PC programs & bootup extremely slow - Page 2

Question

Bizman

13 Years Ago

OK, then I'd delete the Intel Sata AHCI Controller. It doesn't do any harm to try but it can fix the problem. Same goes for any other hard disk related items in your Device Manager. It's crude but practical.

I wouldn't worry about the error message, it sounds like a normal Microsoft random message in a situation someone has tried to find non existing information. It's too hard for them to admit they don't know why someone would want to try to populate an empty slot.

crunchie 990 Most Valuable Poster

13 Years Ago

Do you have another pc that you can connect the bad hard drive to in order to back-up the files you need?

crunchie 990 Most Valuable Poster

13 Years Ago

You should be able to remove the laptop HD and connect it to a sata cable and a sata power cable (provided the desktop has any free).

crunchie 990 Most Valuable Poster

13 Years Ago

Once you have backed up, you should be able to format the laptop hard drive from within the desktop, then check the hard drive using a tool from the hard drive manufacturers website. If it comes up ok, just whack it back in the lappie and install the OS.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Bizman · Answer 1 · 2010-04-26T23:10:43+00:00

Yes, changing it to DMA might do the trick. Most of the times it doesn't, so I usually skip it and delete the IDE channel right away.

I have never had any problems when deleting objects in the Device Manager. If there's a software related problem, deleting and letting Windows reinstall will either fix it or not. So things can't get worse, but there's a possibility they could get better :cool:

reid1 0 Light Poster · Answer 2 · 2010-04-27T05:36:40+00:00

Crunchie, I really appreciate your continued assistance in trying to help me figure out this madness. Here are the ComboFix and HJT logs.

ComboFix 10-04-26.02 - Owner 04/26/2010 17:42:12.1.2 - x86
Running from: c:\documents and settings\Owner.YOUR-2903ECCBED\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AskSearch\bin\DeFAultsearch.dll
c:\program files\Internet Explorer\SETA6.tmp
c:\program files\Internet Explorer\SETA7.tmp
c:\program files\Internet Explorer\SETA9.tmp
c:\program files\Internet Explorer\SETB7.tmp
c:\program files\Internet Explorer\SETB8.tmp
c:\program files\Internet Explorer\SETBA.tmp
c:\recycler\S-1-5-21-49888811-3100132957-391471977-500
D:\Autorun.inf
F:\Autorun.inf
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-03-26 to 2010-04-26 )))))))))))))))))))))))))))))))
.

2010-04-25 20:30 . 2010-04-25 20:30 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2010-04-25 20:30 . 2010-04-25 20:30 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Local Settings\Application Data\eSupport.com
2010-04-25 02:12 . 2010-04-25 02:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Seagate
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Local Settings\Application Data\Downloaded Installations
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-----w- c:\program files\Carbonite
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-sh--w- c:\windows\ftpcache
2010-04-25 02:11 . 2010-04-25 02:12 -------- d-----w- c:\program files\Seagate
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-----w- c:\program files\Common Files\muvee Technologies
2010-04-23 13:47 . 2010-04-23 13:49 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Local Settings\Application Data\Temp
2010-04-23 13:47 . 2010-04-23 13:47 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-04-23 13:42 . 2010-04-23 13:42 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-04-21 23:05 . 2010-04-21 23:05 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-21 23:05 . 2010-04-21 23:05 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-21 23:05 . 2010-04-21 23:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-04-21 23:05 . 2010-04-21 23:05 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-21 22:51 . 2010-04-21 22:51 52224 ----a-w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-21 22:51 . 2010-04-21 22:51 117760 ----a-w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-21 22:50 . 2010-04-21 22:50 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-21 22:50 . 2010-04-21 22:50 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-21 22:50 . 2010-04-21 22:50 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\SUPERAntiSpyware.com
2010-04-19 20:56 . 2010-04-19 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-04-19 20:07 . 2010-04-19 20:11 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Auslogics
2010-04-19 20:07 . 2010-04-19 20:07 -------- d-----w- c:\program files\Auslogics
2010-04-14 16:50 . 2010-04-14 16:50 -------- d-----w- c:\program files\Trend Micro
2010-04-14 04:42 . 2010-04-14 04:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-04-09 21:18 . 2010-04-09 21:18 -------- d-----w- c:\windows\Cache
2010-04-08 03:19 . 2010-04-08 03:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-23 15:18 . 2010-03-22 14:46 -------- d-----w- c:\program files\Coupons
2010-04-23 13:42 . 2006-09-07 05:47 -------- d-----w- c:\program files\Google
2010-04-23 12:01 . 2010-04-23 12:01 49152 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-04-23 12:01 . 2010-04-23 12:01 40960 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-04-23 12:01 . 2010-04-23 12:01 341600 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-04-23 12:01 . 2010-04-23 12:01 308808 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-04-23 12:01 . 2010-04-23 12:01 14848 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-04-23 12:01 . 2006-09-07 05:55 -------- d-----w- c:\program files\Common Files\Real
2010-04-23 12:01 . 2010-04-23 12:01 -------- d-----w- c:\program files\Common Files\xing shared
2010-04-21 21:27 . 2007-01-08 18:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-16 15:01 . 2010-02-20 21:16 176 ----a-w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\wklnhst.dat
2010-03-26 20:30 . 2006-06-19 04:25 82264 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-26 18:16 . 2010-03-14 01:25 256 ----a-w- c:\windows\system32\pool.bin
2010-03-26 15:35 . 2010-03-26 15:35 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-25 18:41 . 2010-03-25 18:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\Roxio
2010-03-25 18:41 . 2010-03-25 18:41 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Roxio
2010-03-25 18:34 . 2010-03-25 18:33 -------- d-----w- c:\program files\Roxio
2010-03-25 18:33 . 2010-03-13 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2010-03-25 18:33 . 2010-03-25 18:33 -------- d-----w- c:\program files\Common Files\Sonic Shared
2010-03-17 00:37 . 2006-09-07 05:48 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-14 22:02 . 2010-03-07 12:37 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\NCH Swift Sound
2010-03-14 22:02 . 2010-03-14 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
2010-03-14 22:02 . 2010-03-07 12:37 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2010-03-14 01:25 . 2010-03-14 01:25 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Research In Motion
2010-03-13 23:58 . 2010-03-13 23:58 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\InstallShield
2010-03-13 23:58 . 2010-03-13 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2010-03-13 23:58 . 2010-03-13 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2010-03-13 23:48 . 2010-03-13 23:47 -------- d-----w- c:\program files\Research In Motion
2010-03-13 23:47 . 2010-03-13 23:47 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-03-13 06:22 . 2009-02-28 22:29 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\FrostWire
2010-03-11 21:54 . 2010-03-11 21:54 -------- d-----w- c:\program files\Common Files\L&H
2010-03-10 14:41 . 2006-09-07 05:55 -------- d-----w- c:\program files\Real
2010-03-07 22:27 . 2010-03-07 12:37 -------- d-----w- c:\program files\NCH Swift Sound
2010-03-07 22:09 . 2010-03-07 22:09 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Canneverbe Limited
2010-03-07 22:09 . 2010-03-07 22:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2010-03-07 22:02 . 2010-03-07 22:02 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\NCH Software
2010-03-07 22:02 . 2010-03-07 22:02 -------- d-----w- c:\program files\NCH Software
2010-03-04 13:05 . 2010-03-04 13:03 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-02-25 06:24 . 2006-06-17 09:23 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-14 22:32 . 2010-02-14 22:32 161296 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-02-14 22:01 . 2010-02-14 22:01 9758152 ----a-w- C:\windows-kb890830-v3.4.exe
2010-02-10 17:47 . 2010-02-10 17:47 14534 ----a-r- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Microsoft\Installer\{E7B100D8-98A5-42AA-830F-16D6BD5351F1}\SystemFolder_msiexec.exe
2010-02-09 14:55 . 2010-02-09 14:55 43732816 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\waol_single\4337.155.1.1\setup.exe
2010-02-09 14:55 . 2010-02-09 14:55 42960 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\waol_single\4337.155.1.1\noneCodesignFilesBundle.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}"= "c:\program files\Freeze.com\My.Freeze.com NetAssistant\NetAssistant.dll" [2010-01-19 361592]

[HKEY_CLASSES_ROOT\clsid\{e38fa08e-f56a-4169-abf5-5c71e3c153a1}]
[HKEY_CLASSES_ROOT\NetAssistant.NetAssistantBHO.1]
[HKEY_CLASSES_ROOT\TypeLib\{1E8FC16F-4C51-49C4-BC9B-4FC24BDDCEE7}]
[HKEY_CLASSES_ROOT\NetAssistant.NetAssistantBHO]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-09 03:08 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}]
2010-01-19 20:08 361592 ----a-w- c:\program files\Freeze.com\My.Freeze.com NetAssistant\NetAssistant.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-04-01 2010864]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-23 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-23 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-07 98304]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Install Pending Files.LNK]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Install Pending Files.LNK
backup=c:\windows\pss\Install Pending Files.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
NA [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2009-10-28 14:38 50536 ----a-w- c:\program files\AOL 9.5\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 12:50 71216 ----a-r- c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 19:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-06 03:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoBoingo]
2007-03-06 17:45 333360 ----a-w- c:\program files\Boingo\GoBoingo\GoBoingo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2006-09-07 05:47 169984 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2009-07-20 19:52 41264 ----a-w- c:\program files\Common Files\AOL\1157608487\EE\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-10-12 19:30 139264 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-03-23 19:13 77824 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2006-03-23 19:17 118784 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-03-23 19:17 94208 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2005-12-28 18:56 602182 ----a-w- c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2005-12-28 18:55 667718 ----a-w- c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 13:14 206112 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 20:39 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-08-12 23:16 1121792 ----a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 23:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 21:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic]
2004-04-05 21:33 99480 ----a-w- c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-07 05:55 98304 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2002-09-14 06:42 212992 ----a-w- c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-12-27 17:20 413696 ----a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-05-24 02:22 573440 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2004-11-05 14:47 688218 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2004-11-05 14:47 98394 ----a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-04-23 12:01 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
2006-03-30 21:45 313472 ----a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157608487\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157608487\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AOL 9.5\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-23 135664]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [2010-04-25 23456]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632]
S2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2009-09-26 189736]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872]

.
Contents of the 'Scheduled Tasks' folder

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-23 13:42]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-23 13:42]

2006-10-19 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2006-06-17 19:00]

2006-10-19 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2006-06-17 19:00]

2010-04-26 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3023522620-153427874-4026194879-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-04-26 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3023522620-153427874-4026194879-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-03-17 c:\windows\Tasks\videopadShakeIcon.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2010-03-07 22:02]

2010-03-17 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Swift Sound\WavePad\wavepad.exe [2010-03-07 22:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6931
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101664&gct=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-AOLAspSunset2 - c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\sunsetAsp2.exe
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-osCheck - c:\program files\Norton AntiVirus\osCheck.exe
MSConfigStartUp-RoxWatchTray - c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-26 17:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-04-26 17:47:52
ComboFix-quarantined-files.txt 2010-04-26 21:47

Pre-Run: 77,761,036,288 bytes free
Post-Run: 77,903,380,480 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
C:\wubildr.mbr = "Ubuntu"

- - End Of File - - 954070A3392CEF13861C930E91336FA9

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:09:18 PM, on 4/26/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6931
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101664&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101664&gct=&gc=1&q=%s
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: NetAssistantBHO Class - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\My.Freeze.com NetAssistant\NetAssistant.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: NetAssistantBHO - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\My.Freeze.com NetAssistant\NetAssistant.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] "C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" /background
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CarboniteSetupLite] "C:\Program Files\Carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-21-3023522620-153427874-4026194879-1006\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User '?')
O4 - HKUS\S-1-5-21-3023522620-153427874-4026194879-1006\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10666 bytes

reid1 0 Light Poster · Answer 3 · 2010-04-27T05:46:00+00:00

Ok I uninstalled the ide channel and rebooted eventhough I was never prompted to reboot. It did change the Transfer Mode to DMA if available and the Current Transfer Mode to Ultra DMA 2. Still very slow.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2010-04-27T07:29:07+00:00

You may want to uninstall AskBar as it has given problems.

How does the pc run once loaded? When did it all start?

==

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

Folder::
c:\program files\Coupons

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

7. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter you re-enable all the programs that were disabled during the running of ComboFix:

Combofix.txt
A new HijackThis log.

Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

reid1 0 Light Poster · Answer 5 · 2010-04-27T08:18:22+00:00

This problem started about 3 weeks ago. I did a restart after having an issue with IE (I can't remember exactly what it was right now). Upon restart I received the following error message. Runtime error.
Program:...es\common files\roxioshared\9.0\sharedcom\roxwatch9.exe.
After that, the problems started.
Once loaded, it takes 2 to 3 minutes sometimes more for a program to launch. Once it's opened, I can do most things normally such as creating a word doc. IE opens normally but AOL takes a while to open. There's a delay in closing programs too. I usually use task manager to close them quickly.

I'll do the procedure that you suggested and post back later.

reid1 0 Light Poster · Answer 6 · 2010-04-27T10:01:18+00:00

I removed the Ask toolbar in Control Panel.

ComboFix 10-04-26.02 - Owner 04/26/2010 22:37:46.2.2 - x86
Running from: c:\documents and settings\Owner.YOUR-2903ECCBED\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner.YOUR-2903ECCBED\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Coupons
c:\program files\Coupons\Coupons.ico
c:\program files\Coupons\CouponsDotCom.url
c:\program files\Coupons\uninstall.exe
c:\program files\Coupons\Uninstall\IRIMG1.JPG
c:\program files\Coupons\Uninstall\IRIMG2.JPG
c:\program files\Coupons\Uninstall\IRIMG3.JPG
c:\program files\Coupons\Uninstall\IRIMG4.JPG
c:\program files\Coupons\Uninstall\IRIMG5.JPG
c:\program files\Coupons\Uninstall\IRIMG6.JPG
c:\program files\Coupons\Uninstall\IRIMG7.JPG
c:\program files\Coupons\Uninstall\IRIMG8.JPG
c:\program files\Coupons\Uninstall\uninstall.dat
c:\program files\Coupons\Uninstall\uninstall.xml
F:\autorun.inf
G:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-03-27 to 2010-04-27 )))))))))))))))))))))))))))))))
.

2010-04-25 20:30 . 2010-04-25 20:30 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2010-04-25 20:30 . 2010-04-25 20:30 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Local Settings\Application Data\eSupport.com
2010-04-25 02:12 . 2010-04-25 02:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Seagate
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Local Settings\Application Data\Downloaded Installations
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-----w- c:\program files\Carbonite
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-sh--w- c:\windows\ftpcache
2010-04-25 02:11 . 2010-04-25 02:12 -------- d-----w- c:\program files\Seagate
2010-04-25 02:11 . 2010-04-25 02:11 -------- d-----w- c:\program files\Common Files\muvee Technologies
2010-04-23 13:47 . 2010-04-23 13:49 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Local Settings\Application Data\Temp
2010-04-23 13:47 . 2010-04-23 13:47 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-04-23 13:42 . 2010-04-23 13:42 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-04-21 23:05 . 2010-04-21 23:05 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-21 23:05 . 2010-04-21 23:05 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-21 23:05 . 2010-04-21 23:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-04-21 23:05 . 2010-04-21 23:05 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-21 22:51 . 2010-04-21 22:51 52224 ----a-w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-21 22:51 . 2010-04-21 22:51 117760 ----a-w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-21 22:50 . 2010-04-21 22:50 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-21 22:50 . 2010-04-21 22:50 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-21 22:50 . 2010-04-21 22:50 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\SUPERAntiSpyware.com
2010-04-19 20:56 . 2010-04-19 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-04-19 20:07 . 2010-04-19 20:11 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Auslogics
2010-04-19 20:07 . 2010-04-19 20:07 -------- d-----w- c:\program files\Auslogics
2010-04-14 16:50 . 2010-04-14 16:50 -------- d-----w- c:\program files\Trend Micro
2010-04-14 04:42 . 2010-04-14 04:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-04-09 21:18 . 2010-04-09 21:18 -------- d-----w- c:\windows\Cache
2010-04-08 03:19 . 2010-04-08 03:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-23 13:42 . 2006-09-07 05:47 -------- d-----w- c:\program files\Google
2010-04-23 12:01 . 2010-04-23 12:01 49152 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-04-23 12:01 . 2010-04-23 12:01 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-04-23 12:01 . 2010-04-23 12:01 40960 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-04-23 12:01 . 2010-04-23 12:01 341600 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-04-23 12:01 . 2010-04-23 12:01 308808 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-04-23 12:01 . 2010-04-23 12:01 14848 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-04-23 12:01 . 2006-09-07 05:55 -------- d-----w- c:\program files\Common Files\Real
2010-04-23 12:01 . 2010-04-23 12:01 -------- d-----w- c:\program files\Common Files\xing shared
2010-04-21 21:27 . 2007-01-08 18:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-16 15:01 . 2010-02-20 21:16 176 ----a-w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\wklnhst.dat
2010-03-26 20:30 . 2006-06-19 04:25 82264 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-26 18:16 . 2010-03-14 01:25 256 ----a-w- c:\windows\system32\pool.bin
2010-03-26 15:35 . 2010-03-26 15:35 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-25 18:41 . 2010-03-25 18:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\Roxio
2010-03-25 18:41 . 2010-03-25 18:41 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Roxio
2010-03-25 18:34 . 2010-03-25 18:33 -------- d-----w- c:\program files\Roxio
2010-03-25 18:33 . 2010-03-13 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2010-03-25 18:33 . 2010-03-25 18:33 -------- d-----w- c:\program files\Common Files\Sonic Shared
2010-03-17 00:37 . 2006-09-07 05:48 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-14 22:02 . 2010-03-07 12:37 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\NCH Swift Sound
2010-03-14 22:02 . 2010-03-14 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
2010-03-14 22:02 . 2010-03-07 12:37 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2010-03-14 01:25 . 2010-03-14 01:25 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Research In Motion
2010-03-13 23:58 . 2010-03-13 23:58 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\InstallShield
2010-03-13 23:58 . 2010-03-13 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2010-03-13 23:58 . 2010-03-13 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2010-03-13 23:48 . 2010-03-13 23:47 -------- d-----w- c:\program files\Research In Motion
2010-03-13 23:47 . 2010-03-13 23:47 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-03-13 06:22 . 2009-02-28 22:29 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\FrostWire
2010-03-11 21:54 . 2010-03-11 21:54 -------- d-----w- c:\program files\Common Files\L&H
2010-03-10 14:41 . 2006-09-07 05:55 -------- d-----w- c:\program files\Real
2010-03-07 22:27 . 2010-03-07 12:37 -------- d-----w- c:\program files\NCH Swift Sound
2010-03-07 22:09 . 2010-03-07 22:09 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Canneverbe Limited
2010-03-07 22:09 . 2010-03-07 22:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2010-03-07 22:02 . 2010-03-07 22:02 -------- d-----w- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\NCH Software
2010-03-07 22:02 . 2010-03-07 22:02 -------- d-----w- c:\program files\NCH Software
2010-03-04 13:05 . 2010-03-04 13:03 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-02-25 06:24 . 2006-06-17 09:23 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-14 22:32 . 2010-02-14 22:32 161296 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-02-14 22:01 . 2010-02-14 22:01 9758152 ----a-w- C:\windows-kb890830-v3.4.exe
2010-02-10 17:47 . 2010-02-10 17:47 14534 ----a-r- c:\documents and settings\Owner.YOUR-2903ECCBED\Application Data\Microsoft\Installer\{E7B100D8-98A5-42AA-830F-16D6BD5351F1}\SystemFolder_msiexec.exe
2010-02-09 14:55 . 2010-02-09 14:55 43732816 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\waol_single\4337.155.1.1\setup.exe
2010-02-09 14:55 . 2010-02-09 14:55 42960 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\waol_single\4337.155.1.1\noneCodesignFilesBundle.exe
.