hijack this

atro1

could someone look at this please. my pc. running vista has become very slow to open anything,mail google, the first time it can take up to 4 minutes.
anyway here is the log.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:51:03, on 03/04/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19019)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Secunia\PSI\psi.exe
c:\Users\suzy\Downloads\HijackThis(2).exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Wireless Manager] "C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" startup
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON SX110 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFBE.EXE /FU "C:\Windows\TEMP\E_SC043.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/da2/PCPitStop2.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mamutu Service (Mamutu) - Emsi Software GmbH - C:\Program Files\Mamutu\a2service.exe
O23 - Service: MozyHome Backup Service (mozybackup) - Unknown owner - C:\Program Files\MozyHome\mozybackup.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 9521 bytes

GunJack

3 things glaringly obvious from a quick look - Rapport installed, spybot's Tea-timer, and virgin's wireless manager. BinRapport, turn off tea-timer and use windows internal wireless manager. JUst those will make a difference

Also, too many toolbars and helper objects in there. Visit closed's excellent sticky and work through the decluttering in there, post back on this thread for advice as you work through it

RussJK

Main problems: Overboard on security , too many toolbars, too many programs running

Security:
Winpatrol (lightweight)
Spybot (I'd uninstall, then reinstall without any extras +/- immunisation)
Rapport (slows down systems)
Microsoft Security Essentials
Mamatu (normally light, but can conflict and cause problems for some - worth testing the system without it to make sure it's not causing you a problem)

Toolbars:
Realplayer
Bing
Google
Windows Live

Other bloat:
Adobe reader
Java
iTunes

atro1

Also, too many toolbars and helper objects in there. Visit closed's excellent sticky and work through the decluttering in there, post back on this thread for advice as you work through it

going through Closed sticky. Slowly.

Winpatrol (lightweight)
Spybot (I'd uninstall, then reinstall without any extras +/- immunisation)
Rapport (slows down systems)
Microsoft Security Essentials
Mamatu (normally light, but can conflict and cause problems for some - worth testing the system without it to make sure it's not causing you a problem)

Got rid of all except MS essentials.
I cannot uninstall 'Bing' coz it states 'speak to administrator'.
virgin's wireless manager got rid of it, will windows internal wireless manager switch it self on or is it already running.
Thats a start.

atro1

Its quicker but on switching on I get a warning message that windows has stopped a whole list of things from opening or starting!!

GunJack

atro1 wrote: »

Its quicker but on switching on I get a warning message that windows has stopped a whole list of things from opening or starting!!

some more detail would be useful

atro1

sorry! but I clicked disable and it has not come up again.These were all enabled on start up. The icons in the bottom right hand tray have gone. M/S security essentials has gone from the tray, but Its still in programmes and when I click on it it shows it is still working. Not a lot of help. Do I sound as idiotic as I feel.!!

RussJK

Presumably you've gone into MSCONFIG, and unticked everything in the Startup section? If so, you can reverse that and retick anything you need.

atro1

Got it back. Put msconfig into run and up it came.
Under startup tab I have 28 items.Cannot copy and paste! but saome I know off Others I have not a clue.mostly
HKLM\SOFTWARE\MICROSOFT\windows\current version\run.
2 HKCO\MICROSOFT\windows\ current version\run
and then
SECUNIA c:\PROGRAMME DATA microsoft\windows\start menu\programmes\start.
microsoft O\c:users suzy\appdata\roaming

Does that help in anyway.

RussJK

Best not to make changes you don't understand. If you know that unticking a particular entry will disable a certain program from starting with Windows, then fine - but it sounds like you are unticking too many things. Still, we've all learnt by experimenting

I'd like to look into the appdata/roaming entry. Please don't make any further changes for the moment, and download OTL for me. It'll let me do a specific search.
http://www.geekstogo.com/forum/files/download/398-otl-oldtimers-list-it/

Run OTL, and don't be alarmed by the interface

• First press None (so the button changes to say 'Standard')
• Check/TICK the box next to 'LOP Check'
• In the 'Custom Scans/Fixes' box, please type in: msconfig
• Press the blue Run Scan button at the top left.
• When it finishes, paste the log that comes up in notepad here

atro1

Here goes

OTS logfile created on: 27/08/2011 17:24:05 - Run 1
OTS by OldTimer - Version 3.1.44.4     Folder = C:\Users\suzy\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.75 Gb Total Space | 171.76 Gb Free Space | 77.11% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.12 Gb Free Space | 51.22% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: SUZY-PC
Current User Name: suzy
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
 
 
[File - Lop Check]
 Atari -> C:\Users\suzy\AppData\Roaming\Atari -> [2009/02/01 22:26:24 | 000,000,000 | ---D | M]
 Azureus -> C:\Users\suzy\AppData\Roaming\Azureus -> [2010/08/27 10:55:10 | 000,000,000 | ---D | M]
 Business Logic -> C:\Users\suzy\AppData\Roaming\Business Logic -> [2009/03/22 14:23:18 | 000,000,000 | ---D | M]
 com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 -> C:\Users\suzy\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 -> [2010/05/31 18:07:14 | 000,000,000 | ---D | M]
 coupons -> C:\Users\suzy\AppData\Roaming\coupons -> [2011/06/26 14:25:52 | 000,000,000 | ---D | M]
 DriverCure -> C:\Users\suzy\AppData\Roaming\DriverCure -> [2009/09/10 10:49:28 | 000,000,000 | ---D | M]
 E-centives -> C:\Users\suzy\AppData\Roaming\E-centives -> [2010/07/06 09:26:25 | 000,000,000 | ---D | M]
 EPSON -> C:\Users\suzy\AppData\Roaming\EPSON -> [2010/09/16 17:20:31 | 000,000,000 | ---D | M]
 Eyeblaster -> C:\Users\suzy\AppData\Roaming\Eyeblaster -> [2008/10/27 16:16:02 | 000,000,000 | ---D | M]
 Fotoboox -> C:\Users\suzy\AppData\Roaming\Fotoboox -> [2010/12/20 20:02:50 | 000,000,000 | ---D | M]
 ICQ Toolbar -> C:\Users\suzy\AppData\Roaming\ICQ Toolbar -> [2008/12/01 09:47:36 | 000,000,000 | ---D | M]
 InstallPad -> C:\Users\suzy\AppData\Roaming\InstallPad -> [2008/12/01 09:45:56 | 000,000,000 | ---D | M]
 iWin -> C:\Users\suzy\AppData\Roaming\iWin -> [2008/12/23 18:53:14 | 000,000,000 | ---D | M]
 JAM Software -> C:\Users\suzy\AppData\Roaming\JAM Software -> [2011/08/20 16:38:33 | 000,000,000 | ---D | M]
 Nokia -> C:\Users\suzy\AppData\Roaming\Nokia -> [2011/02/13 11:07:48 | 000,000,000 | ---D | M]
 PC Suite -> C:\Users\suzy\AppData\Roaming\PC Suite -> [2011/02/13 11:07:45 | 000,000,000 | ---D | M]
 PCDr -> C:\Users\suzy\AppData\Roaming\PCDr -> [2010/12/10 17:41:40 | 000,000,000 | ---D | M]
 PopCapv1006 -> C:\Users\suzy\AppData\Roaming\PopCapv1006 -> [2011/02/20 06:49:03 | 000,000,000 | ---D | M]
 Serif -> C:\Users\suzy\AppData\Roaming\Serif -> [2011/08/03 22:03:13 | 000,000,000 | ---D | M]
 TeamViewer -> C:\Users\suzy\AppData\Roaming\TeamViewer -> [2009/03/01 10:35:59 | 000,000,000 | ---D | M]
 Trusteer -> C:\Users\suzy\AppData\Roaming\Trusteer -> [2011/02/24 08:24:18 | 000,000,000 | ---D | M]
 TuneUp Software -> C:\Users\suzy\AppData\Roaming\TuneUp Software -> [2009/07/06 09:50:39 | 000,000,000 | ---D | M]
 Unity -> C:\Users\suzy\AppData\Roaming\Unity -> [2011/07/12 07:40:45 | 000,000,000 | ---D | M]
 uTorrent -> C:\Users\suzy\AppData\Roaming\uTorrent -> [2009/03/22 14:00:04 | 000,000,000 | ---D | M]
 WinPatrol -> C:\Users\suzy\AppData\Roaming\WinPatrol -> [2009/05/13 19:12:44 | 000,000,000 | ---D | M]
 Zylom -> C:\Users\suzy\AppData\Roaming\Zylom -> [2008/10/27 16:16:00 | 000,000,000 | ---D | M]
 PCDoctorBackgroundMonitorTask.job -> C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job -> [2011/08/27 15:02:30 | 000,000,564 | ---- | M] ()
 SCHEDLGU.TXT -> C:\Windows\Tasks\SCHEDLGU.TXT -> [2011/08/27 11:58:36 | 000,032,648 | ---- | M] ()
 SystemToolsDailyTest.job -> C:\Windows\Tasks\SystemToolsDailyTest.job -> [2011/08/27 17:18:03 | 000,000,506 | ---- | M] ()
[Custom Scans]
< MSCONFIG >
< End of report >