Tonne of Viruses - Please Help!

Leaf · Post by **Leaf** » Thu Nov 08, 2007 12:39 pm

Ugh, I just picked up a load of threatening viruses. Windows recommended I download "BestsellerAntivirus" and so I did. But I'm kinda thinking it's actually a virus in disguise! Just the name... why would you call something "Bestseller"? Wouldn't you only call that if it sold well? And then how would you know it would when you named it?! I noticed a spelling mistake, too. Do you guys know anything about this?

I downloaded something off Download.com hoping it would do the job called "Avira Antivir PersonalEdition Classic". I let it scan my PC for 5 hours, and it came up with loads of Trojan Horses and things, but nothings seemed to really been improved.

I think the main reason for the problem, initially, is that I have no Firewall. I don't know how this happened, I had Norton installed, but I guess it's gone walkies. Is there a decent, freeware Firewall I can download?

You guys are my only chance. You were great at solving my last problem! Please help.

Cheers.

MadDoctor · Post by **MadDoctor** » Thu Nov 08, 2007 7:28 pm

Read this part in the link below. Do as it says and it will get you to a place we can help. Right now there is too many things wrong. Try this virus link first:

http://www.kaspersky.com/virusscanner

EXTREMELY IMPORTANT!!!

Download, update and scan with SpyBot S&D EXACTLY as I explain HERE & Ad-aware EXACTLY as I explain HERE to remove any spyware then install and update SpywareBlaster to stay spyware FREE. YOU MUST USE BOTH AD AWARE & SPYBOT TO ENSURE YOU ARE SPYWARE FREE SINCE ONE FINDS WHAT THE OTHER MISSES. Spyware can and will ruin your connection and crash your pc!

http://forums.speedguide.net/showthread ... post643301

Leaf · Post by **Leaf** » Fri Nov 09, 2007 8:25 am

Hi MadDoctor. Thanks for the advice,

Unfortunately my IE doesn't seem to run any more. I'm currently using Firefox, is there a way to make the scan using that?

I'll get onto downloading those anti-spyware prgrammes right away though. Thanks again.

mnosteele52 · Post by **mnosteele52** » Fri Nov 09, 2007 8:41 am

If you think your computer has been compromised by malware then please follow these instructions for proper cleanup.

1. Disable System Restore then reboot your pc, this will delete all old restore points.

2. Download and run CrapCleaner, this will clean out all of your temporary and junk files.

3. Do a free online virus scan from BitDefender and remove all that it finds.

4. Download, update and do a full system scan with SpyBot Search & Destroy 1.5.1 and remove all that it finds.

5. Download, update and do a full system scan with Ad-Aware 2007 and remove all that it finds.

6. Download, update and do a full system scan with SUPERAntiSpyware and remove all that it finds.

7. Download, update and do a full system scan with AVG Anti-Spyware and remove all that it finds.

8. Download and run AutoRuns and see if there is anything suspicious. You have to know what you are looking for but it is an invaluable tool, it is kind of like HijackThis on steriods.

9. Download, update and do a full system scan with Windows Defender and remove all that it finds.

10. Download the free 15-day trial of CounterSpy and do a full system scan, you can remove this after you use it if you like.

11. Download and do a scan with HijackThis 2.0.0 and post the results here in the forums so I can assist you.

12. Download and update SpywareBlaster to help stay malware free.

13. Use ZonedOut to help prevent future infections.

14. If you are not already using Kaspersky Anti-Virus, BitDefender Anti-Virus or NOD32 Anti-Virus then uninstall your current anti-virus program (Norton, McAfee, TrendMicro etc.) and install then update and scan with the free 30 day trial of Kaspersky Anti-Virus 7 or if you prefer to stick with a free antivirus program I would recommend AntiVir Personal Edition.

15. Do ALL of the latest Windows Updates to ensure your OS is patched properly.

Leaf · Post by **Leaf** » Sat Nov 10, 2007 9:36 am

Hi again mnosteele52,

Thanks for helping me out. I'm following your instructions religiously (except I couldn't do step 3 as that requires Internet Explorer, or AutoRuns as I didn't know what to do after having downloaded it) and have already noticed an improvement (mainly the pop-up ads having subsided).

I've gotten up to CounterSpy but cannot perform an update because it says I'm not connected to the internet (which I am!). What should I do?

(At the time of writing my PC is still going slow and all my desktop icons have their names highlighted in a dark blue.)

Leaf · Post by **Leaf** » Sat Nov 10, 2007 12:24 pm

Hijack results:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:22:48, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toucan.com/jump/redir.asp?id=205
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\uk.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: 0 - {6A5AD21A-D57F-4249-69AB-80A3D309760C} - C:\Program Files\Windows NT\temawi.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [1c19700f] rundll32.exe "C:\WINDOWS\system32\fdcidcrs.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKCU\..\Run: [explorer] C:\WINDOWS\system32\services\explorer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Henl] "C:\WINDOWS\SMANTE~1\nslookup.exe" -vt ndrv
O4 - HKCU\..\Run: [BestsellerAntivirus] C:\Program Files\BestsellerAntivirus\pgs.exe /min
O4 - HKCU\..\Run: [Jnc] C:\WINDOWS\?ecurity\d?dplay.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Patrick\Application Data\Microsoft\Windows\ewvlknp.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Patrick\Application Data\WinTouch\WinTouch.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O15 - Trusted Zone: http://www.toucansurf.com
O15 - Trusted Zone: http://www.toucantele.com
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/rap ... loader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/res ... nPUpld.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zy ... player.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 8260 bytes

Leaf · Post by **Leaf** » Sat Nov 10, 2007 12:50 pm

Sorry for the triple post, but I'll update you on my progress:

1. Done

2. Done

3. Not done (can no longer use IE for some reason)

4. Done

5. Done

6. Done

7. Done

8. Not Done (don't know what to do)

9. Done (though no update as it said one was not required)

10. Done (though no update as it would not let me)

11. Done

12. Done, though don't really know what to do here (I've just blocked a bunch of sites on Firefox and IE)

13. Done, but don't know what to do

14. Ok, I previously installed AntiVir Personal Edition, but I had to delete it as I kept being given the same virus warning pop up over and over, making using the PC impossible. Do you think that would no longer be the case as many of the viruses have now been removed?

15. Will do.

Despite all the clean-ups things are still going considerably slow. Perhaps I've missed/haven't done yet something important?

mnosteele52 · Post by **mnosteele52** » Sat Nov 10, 2007 3:29 pm

Don't you think that Antivir keeps notifying you of a virus because you are infected with a virus? Reinstall it and do a full scan and remove all that it finds. Also have HijackThis remove the following:

C:\Program Files\Common Files\Real\Update_OB\realsched.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toucan.com/jump/redir.asp?id=205
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\uk.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: 0 - {6A5AD21A-D57F-4249-69AB-80A3D309760C} - C:\Program Files\Windows NT\temawi.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [1c19700f] rundll32.exe "C:\WINDOWS\system32\fdcidcrs.dll",b
O4 - HKCU\..\Run: [Uniblue RegistryBooster2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Henl] "C:\WINDOWS\SMANTE~1\nslookup.exe" -vt ndrv
O4 - HKCU\..\Run: [BestsellerAntivirus] C:\Program Files\BestsellerAntivirus\pgs.exe /min
O4 - HKCU\..\Run: [Jnc] C:\WINDOWS\?ecurity\d?dplay.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Patrick\Application Data\Microsoft\Windows\ewvlknp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O15 - Trusted Zone: http://www.toucansurf.com
O15 - Trusted Zone: http://www.toucantele.com
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)

Something else, you don't need the real-time protection of all the antispyware programs, you just need Antivir's real-time protection, use the others as on demand scanners.

Leaf · Post by **Leaf** » Sat Nov 10, 2007 6:10 pm

Okay, big thanks for the help. I deleted said stuff on HijackThis and have shut down real-time protection for all except Antivir which I re-downloaded. I did a scan and it found no infections!

Still having a few problems though. I'm unable to update Antivir because it says I'm not connected to the internet. Do you know what's up with that? Also, the computer start-up is still very slow. Usually the desktop loads up seconds after I select my user, but now it's painfully slow with the icons not appearing straight away. Before they do, the desktop goes completely gray and then leaves all icons with their titles highlighted in the same gray.

And do you know where I can go to look for Windows Updates?

Cheers!

mnosteele52 · Post by **mnosteele52** » Sat Nov 10, 2007 7:21 pm

For Windows Update try HERE with Firefox. You really need to have Internet Explorer working properly, try to install Internet Explorer 7 from HERE.

Leaf · Post by **Leaf** » Sun Nov 11, 2007 11:34 am

Done and done.

With the new IE, I was able to go back and complete step 3. It didn't find anything until literally the last minute, all 3 of which it deleted.

So that's good. But my PC is still extremely slow compared to what it used to be, with the grayness I described earlier.

Can any further steps be taken?

mnosteele52 · Post by **mnosteele52** » Sun Nov 11, 2007 12:05 pm

Please post a new HijackThis log and tell me the specs of your pc.

Leaf · Post by **Leaf** » Sun Nov 11, 2007 12:44 pm

Do you know how I can get the specs up?

And new Hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:42:57, on 11/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toucan.com/jump/redir.asp?id=205
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [explorer] C:\WINDOWS\system32\services\explorer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Patrick\Application Data\WinTouch\WinTouch.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/rap ... loader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/res ... nPUpld.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zy ... player.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7613 bytes

Leaf · Post by **Leaf** » Mon Nov 12, 2007 9:00 am

Oh, and it always crashes right before I shutdown.

mnosteele52 · Post by **mnosteele52** » Mon Nov 12, 2007 10:05 am

Download the free 30 day trial of Tune-Up Utilities 2007 and run a 1-click maintenance twice, then please post your spec i.e. cpu speed, amount of RAM.

Leaf · Post by **Leaf** » Mon Nov 12, 2007 10:33 am

Ok, done the 1-click maintenance twice. How do I get the specs up?

mnosteele52 · Post by **mnosteele52** » Mon Nov 12, 2007 10:48 am

Leaf wrote:Ok, done the 1-click maintenance twice. How do I get the specs up?

Your killin' me here....... just tell me what cpu you have and how much RAM your pc has.

Leaf · Post by **Leaf** » Mon Nov 12, 2007 10:58 am

Erm... I don't know.

Sorry, I'm rubbish with computers! (me playing Minesweeper >

)

trogers · Post by **trogers** » Mon Nov 12, 2007 11:22 pm

Leaf wrote:Erm... I don't know. Sorry, I'm rubbish with computers! (me playing Minesweeper > )

Click right on the Icon of "My Computer" and select 'Properties'

Then post the info about your computer.

Leaf · Post by **Leaf** » Tue Nov 13, 2007 6:16 am

trogers wrote:Click right on the Icon of "My Computer" and select 'Properties'

Then post the info about your computer.

Ahh, thanks a lot mate.

mnosteele52 · Post by **mnosteele52** » Tue Nov 13, 2007 4:42 pm

You need A LOT more RAM, you only have 256MB and are sharing that for video so your system only has 192MB to use, buy 1GB, RAM is cheap now. It takes about 128MB just to run XP with nothing else running so you have the bare minumum to run things.

Leaf · Post by **Leaf** » Wed Nov 14, 2007 7:48 am

Okay, thanks.

But, my computer was still running pretty much to my standard before I got these viruses. Are the problems reversible, and do you know what this weird gray stuff is on my desktop?

MadDoctor · Post by **MadDoctor** » Sun Nov 18, 2007 10:02 pm

Leaf wrote:Okay, thanks.

But, my computer was still running pretty much to my standard before I got these viruses. Are the problems reversible, and do you know what this weird gray stuff is on my desktop?

As the man of steel said... your RAM is too low (although you might not see the need). Everything is going to run much faster with more RAM (as a rule anyway). Can you post a picture of the "weird gray stuff"?

Although you might have already done this... click on start>RUN>MSconfig

Click on the tab: Startup (all the way over to the right). Post a screen shot.