[Cookiegal]

You probably didn't "Apply all actions".

Did it quarantine what was found? If so, look in the quarantined files and let me know what is there.

[slook]

C:\Windows.oldWindows|DownloadedProgramFiles\popcap... Not a virus downloader win3
C:\Windows\downloadedPrograms\popcaploader.dll Not a virus downloader win3
C:\Windows.old\ProgramFiles\iWinGames\iWingamesHoakIE... adware.BHO
HKLM\SOFTWARE\Classes\IEHiprObj.IEHlprObj.1 adware.CoolWebSearch
HKLM\SOFTWARE\Classes\IEHiprObj.IEHlprObj adware.CoolWebSearch
C:\PROGRAM~I\WINGA~IWINGA~1.DLL adware.BHO
C:\PROGRAM~I\WINGA~IWINGA~1.DLL adware.BHO

I got rid of Iwin games but there was Totem treasure which was still a part of Iwin Games

[slook]

I did a rescan with the omitted 02 Bho and 016 Dpf that you told me to check mark and put click fix checked.
Logfile of HijackThis v1.99.1
Scan saved at 4:36:07 PM, on 28/06/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\dfrgui.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/z...ploader_v5.cab
O20 - Winlogon Notify: WRNotifier - C:\Windows\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

[spiker_22]

Lets try a different approach here
1.) download and install avast antivirus. It's free and may find things your other software
isn't designed to detect. After installing, it will have you reboot and it will scan before
Windows loads (roughly like doing it in safe mode. If this didn't help try,
2.) instead of hunting for a driver, it may be easier to simply try another network card
If you know someone who has one then try that. I doubt this is the issue. If there was
a driver issue you would probably see all kinds of complaints on the vendors website.
I suggest this step first because it is easy and if you know someone who has a spare
NIC, it's also free and will rule out the Network Interface Card or drivers as the culprit.

3.) you will need to perform a clean install of the OS. Yes I know this has been done
already but there are a number of variables you'll want to rule out.
before you get started get autopatcher. DO NOT DOWN load this on your machine.
See if your buddy with the Laptop will down load and burn this to a disk for you.
a.) Autopatcher has all the critical updates, hotfixes for Windows.
autopatcher. You can find mirror links on this site for downloading autopatcher
http://www.neowin.net/forum/index.php?showtopic=559383

b.) Both sites have instructions for doing a clean install.
1.) http://searchwincomputing.techtarget...5582,sid68_gci
1251261,00 .html
2 .) http://www.5starsupport.com/tutorial...an-install.htm
c.) BEFORE the clean Install you'll want to format the master boot record
this will lessen the likely hood of some malware ( auto downloader of somekind
hiding down there and waiting for you to reinstall before reaking havoc.
1.) use a windows 9X boot disk when it loads up just go to a command prompt
and type fdisk/mbr. Takes a second. YOu can dL the image from this site
http://www.bootdisk.com/bootdisk.htm and the program will create a
bootfloppy
2.) reboot the machine and do it again.
Now go ahead with the clean install. be sure to repartition and format the disk during
the installation. Once that is done you can use autopatcher to get all the recent
security updates before accessing the web. Once this is done load your antispyware
(UNLESS YOU HAVE SOME CRACKED or PIRATED VERSION Which also could be the
culprit here and toss AVAST on. DO NOT LOAD ANY OTHER APPS. AND DO NOT CO
NNECT TO THE WEB YET.
Burn in the OS let it do this for a day At this site you can find freeware that
will "torture test your machine" which will also have the added affect of letting the OS
updates etc to get warn in (kinda like you do with a new baseball glove).
If everything is still humming along nicley you can go ahead and connect to the web.
This is critical however, go to security.symantec.com. This is Norton's online security
check. Of course you need not use Norton there are equal, if not better free, checks out
there like Shields up http://www.grc.com/x/ne.dll?rh1dkyd2 which will scan for security
vulnerabilities. Running more than one MAY be useful.
For the frst week your up and running have avast perform a preboot scan daily and
also do a free online virus scan. Of course once you've passed the 1 day mark where it
seems you've hit the wall after previous installs, you can start adding apps (NOTHING
PIRATED or cracked) one at a time (with a long enough space betweenwhere you will
be able to identify the culprit, if it is infact an app-which I doubt) to see if there is any
change.
In sum, things like network card drivers don't seem to be the problem. SPYWARE is
your number1 suspect here. Somehow or other something is inverting yuor upload down
load speeds so that upload is the fastest and this may be a clue to your problem.
Certainly if upload is higher it may be so malware can be spread quickly.

[Cookiegal]

I do not see the need to download AVAST.

I neglected to tell you to disable Windows Defender real-time protection as it will block the changes we were trying to make so please do this:

• Open Windows Defender
• Click on "Tools"
• Click on "General Settings"
• Scroll down to "Real-time protection options"
• Uncheck "Turn on Real-time protection (recommended)"
• Click "Save"

Now rescan with HijackThis and fix these entries:

O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/z...ploader_v5.cab


I also recommend uninstalling Totem Treasure.


Open HijackThis and click on the "Open the Misc Tools Section" button. Click on the "Open Uninstall Manager" button. Click the "Save List" botton. Copy and paste that list here please.


Reboot and post a new HijackThis scan log please along with the HijackThis uninstall log.

[slook]

I keep getting errors in running Hijackthis. It wont let me "fixed check" those 2 items

[slook]

Is Hijackthis ok for windows vista?

[Cookiegal]

While not actually Vista certified, it will function but will throw off errors that are nothing to be concerned about.

Try running it in safe mode to remove those two entries.

[slook]

Adobe Flash Player 9 ActiveX
Adobe Reader 6.0.1
Apple Software Update
Attansic Giga Ethernet Utility
Attansic L1 Gigabit Ethernet Driver
AVG Anti-Spyware 7.5
CCleaner (remove only)
DVD Suite
GameShadow
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Hijackthis 1.99.1
HijackThis 1.99.1
iTunes
Java(TM) SE Runtime Environment 6 Update 1
LiveUpdate 3.2 (Symantec Corporation)
Microsoft Office Professional Edition 2003
Mozilla Firefox (2.0.0.4)
Nero 7 Essentials
Picasa 2
PowerDVD
PowerProducer
QuickTime
Silent Hunter 4 Wolves of the Pacific
SoundMAX
Spy Sweeper
Symantec AntiVirus
Windows Live OneCare safety scanner

[Cookiegal]

I would try uninstalling the Google Toolbar as it's been known to cause various problems.

Did you try Rollin' Rog's instructions in post no. 12?

[Rollin' Rog]

While you're at it I would also uninstall Webroot -- that too has caused performance problems for others on occasion. Msconfig doesn't completely disable it either when used.

[slook]

Yes I tried Rolling Rogs instructions. 1)Booting to safe mode with networking. Sill slow!
2) Run msconfig, was even slower download was 56 kb upload was 614 kb
3) Uninstalled google and still slow

I did come across this, in the control panel under "problems reports and solutions"

Download and install the driver for the ATK0110 ACPI UTILITY
I searched the ATK0110 and this is what i found.


Description: File ASACPI.sys is located in the folder C:\Windows\System32\drivers. Known file sizes on Windows XP are 5810 bytes (95% of all occurrence), 5755 bytes.
The driver can be started or stopped from Services in the Control Panel or by other programs. There is no file information. The program has no visible window. There is no detailed description of this service. The file is not a Windows system file. It is a trustworthy file from Microsoft. ASACPI.sys seems to be a compressed file. Therefore the technical security rating is 23% dangerous.

Is this thing giving me a problem or is it the problem?

[Rollin' Rog]

This is not a default Windows driver -- but a chipset driver for your motherboard model. Do you have the CD for this? Can you find a chipset update otherwise?

[slook]

Yes I have the cd. It is the ASUS Vista upgrade Kit
Official Vista Drivers For ASus Motherboard.
Not sure what I'm supposed to do.

Maybe I'll just bring it in to a computer store and have them do a clean install on the whole system.

[Rollin' Rog]

This appears to be an overclocking utility and it may not be involved in your problem at all.

Moverover the drivers on your CD probably failed to install due to incompatibilty if this site is correct.

However they may be available through Windows Update.

Scroll down and check the highlighted text on this link:

Other Devices
ATK0110 ASUS overclocking ACPI device - doesn't want to install drivers.
ATK0110 ACPI Utility -- When I ran the setup program for this device from my Asus system CD, it errored out and appeared to fail. However, after it finished, the "ATK0110 ACPI Utility" appeared in Device Manager, and the Unknown Device had disappeared.
ATK0110 ACPI Utility -- was found on windowsupdate for me and installed correctly.
ATI remote wonder--windows installs but does not work, new drivers cause lots of errors and still doesn't work (32 Bit)

http://72.14.253.104/search?q=cache:...s&client=opera