Problems with my computer

[goodguynycusa]

Sirs:

I caught a "redirect virus" and everything became more screwed up
after that.

I ran Kapersky, which got a load of crap off, Malware Bytes Anti-
Malware, which found some viruses, Spybot Search, CCleaner, Super
AntiSpyware, Revo Uninstaller, Trend Micro, which if I remember
correctly found my Yahoo had been directed somewhere else and reset
it, Microsoft Security, which found one bad item. That's most of what
I can remember.

The Kapersky seemed to be screwing things up so I uninstalled most of
it and left a little bit in which I guess I shouldn't have done (it
gives you a choice of complete uninstall or leaving some functions
there in case you choose to return) because it continued to slow down
my computer. Now, it doesn't show up in my list of programs, but I
know some of it is still there. A friend who knows more than me about
computers went in and just turned off any Kapersky functions
remaining.

I don't think there are anymore viruses around, but still the computer
hangs up to some degree, tends to freeze on an action or function for
a period of time, doesn't handle PalTalk as well as before, of which I
am a regular user, and generally can't handle as many functions as
fast as before.

I have a Dell Vostro 1510 which is about 2 years old I would guess and
with the extra 2 gigs of memory I had installed, I have 4 gigs of RAM.

I'm not an expert in computers, depend on my computer for work and am
hugely in debt, so I'm trying to avoid having to pay someone to do a
reinstall.

I'm hoping you can point me in a direction which will return my
computer to its original zipiness. I often need to have about 25
windows open for the work I do, and with the 4 gigs of RAM it handled
it well before this attack of malware and viruses.

My non-professional opinion is that the computer is very clean now but
something got corrupted or turned around or turned off in dealing with
this malware attack and probably with my screwing around with my
computer.

That's about all I can tell you at this point. If you have questions
that will help assess my computer, please ask.

Thank you very much for your assistance.

Brian Austin
braus...@yahoo.com



FreeFixer v0.62 log
http://www.freefixer.com/
Operating system: Windows XP Service Pack 3
Log dated 2012-05-26 20:46


Winlogon Notify (13 whitelisted)
!SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

AppInit_DLLs
C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

Transport service providers
{E70F1AA0-AB8B-11CF-8CA3-00805F48A192} - mswsock.dll (file is missing)
{9D60A9E0-337A-11D0-BD88-0000C082E69A} - mswsock.dll (file is missing)
{8D5F1830-C273-11CF-95C8-00805F48A192} - mswsock.dll (file is missing)

Namespace service providers (2 whitelisted)
{22059D40-7E9E-11CF-AE5A-00AA00A7112B} - mswsock.dll (file is missing)
{6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83} - mswsock.dll (file is missing)

Browser Helper Objects (10 whitelisted)
{02478D38-C3F9-4efb-9B51-7695ECA05670}, &Yahoo! Toolbar Helper, C:
\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
{5C255C8A-E604-49b4-9D64-90988571CECB}, , (no file specified)
{AA58ED58-01DD-4d91-8333-CF10577473F7}, , (no file specified)
{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}, SingleInstance Class, C:
\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

Internet Explorer toolbars (2 whitelisted)
HKLM\..\Toolbar\{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo!
Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
HKLM\..\Toolbar\Locked - - (no file specified)
HKCU\..\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} - -
(no file specified)
HKCU\..\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} - -
(no file specified)

Basic Internet Explorer settings
HKCU\..\Main, Start Page = http://www.yahoo.com/
HKCU\..\Main, Search Page = http://www.google.com
HKLM\..\Search, SearchAssistant = http://www.google.com/ie
HKCU\..\Desktop\General, Wallpaper = C:\WINDOWS\Web\Wallpaper
\Bliss.bmp

Registry Startups (18 whitelisted)
HKLM\..\Run, Anvi Smart Defender = C:\Program Files\Anvisoft\Anvi
Smart Defender\ASDTray.exe
HKLM\..\Run, QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -
atboottime
HKLM\..\Run, ApnUpdater = c:\program files\ask.com\updater\updater.exe
HKLM\..\Run, Broadcom Wireless Manager UI = C:\WINDOWS
\system32\WLTRAY.exe
HKCU\..\Run, Messenger (Yahoo!) = "C:\PROGRA~1\Yahoo!\Messenger
\YahooMessenger.exe" -quiet
HKCU\..\Run, Advanced SystemCare 5 = "C:\Program Files\IObit\Advanced
SystemCare 5\ASCTray.exe" /AutoStart
HKCU\..\Run, SpybotSD TeaTimer = C:\Program Files\Spybot - Search &
Destroy\TeaTimer.exe

Autostart shortcuts
CNET TechTracker.lnk, , C:\Documents and Settings\Administrator
\Application Data\CBS Interactive\CNET TechTracker\TechTracker.exe

Processes (36 whitelisted)
C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe
C:\WINDOWS\system32\DRIVERS\o2flash.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe
C:\program files\ask.com\updater\updater.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Administrator\Application Data\CBS
Interactive\CNET TechTracker\TechTracker.exe
C:\Program Files\Yahoo!\Companion\Installs\cpn1\ytbb.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASC.exe
C:\Program Files\FreeFixer\freefixer.exe

Application modules (76 whitelisted)
C:\Program Files\Paltalk Messenger\ctrlkey.dll

Services (35 whitelisted)
AdvancedSystemCareService5, Advanced SystemCare Service 5, c:\program
files\iobit\advanced systemcare 5\ascservice.exe
asdsrv, Anvi Smart Defender Realtime Guard Service, c:\program files
\anvisoft\anvi smart defender\asdsrv.exe
o2flash, O2FLASH, c:\windows\system32\drivers\o2flash.exe
wltrysvc, Dell Wireless WLAN Tray Service, c:\windows
\system32\wltrysvc.exe
YahooAUService, Yahoo! Updater, c:\program files\yahoo!\softwareupdate
\yahooauservice.exe

Explorer.exe Modules (110 whitelisted)
C:\Program Files\Paltalk Messenger\ctrlkey.dll
C:\Program Files\Anvisoft\Anvi Smart Defender\ContextMenu_x86.dll
C:\Program Files\BlueSprig\JetClean\JetCleanExtMenu.dll

Winlogon.exe Modules (83 whitelisted)
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
C:\Documents and Settings\Administrator\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
C:\Documents and Settings\Administrator\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
C:\Documents and Settings\Administrator\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
C:\Documents and Settings\Administrator\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
C:\WINDOWS\System32\BCMLogon.dll

IExplorer.exe Modules (148 whitelisted)
C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCommon.dll
C:\Program Files\Google\Google Desktop Search
\GoogleDesktopResources_en.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
C:\Program Files\Paltalk Messenger\ctrlkey.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopAPI2.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
C:\Program Files\Java\jre6\bin\MSVCR71.dll
C:\Program Files\Yahoo!\Messenger\ypagerps.dll
C:\Program Files\Google\Google Desktop Search\gzlib.dll

Drivers (31 whitelisted)
avhips, AntiMalware Host-based Intrusion Prevention System, c:\windows
\system32\drivers\avhips.sys
SASDIFSV, SASDIFSV, c:\program files\superantispyware\sasdifsv.sys
SASKUTIL, SASKUTIL, c:\program files\superantispyware\saskutil.sys

Windows XP Firewall authorized apps (20 whitelisted)
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\Google\Google Earth\plugin\geplugin.exe

Firefox Extensions
I Want This, C:\Documents and Settings\Administrator\Application Data
\Mozilla\Firefox\Profiles\kkvecyk7.default\extensions
\crossrid...@crossrider.com\install.rdf
Microsoft .NET Framework Assistant, C:\Documents and Settings
\Administrator\Application Data\Mozilla\Firefox\Profiles
\kkvecyk7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
\install.rdf
Yahoo! Toolbar, C:\Documents and Settings\Administrator\Application
Data\Mozilla\Firefox\Profiles\kkvecyk7.default\extensions
\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf
Skype Click to Call, C:\Program Files\Mozilla Firefox\extensions
\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\install.rdf
Java Console, C:\Program Files\Mozilla Firefox\extensions\
{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\install.rdf

Recently created/modified files (10 whitelisted)
27 minutes, c:\Documents and Settings\Administrator\Local Settings
\Temporary Internet Files\Content.IE5\E2J7LW3G
\spywareblastersetup46[1].exe
32 minutes, c:\Program Files\SpywareBlaster\SQLite3SB.dll
32 minutes, c:\Program Files\SpywareBlaster\sburlhelper.exe
32 minutes, c:\Program Files\SpywareBlaster\sbautoupdate.exe
32 minutes, c:\Program Files\SpywareBlaster\spywareblaster.exe
32 minutes, c:\Program Files\SpywareBlaster\unins000.exe
32 minutes, c:\Documents and Settings\Administrator\Local Settings
\Temporary Internet Files
\Content.IE5\2E88RBO5\spywareblastersetup46[1].exe
1 hour, c:\Program Files\FreeFixer\Uninstall.exe
1 hour, c:\Documents and Settings\Administrator\Local Settings
\Temporary Internet Files\Content.IE5\E2J7LW3G\freefixersetup[1].exe
7 hours, c:\Documents and Settings\All Users\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
7 hours, c:\Documents and Settings\All Users\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
7 hours, c:\Documents and Settings\Administrator\Application Data
\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
17 hours, c:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
21 hours, c:\Documents and Settings\Administrator\Desktop
\cwshredder.exe
1 day, c:\Documents and Settings\Administrator\Application Data\CBS
Interactive\CNET TechTracker\TechTracker.exe.bak
1 day, c:\Documents and Settings\Administrator\My Documents\Downloads
\CNET TechTracker\CNET_TechTracker_2_1_0_69_Update.exe
1 day, c:\Program Files\FreeFixer\freefixer.exe
2 days, c:\WINDOWS\Installer\MSI18.tmp
2 days, c:\Documents and Settings\Administrator\Application Data\CBS
Interactive\CNET TechTracker\uninst.exe
2 days, c:\Documents and Settings\Administrator\My Documents\Downloads
\revosetup.exe

Csrss.exe virtual memory files (94 whitelisted)
C:\Documents and Settings\Administrator\Local Settings\Temporary
Internet Files\Content.IE5\2E88RBO5\spywareblastersetup46[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary
Internet Files\Content.IE5\E2J7LW3G\freefixersetup[1].exe
C:\Documents and Settings\Administrator\Application Data\CBS
Interactive\CNET TechTracker\TechTracker.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\IObit\Advanced SystemCare 5\DiskScan.exe
C:\Program Files\IObit\Advanced SystemCare 5\AutoCare.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ASD.exe
C:\Program Files\BlueSprig\JetClean\JetCleanExtMenu.dll
C:\program files\Ask.com\Updater\Updater.exe
C:\Program Files\IObit\Advanced SystemCare 5\PerformUpdate.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Google\Google Desktop Search\pdftotext.exe
C:\Program Files\VS Revo Group\Revo Uninstaller\revouninstaller.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe
C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
C:\Program Files\IObit\Advanced SystemCare 5\AutoSweep.exe
C:\Program Files\IObit\Advanced SystemCare 5\RescueCenter.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\AutoUpdate.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASC.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\IObit\Advanced SystemCare 5\DelayLoad.exe
C:\Program Files\IObit\Advanced SystemCare 5\AutoUpdate.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ContextMenu_x86.dll
C:\Program Files\Defraggler\Defraggler.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCTooltips.exe
C:\Program Files\IObit\Advanced SystemCare 5\Reminder.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\WLTRAY.EXE
C:\WINDOWS\system32\drivers\o2flash.exe
C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
C:\Program Files\Paltalk Messenger\h264lib_ipp4.dll
C:\Program Files\Paltalk Messenger\ctrlkey.dll

End of FreeFixer log

[Roger Karlsson]

Hello Brian,

I think you've done a good job cleaning your computer. I could not find
any malware in the log.

When it comes to speeding up a computer I usually do the following:

1. Defragment the hard-drive.
2. Uninstall (or temporarily disable) programs, browser extensions, etc
that I don't currently use.
3. In the Task Manager, I sort on the following columns: CPU, I/O Read
Bytes and I/O Write Bytes, to detect if any program uses lots of cpu or
does lots of reading or writing to disk. (The read/write bytes columns
can be enabled from View -> Select Columns, in the Task Manager)

Hope this helped.

/Roger

> {02478D38-C3F9-4efb-9B51-7695ECA05670},&Yahoo! Toolbar Helper, C:

> C:\Program Files\Spybot - Search& Destroy\TeaTimer.exe

> C:\Program Files\Spybot - Search& Destroy\TeaTimer.exe