Posts by jholland1964

Michelle, honestly couldn't tell you WHAT fixed it...LOL. We did so much, let's put it down to...Christmas elves...LOL!
Merry Christmas to you too.
Judy

Can do! I've been using Spybot Search and Destroy and have been happy with it, and the F-secure scan I did revealed nothing, but I'll give this a go.

I thought my computer was slow, but my wife was complaining about hers so I took a look and it takes less time to actually shuffle cards than to load solitare! It's bad.

This program looks for OTHER things that F-Secure and Spybot don't look for, add this to your arsenal for weekly scanning. But do this scan right now and see if it comes up with anything.
As far as your wifes computer, once this one is finished feel free to begin a NEW thread concerning that one. Too confusing to work on two computers, at the same time AND in the same thread. What applies to one may not apply to the other but we will be happy to help you get hers speeding along too.
Post that MBA-M log, even if it shows clean, ok? Please IGNORE the program noted by aka-amboy. This is a paid program, not mentioned here before and we try to stick with the free programs if possible. It is also one I am not familiar with so go with the steps I am giving you, ok?
Judy

Now give us a new HJT scan and post the log.

Hyzaneretro, since you say the system is still running slowly I would like you to do the following:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Reboot the computer.
Then run a new HJT scan, save the log and post back here with the MBA-M log and the HJT log.
Judy

Hi, it looks complicated, I often encounter this ,very low speed. What's the easy solution to fix this.

As you see not often easy solutions. If you have a problem please create your own new thread and somebody will be happy to help you there. It is much better to work with ONE person and ONE computer per thread.

Ok, here is the list and explanations of each as I see it. All I have listed here are NOT required to run at start up and have nothing to do with the actual running of the computer:
IgfxTray-Quick access to the control panel via a System Tray icon for graphics based upon the Intel chipsets
Persistence-Associated with the Common User Interface module for Intel graphics cards
NvSvc-NVIDIA Driver Helper Service - installed when you change from the WDM drivers to nVidia's latest versions but not requied. Extreme shutdown delays can be encountered with this service active, but no adverse side effects with it disabled.
NvCplDaemon-System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again.
NvMediaCenter-System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties
iTunesHelper-Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times so you have to keep an eye out on this one in case it restarts itself.
SunJavaUpdateSched-Java auto updater, do this manually, plus this doesn't work correctly much of …

Thanks for the additional info.
First of all you need to turn OFF that Spybot TeaTimer. It can definitely interfere with other security programs. To do this do the following:
* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer
Do that to start with and I will go through your log and tell you which ones can be stopped and how.
Judy

Hello Heyzaneretro, welcome to daniweb. First of all your HiJackThis log is incomplete. We need to see the full log, including that top portion which tells version number, your operating system, IE version, and WHEN the scan was run. We have to be able to see all that before giving steps to complete.
One thing I do note in the log posted is you have an extraordinary number of auto starting programs 36 to be exact many of which are totally unnecessary and would most definitely slow your system.
Run a NEW HJT scan and post back with that entire log. Then we can hopefully be able to give some steps to speed the boot times.
Judy

If you read my reply above I said BOTH.

on both the minimum and the maximum. That way the page file does not dynamically grow and shrink. On your 2GB of RAM this would be 3072MB

Reboot the computer after you change this

How do i update ?

Open the program, click the Update Tab, when that opens hit the Check for Updates button. Program will update in just a few minutes. Then go back to the Scanner Tab. Put a dot in Perform Full Scan and click Scan. It may ask what to scan, choose "C" drive. Allow it to scan, may take awhile. When it is finished it will show any infections in Red. Make sure there are check marks in all and then click the Remove All button. It will remove all found and then you should reboot the computer.
If nothing is found then the program will tell you Congratulations nothing found and the log will open. Regardless, please post the log.

I already uninstalled the two anti virus program , and installed the anti virus program you intorduced me .

But I have no way of knowing that because you have not done a new scan with HJT and posted the log as I requested now at least twice.
I also need you to UPDATE MBA-M and do another Full Scan with it. Have it REMOVE anything found.
THEN REBOOT.
THEN I really need you to do a NEW HJT scan and post the new log. I can't give any more steps until I see those new logs because I don't know yet if the system is truly cleaned or more needs to be removed. I need those two logs and they have to be brand new scans.

I remembered ! Its on 4th of december . Is NoLop a virus ? Cause i went to other forums they said that its a way to remove the pop-ups .

Lop is an infection NoLop is a removal tool for this infection. Now I said you should Uninstall Messenger Plus! Live because of this:

McAfee SiteAdvisor warns that the website http://www.msgpluslive.net/ is linked with adware Adware-Lop/Swizzor

and as Crunchie said:

As far as I remember, you can have messenger plus, but you need to deny the 3rd party installation that comes bundled with it.

but I have to say, I wouldn't use it. Their own website, which is in NO Way connected to Windows Live Messenger it is simply a 3rd Party Add-on from Yuna Software, NOT Microsoft. The Messenger Live! Plus distributor website gets an Unsatisfactory Rating through Web of Trust for Malicious Content, Spyware, Malware and viruses. The choice is yours of course but if it were my machine I would stick with Windows Live Messenger. Messenger Live! Plus supposedly expands the features of the public version of Windows Live Messenger and as I said, the choice is yours but are the expanded features worth it? But that is your choice to make.

Now I need to ask again...WHAT anti-program do you have INSTALLED as I see NONE in the Uninstall List but I see at least some files from BitDefender and AVG 9 running on the system …

Can I ask WHEN you ran the NoLop?

When did you run NoLop?

You need to go into Add/Remove and Uninstall Messenger Plus! Live
This is what carried in the Lop infection.
Then reboot and run a new HJT scan and post the log.

If you have no anti-virus on the computer then I would recommend instead that you install Avira. It is good, and it is Free.

Why didn't you note that you ran NoLop before you came here?

I need to see an Uninstall List generated by HiJackThis.
Run HijackThis and click Open the Misc Tools section

* Click Open Uninstall Manager
* Save list
* click on the Desktop icon or select to save the list on the desktop
* then click save.

Open the file and copy/paste the contents back here.

Its 32-bit Operating System .

Thanks, first then you need to Uninstall BitDefender entirely. I would use this program to do so;
BitDefender Uninstall Tool
After you run that tool THEN follow the instructions for the use and running of Combofix and post back with the log it produces.
Judy

I installed AVG because when i uninstalled BitDefender , until halfway , it stopped uninstalling so i restart my computer , when i went back to Add/Remove Programme , BitDefender was not there anymore , i could still find the file location , but there's isnt any uninstall.exe so i installed AVG to protect my computer .

Don't run Combofix until we get this anti-virus program problem corrected. How did you try to Uninstall BitDefender?
Is this a 32bit or 64bit system?

If you don't know here is how to find out. We need to know this for sure before going forward.
View System window in Control Panel

1. Click Start, type system in the Start Search box, and then click system in the Programs list.
2. The operating system is displayed as follows:
* For a 64-bit version operating system: 64-bit Operating System appears for the System type under System.
* For a 32-bit version operating system: 32-bit Operating System appears for the System type under System.

You now appear to be running TWO anti-virus programs on the computer, BitDefender and AVG 9. When did you install AVG 9 as it did not appear on the previous log?
You need to completely Uninstall this as having two anti-virus programs on the same computer can cause major problems. Go to Add/Remove and Uninstall whichever program is current and up to date. After you do this please do the following:
Download ComboFix from Here or Here
You will get a prompt asking if you want to run or save the file. Choose SAVE and save it to the desk top. DO NOT RUN it YET
You must take some preventative measures so that there are no conflicts with other programs when running ComboFix. At this point you should do the following:

* Close all open Windows including this one.
* Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.

Once these two steps have been completed, double-click on the ComboFix icon found on your desktop. Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.
Windows may issue a prompt because ComboFix …

We did what we could, sorry it ended in a format but as you say, a learning experience...next time don't wait so long. Hopefully though there won't be a next time!
Judy

Not AVG. Go with Avira

Ok, I think we finally figured it out. Thank you :)

Fx must have changed something in one of their new versions, so in the privacy tab it didn't look like those options were available, but they were, they were just hidden under a different drop down menu.

I didn't realize it was deleting cookies every single time I closed Fx LOL

What about my virtual memory, was that # ok?

Thanks Judy :)

Michelle

Default and recommended size of this file is 1.5 times the amount of physical memory on both the minimum and the maximum. That way the page file does not dynamically grow and shrink. On your 2GB of RAM this would be 3072MB but other than increasing the amount of disk space it takes it probably is ok.

Are you deleting your cookies? Are you deleting your temp files? If so, doesn't matter how you have Firefox or IE set up, you will have to sign in each time. This is how they are remembered, with those cookies but if you delete them all then, no, it will not remember.
If you are using something like CCleaner to remove temp files and internet temp files then they will be removed. There are any number of reasons why this is happening, has absolutely nothing to do with a website thinking you are signing on from a different computer.
You also have to have your Privacy settings set to Keep Cookies until they expire and not have them clear when you close Firefox

B/c I don't want to have to pay for it if I don't have to.
Michelle :)

This is the only free one I know of, though it doesn't test memory only hard drive. To get one to test memory you must pay for it.
http://hcidesign.com/memtest/download.html

Here is the paid version

http://hcidesign.com/memtest/purchase.html

It's hard for me to read what you wrote b/c of my bad eye, but I don't think you are understanding me.

I'm not saying I expect the bank to remember my p/w, I'm saying it's asking me the sercurity question b/c it thinks I've changed computers, so that means the IP address is being changed (I think).

I'm also saying that when I change the p/w (this is on non bank types sites like my own) in Fx it doesn't change it, it keeps reverting back to the p/w that isn't correct.

Hope I'm clearer now.

Thanks

Michelle

I don't believe it is EVER going to remember your security question answer...that is the point of the security question. If a stranger logged on they might be able to figure out your password but chances of them knowing the answer to your personal security question is very unlikely. There would be no point of having a security question at all if it can easily be saved on the computer.
Look at my attachment. Do you have Firefox set up like this?

The computer shop I just called said they would be willing to test the memory that's already there which is a good idea.

Do you know of any sites that test the current memory & maybe the HD for bad sectors?

Thanks

Michelle

Why do you need to test it yourself if the computer shop is going to do it?
I have a disk which came with my computer containing Memtest and that will test the hard drive so I have never used any online testing like that which would be very comprehensive.

I finally remembered what else the computer is doing that concerns me:

1. I think it's changing my cookies or IP address or something, b/c I'll go onto a site where I have to log in, & it will ask me my security question as if I'm not using the same computer I was using last time.

This has happened several times on 2 different sites. I keep answering the question, then the next time I log in it asks again.

2. Same thing happens with Fx. I thought it was just a Fx issue, but I have a strong feeling it's not.

I have a user name & p/w saved in my p/w area in Fx & it keeps changing back to another p/w. Every time I copy & paste in the correct one & Fx saves the correct one b/c it gives me the "change" button to click on, then every time I go back to the site once I've rebooted, it has the wrong p/w in it & I have to do it all over again.

Before I tied to find the entry in the p/w area to delete it, but Fx doesn't show all the entries properly, so I couldn't find it.

One time I did delete one entry I thought it was it, but it didn't help, same problem over & over again.

Thanks

Michelle

This has to do likely with the way cookies are saved on the computer. If you empty them …

First of all get rid of this HiJackThis. The version is way out of date, at least two years old. Current version is version 2.0.2

But please follow these steps exactly, run all the programs, save the logs, reboot when advised and then last run a HiJackThis scan with the new version linked above.

Download ATF-Cleaner.exe by Atribune Save it to your desktop for easy access.
RUN ATF-Cleaner.exe.

-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK

If you use Firefox browser, do this also:

* Click Firefox at the top and choose Select All from the list.
* Click the Empty Selected button.
* NOTE : If you would like to keep your saved passwords, click No at the prompt.

Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove …

Hiya Judy..I just deleted the file and yes all things seem good now..I have one other wee problem but gonna start a new thread for it I think..thanks again for all your wonderful help and being so patient. i'm gonna mark this as solved now
Lisa

What is this "wee" problem, may be related to this one, if not then a new thread may be advised but what is the problem?
Judy

Sorry Michelle, realized that you probably meant didn't know how to find virtual memory.
Here is how:
On Windows XP, look in Control Panel: System, Advanced, Performance, Settings, Advanced, Virtual Memory.
Here is an explanation of Virtual Memory which is fairly simplified and easier to understand:

Virtual memory is conceptually somewhere between RAM and hard disk space; it's disk space used to maximize the amount of RAM available to programs.
*You run programs that need memory. The operating system takes care of tracking which program is using what portions of memory, and allocating each program the amount of memory it needs.
* Those programs will need more memory as they do their jobs. Opening a large document may cause your word processor to request additional memory from the operating system in order to hold the document.
* If there isn't enough memory available to satisfy a request, the operating system may decide that another program's needs are less "important". Some of that program's memory will be freed, first by writing the contents to disk (the memory is "swapped out"), and then allocated to the program making the request.
*Later when the program whose memory was swapped out needs it back, that memory can be "swapped in" by reading it back from disk. This might cause memory from another program to be swapped out to make room.

Also remember that the operating system itself is also just a program. So it too …

Well that showed nothing there. Go ahead and delete that Qoobox folder, especially since it is empty. Are you still having problems or do you feel all is ok now?
Judy

TB = thunderbird
I can't remember how to get that, pls. tell me.
Thank you
Michelle

Not sure either what you mean by that Michelle, how to get what? If you all ready have Thunderbird on the computer you don't need to get it again, or do you mean you need to reinstall it?

Glad you got the graphic driver issue corrected.

but I see you deleted my other thread.

There was no need for that thread as all work was done in this thread and they pertained to the same issues.

strange things happen like my main TB window just closed on it's own.

I don't know what program you are talking about here.
Can you give me the settings you have for Virtual Memory?

Hi, All done! I did have to delete the combofix manually , and then I did the restore point so thats me all done..thanks so much for your wonderful help I dont know where I would have been with out you..

Not sure if this is something to do with the netsky or something random that I have done but I dont seem to have any audio, and I dont think we where near any of the audio settings ..should I start a new thread with this?

Lisa

Smodka, earlier you said you saw a file called Qoobox in "C". Can you look and see if it is still there? If so, open it and see if there is a .txt file in there. If there is, open it and copy/paste it here.

Which tool are you running?

Although I understand (I think) what you are trying to say, why remove the link when it offers a clean and quick solution. What I believe you to be saying is that more is to be learned by making the problem's solution as difficult and time consumming as possible. This may be true, but I do not believe it serves the poster's interest in this case.

I did NOT remove YOUR link from YOUR post for the Symantec tool which is a legitmate tool and appropriate for the thread, though at this time I believe the problem is corrected but I left the link for others to see who may be having the same difficulties.

I removed mr. ashraf_amad's post because it was a link to a university website period and it offers NO information about solutions to infection problems. If links given have absolutely nothing to do with the problems in the thread then they can be considered spam and be removed.

I understand. Thanks.

You understand what?

Avast is an excellent program, and as you say, it's free. I highly recommend it.

Hi welcome to daniweb, First of all, you said you all ready had Trend Micro so installing another anti-virus program was a mistake. Rule #1. ONE anti-virus program should run on a machine. Uninstall Avast. It is a great program but you can't run two.
#2. Registry Easy is not really a recommended program, plus "playing with" the registry unless you know 100% exactly what you are doing is a big mistake. Hopefully you made back ups of the registry before using this program.

Now we need much more information:
You say you have...

more than enough ram.

Well exactly how much is that? How large is your hard drive and how full is it?
Please do this:
Download HiJackThis and run a System Scan with it and save the log. Post back here with that log.

Here is some info on how to test if there is a corrupt file or add-in with Word from the Troubleshoot Word website:

If Word is not launching for you at all or is crashing or freezing as soon as it comes on the screen, odds are your global template is corrupt or something is loading automatically in your Word Startup folder that is misconfigured or corrupt. To see if it's a corrupt global template or some add-in that is loading on startup, go to your Start button and click on Run. In the Run box, type "winword.exe /a" (without the quotes, but …

Post the most recent MBA-M log.

Try it once more, if it doesn't work you can delete it manually by right clicking the icon and choosing delete.

Did the program actually run a full scan when this happened?

Do you mean there were no instructions to follow?

Very often old drivers have to be uninstalled before new drivers can be installed.
Generally what is recommended is that old drivers be uninstalled, reboot. Tell Windows to "cancel" when it wants to reinstall the video card and then install the new drivers.
I believe this graphics card requires everything new when you do this, directx, everything.
I also found several notes on this Smart Doctor causing graphics problems, though this doesn't help of course with this issue now.

If you would prefer not to do this then allow Windows to go ahead and install the video card.

=ep2002;1062260]1. Ok, I unchecked it.
2. The list of drivers, & when I went to go do a search, they don't have ASUS Extreme (only Innovations) & their year goes upto 2008, not 2009, so can you just shoot me the URL of where that new driver is so I can DL it. Thank you

http://support.asus.com/download/download.aspx
When you get to that page do the following:
First Click Graphic Card
Then click ATi Series.
Then scroll all the way down through the list and choose the model which is EAX300 Series.
When the page opens you will see
134 files found
+VGA (5)<<<<-----This is what you want
+Utilities (85)***No
+Manual (44)***No

Click the + next to VGA and choose the very TOP driver, that is the most recent one.

As far as those CIS Benchmark Score listings, ignore them. I have no idea what they are or what they mean. I don't get those on my computer because I am not running XP Pro. So ignore them.

Try this:
Could be a corrupted DNS cache in your Windows Vista.

Click on Microsoft Vista Start on the bottom left corner
Click All Programs
Click Accessories
Right click on Command Prompt
A black window will appear with a prompt.
At the prompt type: ipconfig/flushdns
You should get a message that says:
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

New to this so please bear with me. Working all day trying to get rid of this problem. It has improved but I still have a blue screen on startup.
Started out I had more than one virus. Many scans later I have eliminated some of the warning screens about numerous viruses but still have the win.32netsky problem.
After running the Malware bytes program and creating a log seemed better. I still have a problem though with ccSvcHost on shutdown.
Any help would be apprecieated.

Ritar, I have all ready told you that you must begin your own new thread. You will not receive answers in this thread. This is not your thread. We do not work with two posters on the same thread. Please Start a New Thread.

Looks good Lisa, now just these last steps.

You should remove HiJackThis, you don't need it any more.
You also should uninstall combofix. It basically is a "one time" fix. If a person is told to use it again some other time then a new copy would be needed.

* Click START then RUN
* Now type Combofix /u in the runbox and click OK. The space between the combofix and the /u, it must be there.
When shown the disclaimer, Select "2"

You also need to set a new, clean Restore point.
To do this Right Click My computer.
Choose Properties
When System Properties opens choose the System Restore Tab.
Place a check mark in Shut down System Restore.
You will probably get a message telling you it will be shut down, click ok or yes.
Allow it to shut down.
Wait a moment. Then go back in and take that check mark Out so that System Restore will turn back on.
If you believe all is ok then this one is solved.
Judy

New to forums...all day trying to get rid of this same virus..How do I know what to do with the HiJack This file?
Thanks..

You need to begin your own thread, stating the steps you have taken and posting the HJT log in YOUR own thread.
Judy

Yes, try that.

PhilliePhan to the rescue!!!!

Note at the bottom of the browser it says, Protected Mode On...