Computer playing up, pls look at my hijack log

kaza

I have a toshiba satellite, use windows xp and google chrome.

It's been playing up for about a week, pages wont load they time out or are really slow, bit if I switch the laptop of 3 or 4 times it runs great for hours/days. Have run malware bytes it didnt find anything, I have microsoft security essentials on it. At this moment after switching on /off 4 times because ages wouldn't load its fine.

Here is the hijack this log ;

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:40:27, on 14/08/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\KAREN.KAREN-B497AA490\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

--
End of file - 6815 bytes

Thanks for any help
Karen

davb

There doesn't seem to be anything obviously nasty in there, maybe a couple of entries that aren't essential, but they shouldn't cause the type of problems you mention.
Personally I would try uninstalling Microsoft security essentials and put on either Avast or Avira as a test (download it before uninstalling mse). You can always put mse back later if you prefer it.

SteveJH200

Go to Bleeping Computer.com and download ComboFix onto your desktop. Run it and follow the instructions - it can take a minimum of ten miutes but it will find and fix whatever is causing the problem. Delete it from your desktop when you have finished with it.

waddler_8

A caveat concerning the running of combofix:

ComboFix usage, Questions, Help? - Look here

kaza

waddler_8 wrote: »

A caveat concerning the running of combofix:

ComboFix usage, Questions, Help? - Look here

So this recommends I dont use combofix?
Thanks

GunJack

kaza wrote: »

So this recommends I dont use combofix?
Thanks

it's not a case of don't use it, but it should be considered a "big gun"

Before you use CF (which will be recommended on here if needed) can you post the last MBAM log please ??

spakkker

I have used combofix many times - it's very good.
I don't understand how it works . . . so what??
That caveat is always brought up and is why I've given up recommend CF on this forum - fed up with the inevitable, unqualified comments that follow.
You were happy to run hijackthis which can rubbish your pc if you go clicking willy-nilly , combofix doesn't give you that oportunity.

I'd try and cut down on items starting with windows - ccleaner/tools/startup - also decide if you need certain progs running eg roboform etc.

waddler_8

As the link shows, other prelimainary scans are run first to determine whether to deploy combofix or not. It's then recommended by it's developer to be only run only under the supervision of someone trained in it's use - It's not a generic, one click fix type scanner.

You can choose to follow that advice or not - It's up to you.

HijackThis is/was intended to show possible settings and load points affected by malware. Malware has progressed in the time since trend bought the tool & they haven't updated it much at all since purchasing the code - It just hasn't kept up with the pace of modern malware and therefore is no longer regarded comprehensive as a preliminary scan tool.

GunJack

all these tools have their uses, and it's not a case of one is better than the other - they do different things, and should be used in conjunction with each other to sort out the infection/slow running/etc.

spakkker

Try leaving task manager running, there have been cases of mse hogging cpu
http://answers.microsoft.com/en-us/protect/forum/protect_start/recent-upgrade-to-mse-caused-me-to-get-msmpengexe/30961785-3199-4305-8a51-7119ec2485d5
Better uninstall it, as already posted.

SteveJH200

Sorry - didn't mean to start something here - yes, I agree that all the normal tools should be employed first and ComboFix should be regarded as a last resort. All I can say is that it works on the most stubborn problems - the sort of problems where one finds oneself thinking about jumping off a cliff or removing ones hair in big clumps Combofix has never failed me yet but it might be worth looking at a few reviews here before you make up your mind to use it. http://download.cnet.com/Combofix/3000-8022_4-75221073.html