1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

PC running slow HJT log - Please review

Discussion in 'Virus & Other Malware Removal' started by rob2910, Oct 15, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. rob2910

    rob2910 Thread Starter

    Joined:
    Aug 13, 2003
    Messages:
    365
    On a friends PC running W98. Had [email protected] which has been removed, including registry, as per the instructions at Norton / Symantic.

    PC is still running slow and also running out of memory could someone please review the HJT log and start up log, thanks

    file of HijackThis v1.97.2
    Scan saved at 22:54:30, on 15/10/03

    Platform: Windows 98 Gold (Win9x 4.10.1998)
    MSIE: Internet Explorer v5.00 SP1 (5.00.3105.0105)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
    C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\STARTER.EXE
    C:\WINDOWS\SYSTEM\ATICWD32.EXE
    C:\WINDOWS\SYSTEM\ATITASK.EXE
    C:\PROGRAM FILES\PRIMAX\POWERTWAIN\PMXDETECT.EXE
    C:\WINDOWS\SYSTEM\LAUNCHER.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\HP DESKJET 720C SERIES V10.3\EREG\REMIND32.EXE
    C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.luckyhomepage.com/ie/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.luckyhomepage.com/ie/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luckyhomepage.com/home.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.virgin.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.luckyhomepage.com/ie/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Virgin Net
    F1 - win.ini: run=hpfsched
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
    O4 - HKLM\..\Run: [VortexTray] ASP4TRAY.EXE
    O4 - HKLM\..\Run: [Atikey] Atitask.exe
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [Scan Detector] C:\PROGRA~1\PRIMAX\POWERT~1\Pmxdetect.exe
    O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\SYSTEM\Launcher.exe
    O4 - HKLM\..\Run: [Virgin Net User Check] C:\PROGRA~1\INTERN~1\CONNEC~2\vnet\runvnet.exe /c
    O4 - HKLM\..\Run: [C2K] C:\WINDOWS\CYB2K.EXE
    O4 - HKLM\..\Run: [vptray] c:\Program Files\Norton AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [V128IID] Rundll32.exe c:\windows\SYSTEM\v128iitw.dll,STB_InitTweak
    O4 - HKLM\..\RunServices: [V128IITV] Rundll32.exe c:\windows\SYSTEM\v128iitv.dll,STBTV_SwitchTo640x480
    O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
    O4 - HKLM\..\RunServices: [rtvscn95] c:\Program Files\Norton AntiVirus\rtvscn95.exe
    O4 - HKLM\..\RunServices: [defwatch] c:\Program Files\Norton AntiVirus\defwatch.exe
    O4 - Startup: Reminder-hpc41001.lnk = C:\Program Files\HP DeskJet 720C Series v10.3\ereg\Remind32.exe
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net
    O16 - DPF: {7183CF29-F63C-11D2-923F-00600854D4DF} (IEUpdateOSR2 Control) - http://autoreg.virgin.net/ChangeNo.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab


    StartupList report, 15/10/03, 21:28:16
    StartupList version: 1.52
    Started from : C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
    Detected: Windows 98 Gold (Win9x 4.10.1998)
    Detected: Internet Explorer v5.00 SP1 (5.00.3105.0105)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
    C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\STARTER.EXE
    C:\WINDOWS\SYSTEM\ATICWD32.EXE
    C:\WINDOWS\SYSTEM\ATITASK.EXE
    C:\PROGRAM FILES\PRIMAX\POWERTWAIN\PMXDETECT.EXE
    C:\WINDOWS\SYSTEM\LAUNCHER.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\HP DESKJET 720C SERIES V10.3\EREG\REMIND32.EXE
    C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
    C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Startup:
    [C:\WINDOWS\Start Menu\Programs\StartUp]
    Reminder-hpc41001.lnk = C:\Program Files\HP DeskJet 720C Series v10.3\ereg\Remind32.exe
    Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    ScanRegistry = c:\windows\scanregw.exe /autorun
    TaskMonitor = c:\windows\taskmon.exe
    SystemTray = SysTray.Exe
    LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    EnsoniqMixer = starter.exe
    AtiCwd32 = Aticwd32.exe
    VortexTray = ASP4TRAY.EXE
    Atikey = Atitask.exe
    Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    Scan Detector = C:\PROGRA~1\PRIMAX\POWERT~1\Pmxdetect.exe
    PrimaLauncher = C:\WINDOWS\SYSTEM\Launcher.exe
    Virgin Net User Check = C:\PROGRA~1\INTERN~1\CONNEC~2\vnet\runvnet.exe /c
    C2K = C:\WINDOWS\CYB2K.EXE
    vptray = c:\Program Files\Norton AntiVirus\vptray.exe
    LoadQM = loadqm.exe

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    V128IID = Rundll32.exe c:\windows\SYSTEM\v128iitw.dll,STB_InitTweak
    V128IITV = Rundll32.exe c:\windows\SYSTEM\v128iitv.dll,STBTV_SwitchTo640x480
    winmodem = WINMODEM.101\wmexe.exe
    rtvscn95 = c:\Program Files\Norton AntiVirus\rtvscn95.exe
    defwatch = c:\Program Files\Norton AntiVirus\defwatch.exe

    --------------------------------------------------

    Load/Run keys from C:\WINDOWS\WIN.INI:

    load=
    run=hpfsched

    --------------------------------------------------

    C:\WINDOWS\WININIT.BAK listing:
    (Created 4/8/2003, 17:42:58)

    [rename]
    nul=c:\windows\TEMP\~ef7194.tmp

    --------------------------------------------------

    C:\AUTOEXEC.BAT listing:

    SET BLASTER=A220 I7 D1 T2
    PATH=C:\WINDOWS
    SET SNDSCAPE=C:\WINDOWS
    mode con codepage prepare=((850) c:\windows\COMMAND\ega.cpi)
    mode con codepage select=850
    keyb uk,,c:\windows\COMMAND\keyboard.sys

    --------------------------------------------------


    Enumerating Download Program Files:

    [IEUpdateOSR2 Control]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\IEUPDA~1.OCX
    CODEBASE = http://autoreg.virgin.net/ChangeNo.cab

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    [Shockwave ActiveX Control]
    InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    [{56336BCB-3D8A-11D6-A00B-0050DA18DE71}]
    CODEBASE = http://207.188.7.150/19d3ee74870009757b15/netzip/RdxIE2.cab

    [iPIX ActiveX Control]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\IPIXX.OCX
    CODEBASE = http://www.ipix.com/viewers/ipixx.cab

    [MessengerStatsClient Class]
    InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MESSENGERSTATSCLIENT.DLL
    CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab

    [Minesweeper Flags Class]
    InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MINESWEEPER.DLL
    CODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab

    --------------------------------------------------

    Enumerating ShellServiceObjectDelayLoad items:

    WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

    --------------------------------------------------
    End of report, 5,483 bytes
    Report generated in 0.317 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
     
  2. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    rob2910

    Welcome to TSG!

    Run Hijack This again and put a check by these. Close all browser windows and "Fix checked"

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.luckyhomepage.com/ie/

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.luckyhomepage.com/ie/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luckyhomepage.com/home.php

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.luckyhomepage.com/ie/

    F1 - win.ini: run=hpfsched

    O4 - HKLM\..\Run: [LoadQM] loadqm.exe

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    Restart your computer.

    Go here http://www.lavasoftusa.com/software/adaware/ and download Adaware 6

    Install the program and launch it.

    I strongly recommend that you read the help file to familiarize yourself with the program.

    Before running the scan look at the top of the main window and you will see a Gear Icon. This is where you configure the settings. Click on that and then in the next window that pops up click on the "Scanning" tab on the left side. Under "Drives and Folders" put a check by "Scan within archives" and below that under "Memory and Registry" put a check by all the options there.
    The click on the "Tweak" tab and under "Scanning engine" put a check by "Unload recognized processes during scanning" ...........then......under "Cleaning engine" put a ckeck by "Let windows remove files in use at next reboot" then click "Proceed"

    Next in the main window look in the bottom right corner and click on "Check for updates now" and get the latest referencefiles.
    After getting the latest referencefiles you are ready to scan.

    Click "Start" and in the next window make sure "Active in depth scanning" is checked then click "Next" and the scan will begin.

    When it is finished let it fix everything it finds.

    Restart your computer.

    Then go here http://spybot.eon.net.au/index.php?lang=en&page=download and download Spybot.

    Install the program and launch it.

    Before scanning press "Online" and "Search for Updates" .

    Put a check mark at and install all updates.

    Click "Check for Problems" and when the scan is finished let Spybot fix/remove all it finds.

    Restart your computer.
     
  3. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    I'm off to eat dinner but I'll be back shortly with some suggestions on a few things that you should disable from loading when Windows boots.
     
  4. rob2910

    rob2910 Thread Starter

    Joined:
    Aug 13, 2003
    Messages:
    365
    Thanks flrman1

    It's late here, or should I say early so I am off to bed but will pick this up in the morning.

    Thanks for prompt help and will keep you posted on progress. Also thanks in advance for reviewing Start Up also.
     
  5. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Go to Start > Run and type in msconfig

    Uncheck the following:

    Remind32.exe

    Launcher.exe

    OSA9.EXE

    starter.exe

    ASP4TRAY.EXE

    Atitask.exe
     
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/172221

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice