[flavallee]

Now that you've uninstalled McAfee, you want to make sure that all the remnants of it are gone. Go here so you can download and run the McAfee removal tool. Restart your computer afterwards.

Two pages of replies has been posted since your last HijackThis log, so please post a new log - after you run the McAfee removal tool and restart.

-------------------------------------------------------------------

[hewwo2u2]

Originally Posted by new tech guy

How is the machine running after the mcafee removal?

it is still slow :/

[hewwo2u2]

Originally Posted by flavallee

Now that you've uninstalled McAfee, you want to make sure that all the remnants of it are gone. Go here so you can download and run the McAfee removal tool. Restart your computer afterwards.

Two pages of replies has been posted since your last HijackThis log, so please post a new log - after you run the McAfee removal tool and restart.

-------------------------------------------------------------------

I will download and re post right now. Thank you!

[hewwo2u2]

I have now downloaded and run this removal tool..is there anything I need to do now to remove whatever it is I just downloaded or did it remove itself?

[hewwo2u2]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:54:39 PM, on 1/12/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Users\Jessica\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.h...s=PTB&M=MT6456
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [BigFix] c:\program files\Bigfix\bigfix.exe /atstartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jessica\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/p.../PCPitStop.CAB
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7013 bytes

[hewwo2u2]

question: why does HiJackThis continue to run in the background after I've exited it? Is this something I need to remove once the problem is fixed?

I will be back tomorrow afternoon to read any responses. Thank you in advance!

[flavallee]

Did you just download and save the McAfee removal tool, or did you actually run it and let it remove the remnants of McAfee? If you actually ran it, it would've advised you when the process was completed and then to restart your computer.

----------------------------------------------------------------

HijackThis does not run in the background. The only time it runs is when you open its main window and then run a scan with it. After you're done with it and close it, it doesn't do anything until you open it again.

----------------------------------------------------------------

Other than:

Windows Defender

AVG7

SynTPEnh

no other programs in the O4 list need to run in the background.

-----------------------------------------------------------------

[hewwo2u2]

Originally Posted by flavallee

Did you just download and save the McAfee removal tool, or did you actually run it and let it remove the remnants of McAfee? If you actually ran it, it would've advised you when the process was completed and then to restart your computer.

yes, it said to restart to computer in order to remove all the components

Originally Posted by flavallee

HijackThis does not run in the background. The only time it runs is when you open its main window and then run a scan with it. After you're done with it and close it, it doesn't do anything until you open it again.

After I restarted the computer I proceeded to run a new log to post on here, but an error occurred when I attempted to run HiJackThis telling me to try to run it again by right clicking and selecting "run as administrator". After I clicked OK, it continued to scan anyway. I then exited the program and the log and attempted to run HiJackThis again as administrator but the program would not open because it said it was already in use (even though I had exited it). I found it in Windows Task Manager listed as one of the many processes I have running on my coputer and clicked "end process". I was then able to open and run HiJackThis and produce the log posted above. This is the reason I asked why it runs in the background...I was curious as to why it didn't close when I exited the program.

[hewwo2u2]

Do you think the processes are part of what is causing my computer to run so slowly? Would it be helpful if I took a screen shot of the processes I have running right now? Windows Task Manager currently says I have 69 processes running.

[flavallee]

69 processes is way too many.

I have 25 - 26 processes right after startup, but I keep a very lean startup load.

Other than AVG8, Windows Defender, and ctfmon.exe, I have nothing else running in Start - Run - MSCONFIG - OK - "Startup" tab.

Most of my Services list(Start - Run - SERVICES.MSC - OK) is also set to "Manual".

You should make use of these 2 sites:

http://www.sysinfo.org/startuplist.p...t=100&offset=0

http://www.blackviper.com/WinXP/servicecfg.htm

-----------------------------------------------------------------

[new tech guy]

I should add to what flavallee said about black viper. If your unsure what you are doing, just use his "safe" option as it is least likely to cause problems. Also, if msconfig is misused it can cause trouble booting, so unless you know what it is, leave it alone. furthermore, we are dealing with vista, not xp folks. vista is a much bigger operating system than xp and it is typical to see steep process lists in vista. I know my machine is running with 71 processes at the moment, although it is vista home premium on 3 gb of ram. the 71 include the task manager, firefox, and aim 5.9, which is only one process. If you want to lighten the machine, i would honestly just look into an xp downgrade.

[flavallee]

Oops! I forgot the log was Vista and not XP.

New Tech Guy is correct in that Vista will have more running processes than XP. My Vista desktop has 39 running processes right after startup and before opening any browser windows or programs.

And to add to what he said about the Black Viper site, the "Safe" column is the best place to start out, if you want to research and edit the Services list.

-----------------------------------------------------------------

[hewwo2u2]

sorry I took so long to reply. School has been pretty busy lately. Okay, so I should still try and reduce some of the processes but now by using misconfig since I do not know what I'm doing, correct?

I would like to keep vista if I can, and I plan on buying more RAM as soon as I have the money, so hopefully that will help.

So does this mean you don't see anything in the HighJackThis Log? If not, should I delete the program?

Also if you don't see anything wrong, then what do you think is the main reason my computer is such a snail? Is it just that I have too much stuff on it? The thing is, I've been using the same amount of programs for a long time now and it hasn't been this slow for that long. I just wanted to remove whatever it is that happened between then and now. This gets so frustrating.

I am going to go check out these sights now. I appreciate all your patience.

[new tech guy]

Another thing you could do in vista is turn off the aero effects, to do that, right click the desktop>personalize. then click window color and appearance. Then click to open the classic properties pane and select either vista basic or windows classic and hit apply. Should lighten up vista a bit if it doesnt have to load the bloated aero effect. (linux did similar layouts that use a fraction of the recources, microsoft should take a page from their book).

[hewwo2u2]

I just realized the black viper one is only for xp. is there a link you can give me for vista? What about the other site? If I use the other site, what do you suggest I do in order for my changes to basically equal those of the "safe" column on the other site? Also it says something on black viper about backing up before I make changes. This sounds complicated as I'm not sure I would even know how to use the backup files if I needed them. Is "system restore" not sufficient enough if I realize I've done something wrong?