please help me! hijackthis log included

Hi there.

I hadnt received a reply in 24hrs with the sister forum, so ive been told to place one here. I have downloaded and run the programs mentioned in the post regarding running hijackthis. (I have also run 3 other spyware scanners, which cleared up certain objects)

I have also run the new AVG 7.5 edition which found one 'trojan proxy' last night which i deleted. I ran it twice today, and nothing was detected.

Please help me! i feel something is still not right.. I am a new adsl user and not that clued up with certain system information, and my bandwidth feels like its being eaten up slowly by unwanted spyware and proccesses, not by bandwidth thieves as my router is encrypted (which was my previous problem).

I just dont know what to do anymore..Help will be greatly appreciated!!

Below is my Hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 6:35:17 PM, on 4/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\NEWAPP~1\AVG\avgamsvr.exe
D:\NEWAPP~1\AVG\avgupsvc.exe
D:\NEWAPP~1\AVG\avgemc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Nokia\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
D:\NEWAPP~1\AVG\avgcc.exe
D:\Apps\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Apps\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Nokia\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\NEWAPP~1\AVG\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "D:\Apps\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Apps\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Apps\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Apps\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\NEWAPP~1\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\NEWAPP~1\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\NEWAPP~1\AVG\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Test your Internet connection here (requires Java, which you have):

Run it several times to ensure reasonably consistent results are being reported (here are my acceptible ADSL stats for comparison) - review their 'Definition of Terms', as well:


Please provide details on your CPU, free disk space, and RAM memory. As an assist you can run the diagnostic (Full Tests) at www.pcpitstop.com and their Disk Health tests (do not ever run defrag when your PC has suspected issues).


Please state which tools you used. That will indicate whether you have adequately covered potential non-virus related issues (spyware/malware).

__________________
Vincent P

MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis LOG __V2.0.2 _|

__
ASAP: promoting a high standard and quality of security support no matter where you seek help.

thanks for the reply!

i dont know how to run the internet tests from "here" as u specified, but i ran an download and upload test on pcpitstop (which i dont think is accurate or from the same source as you..) Could you help me set up those internet tests?

Download speed: 186 kilobits per second
Test details: 171 kilobytes downloaded in 7.39 seconds.
Receive buffer size: 65535 KB
Upload speed: 100 kilobits per second

Below is the info re RAM, CPU and Disk Space:
Intel Celeron, 2660 MHz
512MB RAM
Drive C:\ has only 14 percent of its space available.

Drive D:\ has only 21 percent of its space available.

Of the total 111.78 GB of disk space available on this system, just 22.13 GB (20%) is still available. The rest is being used by existing program and data files.

DISK HEALTH TEST PC PITSTOP:
Free space: 2.68gb (13%)
Capacity: 19.53gb
Total files: 239091
Total fragmentation: 25%
Data fragmentation: 29%
File Fragmentation: 16%
Total fragmented files: 38296
Folder Fragmentation: 2%
System restore directory: 2.18gb

Folder Fragmentation:

Total Folders: 4,231
Fragmented Folders: 116
Excess Folder Fragments: 1,674
Average Fragments per Folder: 1.395651

Most Fragmented Files:

File: System Volume Information\_restore{748EC2BD-6879-4E66-B9DF-C75DC3EBCED3}\RP90\snapshot\_REGISTRY_MACHINE_SOFT WARE
Fragments: 307 Size: 20.09 MB (21,069,824 bytes)


I have used XoftSe, Ad-aware and Spybot S&D.
I have also scanned with NOD32 and now using AVG 7.5
I have also used CCleaner and Tune Up

I hope this info helps! i just need to get the info regarding running the internet connection tests..

Thanks

Sorry for the missing LINK:

Test your Internet connection here (requires Java, which you have):

http://internetfrog.com/mypc/speedtest/

__________________
Vincent P

MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis LOG __V2.0.2 _|

__
ASAP: promoting a high standard and quality of security support no matter where you seek help.

i have run the internet test several times. just to let you know that i have a very standard ADSL package living in South Africa, where we are in a sense far behind with regards to adsl services compared to the rest of the world. I have a 3g cap on a 384kb/s line. Below are the results from the last test performed:

Download: 315,816 bps
Upload: 41,040 bps
QOS: 99%
RTT: 37 ms
MaxPause: 217 ms

Whats the next step?? I feel that i have done everything humanly possible and feel that formatting and starting from scratch may be the only option. Is that viable? I have like slight OCD when it comes to problems like these

Waiting in anticipation..

Your C:\ DRIVE is significantly fragmented which can slow down your PC's performance in a major way. Additionally, the free space is less than a minimum desirable 25% free space. A drive with such characteristics will continue to fragment very quickly and the available 512MB RAM Memory may not help matters, either (virtual memory requirements use a combination of RAM and DISK as necessary - swapping RAM to DISK as needed).

If there are any significant size data files or less used applications that can be moved to the D:\ Drive, I would recommend you do so. Later, I will also be suggesting procedures to move the Internet Cache FILES (Temporary Internet Files) to your less active D:\ DRIVE. Most of the system-loaded traffic occurs from the C:\ DRIVE and potential fragmentation degradation issues need to be reduced/minimized, if possible, on that drive.



You may want to print out these instructions.


Clean out TEMPORARY FILES procedures:
To clean your temp folder, recycle bin, etc..please download this free tool:

CCleaner http://www.ccleaner.com/downloadbuilds.asp

Install Options:

• Don't install any Toolbars, or other programs, should it ask you!
• Just uncheck the option of installing the Yahoo toolbar.

It will put a shortcut on your Desktop.

Do not run CCleaner until requested later.




Run CCleaner in SAFE MODE (reboot tapping the F8 key after the beep).

Select the ‘Options’ BUTTON option (top LEFT), ‘Advanced’ BUTTON, and then UNCHECK the ‘Only delete files in Windows Temp Folders older than 48 hours’ (often, the latest download traffic is likely to be the bearer of bad content).

Select the ‘Cleaner’ BUTTON option (top LEFT), if not already selected. Use the ’Windows’ TAB up front by default.

• Uncheck ‘Cookies’ option (advisable)
• Optionally, Uncheck ‘Recently Typed URLs’ option (potentially still useful)
• Click the ‘Analyse’ button.
• Thereafter, click ‘Run Cleaner’ after you have reviewed what it proposes to clean.

Move the location of ‘Temporary Internet Files’ to the D:\ DRIVE for IE:

Tools>Internet Option>Settings BUTTON (Temporary Internet Files BOX)>Move Folder BUTTON
(new location should show as d:\Temporary Internet Files or similar - may need to create that folder, first)
Press OK BUTTON and reboot.



Cleaning STEPS:

1. Go into SAFE MODE (gently tapping the F8 key while rebooting) and always run CHKDSK first before doing a defrag.
   
   Procedure:
   
   http://www.linkgrinder.com/tutorials...s_article.html
   QUOTE
   For Windows 2000 and XP, double-click My Computer. Right-click the C-drive and click Properties. Click on the Tools tab and choose to check the computer for problems. Click on Check Now. You will then have two check boxes. The top option is for the file check, and the second option is for the hardware (physical disk) check. Check either one, or both. At least check the top one. Again, if you think you may be having problems with the hard disk itself, then check the second one, as well. And just like the Windows 98 Thorough Scan, this will take quite a bit longer to run, so let it run over night. One thing, though: For Windows 2000 and XP, you won’t be able to run the check right then. After clicking the Start button (once the check boxes are checked), you will need to reboot to run the disk check. It will ask you if you want the system to run the CHKDSK on reboot. Choose Yes and reboot. Just before getting back into Windows, the system will do its CHKDSK, and depending on which options you chose, will take either a few minutes, and sometimes up to an hour or so, to run. Let it run.
   
   
   
2. It may be necessary to run CHKDSK more than once if problems are found. The first pass may only repair or restore bad sectors. The next scan might need to delete (orphaned?) file or index entries.
   
   
3. Repeat for any additional DRIVES (D:\ , E:\, etc as applicable.
   
   
   
   
4. Next, in SAFE MODE, run DEFRAG.
   See instructions here, if needed:
   How to Defragment Your Disk Drive Volumes in Windows XP
   http://support.microsoft.com/kb/314848

__________________
Vincent P

MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis LOG __V2.0.2 _|

__
ASAP: promoting a high standard and quality of security support no matter where you seek help.

thanks alot for the info! ive run ccleaner, and about to run the disk check and defrag. according to my hijackthis log, is there now spyware present? Once defragged, is formatting my pc not a possibility, or must it still be done?

Nothing is obvious.


If formatting (erase all content and start again, clean) was your only option, there would be no point in defragging first. Think of defragging as putting a deck or hands of cards in suit order - because as for a card player the lack of order is very unproductive when you efficiently need to access all the cards present in a given suit (same issues as for gathering all the pieces of a given file - linear access is very significantly more productive).


Another additional possibility for later would be to consider converting your existing drive to a larger drive (if the space requirements continue) and if you plan on keeping your current PC as your principal unit for the forseeable future. That is a fairly simple process if want to consider this.

__________________
Vincent P

MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis LOG __V2.0.2 _|

__
ASAP: promoting a high standard and quality of security support no matter where you seek help.

thanks for the help again! one last thing though. you mentioned "consider converting your existing drive to a larger drive". My harddrive is about 100gs, which is large enough for me and im not considering buyijng another one. At the moment it is partitioned where the C drive is only 20gs and the D drive is big (due to media storage..) Is it possible to "repartition" the drive, i.e. make the C drive bigger without formatting or losing any information on both the C and D drive and thus reducing my D drive by a fair amount?

Yes - if 20GB is truly sufficent and optimal for your ongoing needs. One tool that I have personally used with success in the past is Partition Magic (at US$70 it is not cheap). You need to read the instructions carefully. As with any such procedure there is a always a minor risk that things could go wrong. Best to backup critical user files, first.


There may be an appropriate free software alternative available here:
http://en.allexperts.com/q/Shareware...bstitution.htm

__________________
Vincent P

MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis LOG __V2.0.2 _|

__
ASAP: promoting a high standard and quality of security support no matter where you seek help.