Posts by jholland1964

I have a windows xp with vista. I have never had a mac. I am a musician and have an rs232 connector on my laptop. I also need a wave file player. Also my computer has no cd so I want sonic foundry and cakewalk software. Do you know where I can buy.? From the net downloaded?

tupac you should NEVER post within somebody else's thread, especially with this type of question. This is not the forum where this belongs, this is a forum for virus and infection clean up.

I know its been a bit but I'm back. I've gotten my hard drive down to 85% full. Most of the space is due to music and video files, which I don't really want to get rid of, about 24 Gigs.
Irregardless I still think its something else that is slowing down my computer. The computer seems to do better when there isn't any program open that connects to the internet: browsers, Outlook, iTunes, etc.
I'm still having a lot of problems with the windows screen saver freezing up. I have it set to scroll through my photo album.

Sorry, but I firmly believe the cause of your slow downs is the fact that the hard drive is 85% full. We know absolutely that the computer is NOT infected so it cannot be infection causing the slow downs. Yes, the computer would work faster not online, it won't have to use so many processes if it is offline.
Here is the statement I found on MULTIPLE websites concerning a hard drive with only 15% remaining space or less:
Your computer will run more slowly with a relatively full hard drive. This is because the free space is used up by your computer as Virtual Memory space, and the smaller amount of free space available, the smaller amount of Virtual Memory space available. The more you fill up a hard drive, especially past the 85% mark, the more the fragmentation, which decreases file access speeds and consequently …

Hi welcome back...:(
When you say you reinstalled XP I presume you mean you formatted the computer and installed XP, correct? When you reformat you wipe the drive, meaning EVERYTHING has to be reinstalled too. So you need to reinstall all drivers and hardware also. Did you do that? It sounds to me either that the reinstall of XP was done incorrectly, OR you only installed the operating system but nothing else to go with it. How did you do the reinstall?

Have asked PhilliePhan to take a look at his one and see what he thinks.

Of course I think System Restore itself is so mis-understood anyway. So many seem to think it is the "end all and be all" of fixing, when in reality many times it does more harm than good. It doesn't restore everything but so many people "boink" their computers by immediately turning to System Restore rather than just doing a simple uninstall of something or maybe an adjustment of some kind. Then they can't figure out why something doesn't work right anymore. Obviously it DOES work in some instances but for my money anyway it shouldn't be the first step.

I know there ARE forums which tell people to turn it off, guess I should have worded it that MY feeling is that it should be left on because of..the "infected point better than none at all" argument. And yes, I would tell them to turn it on....

Hi,
I profess to no particular expertise, however is it possible you could do a system restore to an earlier time before you experienced this problem?
it reminds me of a nasty i got a year ago which prevented me accessing the internet at all, disabled my antivirus software and sadly also in that case deleted all my restore points - i ended up needing a full format and install, but maybe you can still do a system restore?
good luck.

System Restore is NOT going to remove an infection or ANY program for that matter. What it likely would do is remove the "notation" of the program or infection making it that much harder to find and remove. When dealing with an infection System Restore should be left alone until the computer is deemed clean. THEN, and only then, you should set a new and clean restore point by turning off System Restore and turning it back on. But until the computer is clean, leave it alone.

Try this suggestion from the MBA-M forums;
If you already have MBAM installed on your computer.
Please navigate to the MBAM folder located in the Program Files directory.

Locate MBAM.exe and rename it to winlogon.exe

Once renamed double click on the file to open MBAM and select Full Scan.

At the end of the scan allow MBAM to remove what it had found then reboot.

Post the log here. If you cannot do this either then try running MBA-M in Safe Mode. It IS meant to be run in normal mode since it won't load all of it's drivers in safe mode but if all else fails then this would be the next best thing to try.
Of course have it remove all if you are able to run it in safe mode.
Then reboot to Normal mode and attempt to run another full scan with it. If it works then of course have it remove all it finds and reboot.
Rename HiJackThis to analyze.exe and run the system scan and save the log. Post back here with both logs.
Judy

Firefox version 3.0.4 and yes firefox is allowed and not offline. I did reboot and uninstalled the program then reinstalled, it now seems that it won't work from google.ie/.com but will work for yahoo or some other search engine.

I am not certain what you mean here "IT" won't work from google.ie? What won't work? If you mean you cannot use google but you can use other search engines? You are using an old version of Firefox, current version is 3.5.3.

What version of Firefox are you using? Are you certain that you have Firefox allowed in your firewall?
Are you certain you have Firefox set to operate ONLINE. Go to File and click and make sure there is NO checkmark next to Work Offline
We need more info on your computer itself and the programs you are using; Operating System, Anti-Virus program, Firewall and any other security programs you may have running.
Have you rebooted the computer and tried again to use Firefox?

First I believe you have way to many processes running. Next I see you are running Firefox. I had a similar problem. Are you able to get on the web? I found out that Mozilla firefox had been attacked with the Trojan Horse Downloader.Banload .APJF. I rerand a virus check and it picked it up and deleted it. All is well now. But before I did this I had to do a Winsock reset. Hope this helps.

good4golf, I am going to have to say, you need to read an ENTIRE thread before posting, this one is over 4 pages long, 32 replies counting yours and covers an 8 day period. Obviously you didn't since it appears your reply covers items noted in the first HJT log and doesn't take into account the various scans which were run. All virus and trojans scan run have come up clean. Several of us regulars have looked at these logs and do not feel the computer is infected. The poster makes no mention of NOT being able to get onto the internet and obviously can as various programs requested were downloaded and used.
If you look at the LAST HiJackThis scan log you will see that many of those processes showing in the first log are no longer running since the unnecessary auto start programs have been turned off and the Norton listings in services have been removed AND at the time of the last scan Firefox was NOT running but as …

Hollyecho, This thread was begun 8 days ago and now you are covering a LOT of OLD ground here advising the very same steps which have all ready been fully completed:

AVG has all ready been removed and replaced by Avast as noted HJT log in post #14. All the Norton stuff you noted have all ready been taken care of as noted by the poster in post #15.

Unnecessary start ups were listed in post #17 and recommendations on how to stop these were noted AND also taken care of as demonstrated by the latest HJT log.

Malwarebytes' was all ready updated run over 1 week ago and came up clean in post #3. Finally poster DID post he is continuing to have problems in post #22 2 days ago. He also posted his hard drive is 95% FULL and he only has 1GB of RAM. I gave him my recommendations yesterday and he has yet to post back.

Both of these files are fine.
Analysethis.exe is HiJackThis only renamed.
ctfmon.exe is located properly and is involved with the language/alternative input services. It will run as long as Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features and can be turned off there.

You know to see what IS using all that space, you might try this program DiskPie I have used it before when cleaning out computers. It tells you exactly what IS taking up all the space on there. Read that PC Computer article about it and if you decide to use it then you can download the zip file right there at the top of page one. It does give a good picture of exactly what is hogging and that physical space on the drive.

I'm getting conflicting opinions about Registry Cleaners. Can they damage my files?
Are there any free ones available?

Absolutely leave the Registry Cleaners alone. Learned this years ago from a fellow I learned much of what I know today and have followed his opinion on this which is the following:

. Were registry cleaning *really* able to improve performance, the developers of these utilities would support their marketing claims with some form of empirical evidence (performance prior to cleaning -vs- performance post cleaning). But have you ever seen such benchmarking? No, and that's because registry cleaning does *not* improve perforance. Think about it ... programs such as SpywareBlaster dump 1000's of entries into the registry without causing any performance hit. Similarly, the fact that registries tend to hold significantly more information than in years gone by (bigger hard disks = more programs installed/data stored = more registry entries) has not resulted in systems slowing to a crawl.

Using an automated cleaner to try to fix a problem is akin to using a shotgun to remove an appendix. The best way to deal with (possibly) registry-related issues is is to throughly research the problem and then use regedit to make any necessary changes and/or deletions (having first set a restore point or created a backup).

Now having your "C" 95% full will absolutely slow the computer, I am surprised it is actually running! You need to go through there and get some of that off of there. What all is …

So I've been able to do as suggested and I noticed an immediate improvement in the speed, but within a few hours it seemed to slow down again. Not as bad a before but still not as good as earlier.

Overall thank you for the help. Any other suggestions?

Since it slows again after a few hours then what you have to look at is what is running? How much RAM is installed? You said your "C" drive is getting full...how full?

One thing that will slow the computer is that AVG anti-virus program, it is just loaded with "stuff". I would recommend you choose another anti-virus program. Avira and Avast are both FREE, excellent and don't come with as much extra running files.
I, myself, prefer Avira and have used it several years but the choice is yours.
Do a new scan and post the log.

I will say "assume" it is the final chapter. Since you didn't respond for 13 days honestly I cannot say. If the computer is running well then I guess consider it closed. But to really be certain a computer is cleaned a one must really continue immediately until all things are clear. Mark this closed.

Try running the scan in safe mode.

You have Zone Alarm Firewall on there are you also running the Windows Firewall?
Try turning off Zone Alarm and see if you can access any of the security programs.
Have you done any scans with your AVG 8 that is you anti-virus program and where you should begin, with a full scan with it.

What I gave you was really not a link to a website but should have given you the actual executable program file.
Can you access this site which will give you HiJackThis

Exactly WHAT website are you trying to access? Are you using the infected computer to come here?
Try downloading and running HiJackThis using this executable.
Then run the scan and post the log here.

Do you have access to another computer? If so you could download programs to a thumb drive or cd and then take them to the infected computer and install them. You could also try Safe Mode with Networking which would allow you to boot the computer with only the barest necessary files running AND give you internet access and you possibly could download removal programs that way.

Now for your unneeded auto starting programs; All of these programs auto start when the computer starts and then generally run all the time in the back ground. None of them are needed for the smooth running of the computer. Some are totally unnecessary and some are considered "Users Choice", that is, if you want them to run all the time go ahead but they are not needed. The User Choice ones I will mark with a * so you decide. The others absolutely are not required.
To easily disable these auto starts you can use one of these programs, Mike Lin's StartUp Control Panel which, after download and install can be found in the Control Panel with a little computer icon labeled Start Ups or CodeStuff Starter. The CodeStuff program you can save anywhere you can easily find it. CodeStuff is a bit more of an "in depth" program than Mike Lin's as you can also turn off Services and also has a detailed Process manager, somewhat like the Task Manager. It just is more detailed. You can install either or both of these programs. I have them both so either are fine. Both are FREE. Mike Lin's just enables you to stop auto starting programs.
Either way, once downloaded then open which ever program you have chosen. When Mike Lin's opens you will see six tabs. Go through each tab and remove the check mark from the program you want to Stop …

I was able to delete most the Norton and Symantec stuff. I wasn't able to delete a Aluschedulersvc.exe file.

Try it this way first.
Go to Start, Control Panel, Administrative Tools, Services.
When Services opens scroll through the list until you see these files;
Automatic LiveUpdate Scheduler - Symantec Corporation
LiveUpdate - Symantec Corporation. When you do double click it to bring up it's properties. First Click the Stop Button to stop the Service.
Once the service stops then click the Start Up type button and change it to Disabled.
Ok your way all the way out.
When go to C:\Program Files\Symantec\ and delete the Symantec Folder.

Next, run HiJackThis again and put check marks next to the following entries:
O2 - BHO: (no name) - {52706EF7-D7A2-49AD-A615-E903858CF284} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - Startup: PowerReg SchedulerV2.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
Once you have placed the check marks then click the Fix Checked button. Exit HJT.
I will look through your auto starts and post back here with a list of those which are not required to auto start and can be run manually and instructions on how to turn these off.

It says "Infected" because that was my assumption. When your computer starts freezing up, programs crashing, the cursor getting jumping what else are you supposed to think? I'm not an IT guy, just a computer user.

If its not infected what is the problem?

Don't worry about that guy, just continue with the instructions given to remove those Norton remainders. Then run a new HJT scan and post that log, I'll go through those start ups and tell you what they are and how to stop them.
Judy

What is your opinion of downloading a Registry Mechanic?

Not a good idea. Registry "cleaners/fixers" very often bring on a lot more trouble than you are all ready having. Leave it alone.

For the Norton program, first go to Task Manager and look for this running;
LiveUpdate\ALUSchedulerSvc.exe
If you see it, End the Process.
Then go to Add/Remove and look for Symantec. IF you find it in there Uninstall it. That appears to be the only Symantec/Norton process still running.

Then go to Start, Search, and look for Norton, delete anything found. Then do the same for Symantec.

You have a lot of programs running unnecessarily at start and therefore running all the time. This would slow the computer considerably. Also, AVG can really be a drag on resources as it has so many needless processes. You might consider a different anti-virus program, Avira or Avast are a couple of really good free ones. Highly recommended.
Try going OFFLINE and run the computer without the AVG running and see if it makes a difference. If it does then change your anti-virus program.
We can certainly help you pare down some of those needless auto starts if you wish.

Well, actually; it's ironic that you say that, because I DID update MBAM prior to my scan, (as I realize that it makes sense to). So perhaps the latest definitions file is where the problem lies?

Database version: 2881
The scan was run today. Today's first update brought it to 2886 and latest one this afternoon brings it to 2888.

Notice PP said;

Update your MBAM to database version 2886 or later and you should have no more issues with this.

meaning if you update it to this version or later the False Positive issue was corrected with the database version of 2886.
This means that the MBA-M people were aware of the FP issue in the 2881 version and did an update to correct it. So update as PP advised and run the scan again. If the FP shows again then we will do something else.

It is.

Update your MBAM to database version 2886 or later and you should have no more issues with this.

Cheers :)
PP

This shows WHY the standard instruction BEFORE using MBA-M is Update. The program has updates daily, sometimes multiple updates in one day. The absolute rule should be ALWAYS update the program before scanning with ANY scanner.

What about that registry key? It is still in quarantine.

Yes, restore it too. Then update MBA-M and please do the developer log again so I can send it onto MBA-M

You're welcome. Are all problems fixed? If so then you can mark it solved.

Yes, please restore them all prior to the scan.

Con'tyou do the Word Document attachment of the OLD log. Please Update MBA-M and do a new Developer scan with it and attach THAT new scan ok?

They believe they have it fixed but need to see a log from somebody who was receiving both of these findings. So Update MBA-M...the new database is 2832. So update to that and then do another developer log and attach it ok?
Here are instructions again for getting the developer log;
1. Click the Start Menu.
2. Click Run.
3. Type in "mbam.exe /developer", without the quotes.
4. Run the same type of scan you did before and save the logfile and post it.

Do me another favor. Can you save this log as a Word Document and attach it here? I cannot seem to get the full log to copy. Thanks!

Thanks! Have sent this onto MBA-M and I will let you know what they come up with. Thanks for hanging in there with me on this!
Judy

I would also like you to do the following, after that developer log.
Right click on your desktop and choose New Folder. A new folder will appear on the desktop.
Go to My Computer. Double click to open. Then double click "C" Drive to open that. Then go to Program Files. Double Click to open. Scroll down until you find the Microsoft Works folder. Double click to open that folder. Scroll through there until you find cpitv11.dll Right Click on it and choose Copy. Then go to the new folder on your desktop and open it. Place your cursor anywhere in there and Right Click and choose Paste. A copy of that file will be pasted into the folder.
Next do the same thing...locate another program folder, this one is going to be located in the MATLAB71 folder. Open that folder. You should see other folders in there this time open the toolbox folder. When that opens there will be more folders. Open the datafeed folder. When that opens you will again see other folders. In there again you should see another datafeed folder. Open that one. This time the file you need to Right Click and copy to that new folder on the desktop is bbdatafeed.mexw32

Close all that out. Hold that New Folder on your desktop until I request it. MBA-M first requested that these be put into a folder and zipped and then sent to them but now they want to wait until …

Can you do the following for me?

1. Click the Start Menu.
2. Click Run.
3. Type in "mbam.exe /developer", without the quotes.
4. Run the same type of scan you did before and save the logfile and post it.

Judy

There is only one on that last log. Just hang onto it for now. Don't remove it from Quarantine yet. I am submitting this info to MBA-M. You may need to restore that ONE. The only removals in question were those in that last scan that had items to remove. None of the other scans are in question. But don't clean out any of the quarantine files yet either. I will get back to you on this one as soon as I can.

Happy to help. If you feel all is well then you can mark this one solved.

WAIT! You are not finished yet. You need to do two more things....

First you need to Uninstall Combofix. This isn't needed anymore
* Click START then RUN
* Now type Combofix /u in the runbox and click OK. The space between the combofix and the /u, it must be there.
When shown the disclaimer, Select "2"

You also need to set a new, clean Restore point.
To do this Right Click My computer.
Choose Properties
When System Properties opens choose the System Restore Tab.
Place a check mark in Shut down System Restore.
You will probably get a message telling you it will be shut down, click ok or yes.
Allow it to shut down.
Wait a moment. Then go back in and take that check mark Out so that System Restore will turn back on.

and yes the symantec was something which was uninstalled previously...

Well at least some of it remains. How did you uninstall it? Via Add/Remove? Which version was it, do you recall?
There is a Norton Removal tool that you can use but you have to use the step given specifically for the version you had on the computer.
It DOES need to come off there.

fabianslo,
You need to go back into MBA-M Quarantine Tab and restore ALL these files removed if possible;
:\Program Files\Microsoft Works\cpitv11.dll (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft Works\pibase11.dll (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\MATLAB71\toolbox\compiler\mcr\matlab\verctrl\verctrl.mexw32 (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\MATLAB71\toolbox\datafeed\datafeed\bbdatafeed.mexw32 (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\MATLAB71\toolbox\matlab\verctrl\verctrl.mexw32 (Malware.Packer) -> Quarantined and deleted successfully.

Then go to http://virusscan.jotti.org/en
Upload each of those files for scanning. Report back on what is found for each one.

Yes, is this the instructions you used? I don't have Vista so I don't have all these options on the Windows Firewall on XP.
Check out this thread and see if you are following the correct settings there.
http://www.support4vista.com/tutorial/windows-firewall.htm

also take a look at this one
http://articles.techrepublic.com.com/5100-10878_11-6098592.html

and here
http://www.vistax64.com/vista-networking-sharing/56740-configure-windows-firewall.html

Hopefully. But watch where you surf and WHAT you do. Re-read my post about HOW you get infected.

Ok, I am also going to recommend that you download SpywareBlaster, install update and then ENABLE ALL PROTECTION, including Restricted Sites section. It is a MUST HAVE as far as I am concerned, wouldn't run my computer without it. It works on all Windows systems from 98 forward. It is FREE. You must check it manually for updates unless you purchase it. I use the free version. It will do the following:

* Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
* Block spying / tracking via cookies.
* Restrict the actions of potentially unwanted or dangerous web sites.

and it does all this WITHOUT running in the background. It DOES work.

Sorry, I was away for much of yesterday. Does the computer seem to be running better? Or are you still having problems?

One thing I AM questioning, you said you are using Panda Cloud Antivirus but there are a number of Symantec files on the computer...and running. Is this an OLD anti-virus program that you failed to totally uninstall?

Sorry, when you asked me if I'm using a firewall I didn't think of windows firewall.... yes my windows firewall was and is always on.
So I still don't understand why those IPs keep trying to connect to me?? You are saying if I format my windows hard drive, I will still be getting this?? What firewall would you recommend? How's ZoneAlarm?

Who said anything about formatting your computer? But yes, chances are I think you still would be getting these. You can try it if you wish, that is your choice.
No, I wouldn't recommend Zone Alarm, the one I would recommend would probably be Outpost as it also works on a 64bit system. Many don't but this one does. You will have to disable the Windows Firewall when you install another one.

One thing you have to check is the settings in the browsers you use, make sure only 1st party cookies are allowed, 3rd party are blocked.

I believe you mentioned that your router has a firewall but you are not using it? Use it.

Look, this has really gotten somewhat ridiculous. We've told you multiple times WHY this is happening, you are supposed to get these notifications with MBA-M Protection Module, it is doing the job it was created to do. But it won't replace a firewall. You are running Vista. It HAS a built in two way firewall, turn it on. No, it isn't the very best but it is certainly better than nothing and with the exception of MBA-M that is all you have. These pages are "calling in" what on your computer is "calling out"? You don't know. Turn on the Windows Firewall and get some additional protection at least. All you have to do is turn it on. Period. You can continue to question these websites forever, it won't stop them, you are running a non-secure computer and as long as you allow this to continue you WILL get another infection that is a guarantee.

It doesn't matter if my browsers are open or not, it still keeps notifying me even when I just turn my computer on and leave it without running anything.

Because you don't have a firewall on there. I say again, MBA-M is not a firewall, you KNOW MBA-M is blocking these. It is blocking them because, as they state in their information

it provides an additional layer of security for your computer, by preventing access to known malicious IP addresses and IP ranges.

These are ones which are listed within the MBA-M database so it doesn't block ALL.

Did you do the ESET Online Scanner?

here are few more IPs 89.248.168.63 | 95.211.96.37 | 212.117.164.26

None nice. Why don't you put a firewall on there?
Exactly WHAT webpage are you on when these occur?
Copy paste it here.