[maxcalvada]

It takes up to 15 minutes to start up when you first turn it on. Often takes up to 20 seconds for programs to come up when you hit start. Virtually all software programs take time to come up, even little ones like Notepad. Have lots of slowdowns and freeze ups when using the internet, including trying to type in url's. Anytime the computer isn't in use for a little while, starting up again is always very slow with frequent little freeze ups. Lately, even when we first turn the computer on, we get a low on virtual memory warning in the lower right corner. Somebody told me this could be the problem. If so, why would it need more memory now than in the past when it worked ok? We actually deleted lots of files and some software programs not be used, including video games.

We used Spybot, Malwarebytes and our anti virus program a few days back and all 3 came up with no problems.

Thanks.

[Phantom010]

Dell Dimension 4550, WXP Home Edition, Version 2002, Service Pack 2, Intel(R), Pentium(R) 4 CPU 2.66 GHz,
2.66 GHz, 256MB of RAM

With 256 Mb of RAM for XP, no wonder it's slow! You need at least 512 Mb but 1 Gb would be optimal.

You may have too many processes running at the same time in the background.

Please click here to download and install the HijackThis installer.

Run it and select Do a system scan and save a logfile.

The log will be saved in Notepad. Copy and paste the log in your next post.

Do not fix anything

[maxcalvada]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45, on 2009-09-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\Installer\00000001\bootstrap\fsihs.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=20011&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1me10IE8ENUS/701
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [BCROReminder] C:\Program Files\ByteCrusher\RegistryOptimax\BCRO.exe -rem
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/game...ts/y/kt3_x.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/game...ts/y/nt0_x.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://cs8.chat.sc5.yahoo.com/v43/yacscom.cab
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://www.mathxl.com/wizmodules/tes...enXInstall.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://www.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1204486787500
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1204486747609
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole...rcadeRdxIE.cab
O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.com/applets/DeltaCVX.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: F-Secure Installer restarter (FSIHS) - F-Secure Corp. - C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\Installer\00000001\bootstrap\fsihs.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Win32 USB2 Driver (Microsoft Config) - Unknown owner - C:\WINDOWS\System32\svchosting.exe (file missing)
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O24 - Desktop Component 1: AKC - American Kennel Club for Purebred Dogs - http://www.akc.org/
O24 - Desktop Component 2: (no name) - http://nafadb.flyball.org/cgi-public/pubutil

--
End of file - 9414 bytes

[Phantom010]

You should get rid of Spybot and get yourself a better alternative like the free versions of Malwarebytes' Anti-Malware or SuperAntiSpyware. No need for real-time scanning. Simply make weekly scans or when needed.

You have too many Startup applications loading with Windows. This can significantly increase your Startup time.

You should definitely trim it down quite a bit. You have too many applications running at the same time.

Click on Start > Run > and type msconfig.

Under the Startup tab, uncheck all unnecessary applications. Use these three websites to help you decide which items to uncheck:

Startup applications #1

Startup applications #2

Startup applications #3

Simply copy and paste the .exe files you see at the end of your HijackThis log's 04 (Startup) entries.

Remember, a lot of applications can be started manually when needed.

[BillSnapWire]

I agree with what you are saying but you dont need as much RAM as you said, 256 is okay for basic tasks, but if you are running newer software then you're gonna need to upgrade your RAM. You seem to have fairly new software on your PC so I'd agree with Phantom that you should upgrade to at least 512MB.

[maxcalvada]

I couldn't figure out how to use link 1 or link 3, but put all the 04 startup items in link 3(systemlookup) and came up with a long list. Unfortunately, I don't see most of these items in the system config startup list. And you'll note below much of it is malware/worms. What should I do?

Name



Filename Description Status UStoragustorage.exe sys_auto_run C:\Program Files\U-Storage Tool2.91U-Storage is application software running under Microsoft Windows, it provides functions and utility to manage STF flash drive (USB drive) for security, partition, boot-ability and recovery. Note: See NoteUSystem Files UpdaterSystem Files Updater.exeRelated to System_Files_Updater from Flyakiteosx. It will transform the look of an ordinary Windows XP system to resemble the look of Mac OS X. Note: located in \%WINDIR%\FlyakiteOSX\UMicrosoft IT Updaterandom files namesAdded by a variant of the Win32.Rbot WORM!XBeSys[path to the adware program]Added by BeSys ADWARE!XMicrosoft Update Machinezonealarm.exeAdded by the W32/RBOT-BZ WORM! - NOTE: this is not the valid Zone Labs firewall program!XZoneAlarmzonealarm.exeFirewall program from Zonelabs - free versionYWinsock2 driverkgzgjkpcw.exe, ZONEALARM.EXEAdded by the SDBOT.T WORM! Note - ZONEALARM.EXE is not the valid Zone Labs firewall programXDwlClientsupport.exeDownload manager for Dell support alerts. Note: Located in \%Program Files%\Common Files\Dell\EUSW\NMSNiTuneshelp.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.XMouse Suite 98 Daemonpelmiced.exeMouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games. Note: Located in \%WINDIR%\%System%\NWindows Serviceprivate-zone.exeAdded by an unidentified downloader TROJAN!XDellConnectionManagerDell.UCM.exeRelated to Dell ConnectionManager (DCP) Connection Manager is part of a multipurpose utility called Dell ControlPoint, which includes a Security and System Manager. Note: Located in \%Program Files%\Dell\Dell ControlPoint\Connection Manager\UDellControlPointDell.ControlPoint.exeRelated to Dell ControlPoint (DCP) Connection Manager is part of a multipurpose utility called Dell ControlPoint, which includes a Security and System Manager. Note: Located in \%Program Files%\Dell\Dell ControlPoint\UZoneAlarm Clientzlclient.exeFirewall program from Zonelabs. Note: Located in \%Program Files%\Zone Labs\ZoneAlarm\YZone Labs Clientzlclient.exeFirewall program from Zonelabs. Note: Located in \%Program Files%\Zone Labs\ZoneAlarm\Yzlclientzlclient.exeFirewall program from Zonelabs. Note: Located in \%Program Files%\Zone Labs\ZoneAlarm\YAir MouseAir Mouse.exeRelated to Air Mouse Air Mouse instantly transforms your iPhone or iPod touch into an in air, wireless mouse for your computer! Sit back and surf the web, etc. Note: Located in \%Program Files%\Air Mouse\Air Mouse\UConfiguration Loadermouse.exeAdded by a variant of the AGOBOT/GAOBOT WORM!Xmousemouse.exeAdded by the W32/Rbot-AHJ WORM!XWindows Clientclient.exeAdded by the Troj/Backdr-AM Trojan Note: Located in \%WINDIR%\Xpagmstartclient.exe Note: Possibly related to this??MirraMirra.Client.exeRelated to Mirra_Server from Seagate Tech. Persornal server. Note: Located in \%Program Files%\mirra\UDigiGuideCLIENT.EXE, client01.exeTV guide and reminder. Note: Located in \%Program Files%\DigiGuide TV Guide\NNTupdater(Points to the renamed mIRC client.)Added by the Troj/Digarix-D TROJAN!XDAEMON Tools-1033Daemon.exeRelated to Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive. Note: Located in \%Program Files%\D-Tools\Uuserdaemon.exeAdded by the Trojan.Win32.Obfuscated.aaoh TROJAN! Note: Located in \%WINDIR%\WinShell\ Note: This entry is loaded through one of the "Policies" startup keys.XDAEMON Toolsdaemon.exeRelated to Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive. Note: Located in \%Program Files%\DAEMON Tools\UDAEMON Tools Litedaemon.exeRelated to Daemon Tools Lite - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive. Note: Located in \%Program Files%\DAEMON Tools Lite\USchedulerScheduler daemon.exeTenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily, weekly, monthly or one-time only cleanings.UDaemondaemon.exe c daemon2.exeAdded by the W32.Selotima.A WORM! Note: Located in \%WINDIR%\XTrackpointSrvdaemon.exe, tp4serv.exeSupports the "pointer stick" on Thinkpads in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work. Note: Located in \%WINDIR%\%System%\U

[Phantom010]

In link #1, simply add the 04 .exe file in the address bar.

See attached picture.

[Phantom010]

In link #3, do the same thing.

See attached picture.

[Phantom010]

And you'll note below much of it is malware/worms. What should I do?

You must know you have DeadAIM on your computer? So, when looking at link #2's results, it's a legitimate application.

[maxcalvada]

link #1:
With each one, I get "Number of processes: 0" There is a link to registry cleaner. I download the setup, but am told I don't have enough memory to actvivate it.

link #3:
I can't figure this out. I type in one or more of the C's and get the same long generic list...no individuals results.

[maxcalvada]

is there some easier way we can do this. Again, how do I rid the computer of all the worms that are showing up from Link #2 and how come these things don't show up on my systemconfig startup?

[Phantom010]

Don't download anything, especially not registry cleaners. That's not what I've asked you to do. You have clear examples of what you should be doing.

[Phantom010]

Originally Posted by maxcalvada

is there some easier way we can do this. Again, how do I rid the computer of all the worms that are showing up from Link #2 and how come these things don't show up on my systemconfig startup?

There are no worms!!! Read post #9.

[Phantom010]

Simply copy and paste the .exe files in the address bars.

Example: BCMSMMSG.exe

In link #2, you can enter the entire 04 entry if you want. It will still work.

Example: O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs

[maxcalvada]

If this would help, here's what comes up in startup:
zlclient
pelmiced
ituneshelper
dsentry
deadaim
bcro
bcmsmmsg
avgnt
DirectCd
IntuitSyncManager
realsched
ctfmon
QuickBooks Update