1].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Laura\Cookies\laura@media.adrevolver[3].txt

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Laura\Cookies\laura@mediaplex[2].txt

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Laura\Cookies\laura@overture[2].txt

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Laura\Cookies\laura@perf.overture[1].txt

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Laura\Cookies\laura@questionmarket[1].txt

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Laura\Cookies\laura@realmedia[1].txt

Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Laura\Cookies\laura@revenue[1].txt

Spyware:Cookie/Rightmedia Not disinfected C:\Documents and Settings\Laura\Cookies\laura@rightmedia[1].txt

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Laura\Cookies\laura@server.iad.liveperson[2].txt

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Laura\Cookies\laura@serving-sys[2].txt

Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Laura\Cookies\laura@stat.onestat[2].txt

Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Laura\Cookies\laura@statcounter[1].txt

Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Laura\Cookies\laura@statse.webtrendslive[2].txt

Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Laura\Cookies\laura@tickle[1].txt

Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Laura\Cookies\laura@tradedoubler[1].txt

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Laura\Cookies\laura@trafficmp[2].txt

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Laura\Cookies\laura@tribalfusion[2].txt

Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Laura\Cookies\laura@www.burstbeacon[2].txt

Spyware:Cookie/MyWay Not disinfected C:\Documents and Settings\Laura\Cookies\laura@www.xzoomy[1].txt

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Laura\Cookies\laura@xiti[1].txt

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Laura\Cookies\laura@zedo[2].txt

Hacktool:HackTool/KillProcWin.A Not disinfected C:\Documents and Settings\Laura\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0C.dat[simple_killw.exe]

Adware:Adware/BlazeFind Not disinfected C:\Documents and Settings\Laura\Local Settings\Temp\bar.exe

Hacktool:HackTool/KillProcWin.A Not disinfected C:\Documents and Settings\Laura\Local Settings\Temp\CDASilentInstall0501.exe[simple_killw.exe]

Adware:Adware/Amera Not disinfected C:\Program Files\ISM2\adhydraupd.exe[QdrPack9.exe]

Adware:Adware/Amera Not disinfected C:\Program Files\QdrPack\QdrPack9.exe

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:32:16 PM, on 12/3/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\PROGRA~1\TRENDM~1\INTERN~4\PcCtlCom.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~4\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~4\TmPfw.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\PROGRA~1\TRENDM~1\INTERN~4\PcScnSrv.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe

C:\WINDOWS\System32\LXSUPMON.EXE

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\DELL\Dell Laser MFP 1815\NetworkScan\DNSCST.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\TRENDM~1\INTERN~4\tmproxy.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"

O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [DellNSCST_GRNCH] "C:\Program Files\DELL\Dell Laser MFP 1815\NetworkScan\DNSCST.exe" /HIDEUI

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [autoload] C:\WINDOWS\system32\drivers\smss.exe

O4 - HKCU\..\Run: [autorun] C:\Documents and Settings\Hillary\smss.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIFF2D~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIFF2D~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll

O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc...72/mcinsctl.cab

O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab

O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} - http://216.249.24.142/code/PWActiveXImgCtl.CAB

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/.../ymmapi_416.dll

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg...,19/mcgdmgr.cab

O16 - DPF: {CC7D9C40-1DF5-4C7C-95F7-A0E34982CBA2} - http://downloads.taxslayer.com/olf2002/net...011/install.cab

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~4\PcCtlCom.exe

O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~4\PcScnSrv.exe

O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~4\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~4\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~4\tmproxy.exe

O24 - Desktop Component 0: (no name) - http://s32.photobucket.com/albums/d46/blac...llcolorbook.jpg

--

End of file - 8355 bytes

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

OK... if I remember right, we discussed you having been infected by a back door trojan and no guarantee of cleaning it. Also that you have possibly been victimized by identity theft. The same holds for this account. The same infections are presenting.

So what this means is you have never really been clean, if you want to continue we can but I really think you should reformat this machine.

Link to post
Share on other sites
michigangator

michigangator

Posted
  • Author
Posted

Actually no...that is not my history. You helped with a chronic warning/error message my wife was getting on her XP login process. This time I'm inquiring about my daughter's login on the same pc...should I still just reformat? What do you see in the scan logs that are suspicious?

Thx...

Brian

OK... if I remember right, we discussed you having been infected by a back door trojan and no guarantee of cleaning it. Also that you have possibly been victimized by identity theft. The same holds for this account. The same infections are presenting.

So what this means is you have never really been clean, if you want to continue we can but I really think you should reformat this machine.

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

Sorry, sometimes they all start to look alike. Anyway, what I said about the back door is true regardless. We can attempt cleaning, but there is no guarantees, and the system and all confidential information has been compromised. Let me know your decision and whether or not we proceed.

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

Many of these infections can be avoided with an added layer of prevention. All recommended programs are free and easy on system resources. You should install them as part of your protection arsenol. Keep Spybot Search & Destroy and always immunize when you update. You will also need at least one other scanning program AVG is good and there are several other excellent programs with free and paid versions. Read the overviews of what each program below does so you have an understanding of their importance and how to use.

A firewall and antivirus are also essential. The Windows firewall in XP is not sufficient.

Preform Windows Updates monthly on the second Tuesday or use automatic updates, and use your scanners weekly at the least. Always update before you scan.

SpywareBlaster from Javacool Software

WinPatrol by BillPStudios

SiteHound by FireTrust

RogueRemover

hpHosts

For an excellent list of reliable free firewalls and antivirus programs see here

Also don't allow your daughter to run under an administrator account when surfing etc. This will prevent malware from installing. That goes for everyone running under a non admin account for every day use is safest and logging into the admin account for updates and software installation.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.