Hi all i'm new to the fourm and need someone to decipher a hijackthis log file PLZ!!

[Snatch98]

My little sister recently graduated College and her lap top has been having technical difficulties if you will. It's pretty laggy most of the time. It constantly adjusts the virtual memory and i'm sure there are some underlying issues that I can't detect due to my untrained eye. I've defragged it, run a few different virus scans AVG & AVG anti-spyware. I've also run Ad-ware SE, Counter spy and Avast as well as CC Cleaner.

Here is the AVG LOG:

AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 1:15:42 PM 5/19/2007
+ Scan result:

E:\Documents and Settings\valecia yockey\Cookies\valecia_yockey@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
E:\Documents and Settings\valecia yockey\Cookies\valecia_yockey@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
E:\Documents and Settings\valecia yockey\Cookies\valecia_yockey@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.

::Report end

And now the Hijackthis log file:

Logfile of HijackThis v1.99.1
Scan saved at 3:29:59 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\System32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\system32\carpserv.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
E:\Program Files\Common Files\AOL\1163563665\ee\AOLSoftware.exe
E:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
E:\Program Files\Windows Media Player\WMPNSCFG.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
E:\Program Files\Microsoft Office\Office\OSA.EXE
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Microsoft Office\Office\FINDFAST.EXE
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\ntvdm.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Documents and Settings\valecia yockey\Desktop\Spyware & Virus Removal Tools\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HostManager] E:\Program Files\Common Files\AOL\1163563665\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] E:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [Google Desktop Search] "E:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SBCSTray] E:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Aim6] "E:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] E:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Office Startup.lnk = E:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = E:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: HP Image Zone Fast Start.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Yahoo! Search - file:///E:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///E:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///E:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///E:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,4938/mcfscan.cab
O20 - AppInit_DLLs: E:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: GoogleDesktopManager - Google - E:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - E:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe

Thanks for any and all help that can be provided. I really appreciate it.

[Snatch98]

I can also install and run the MacAfee Anti Virus if necessary. It's available to me via my Universities help desk.

[Snatch98]

I'll be checking back most of the evening and into tomorrow. It's worlds better now than it was when I first got it from her. However it's still having it's occasional issue and doesn't seem to be running as smoothly as it should.

It's a relatively old lap top around 4 years, but it has a new harddrive. She somehow fried the first. Please any and all help would be greatly appreciated. I'm trying to get this thing as clean as possible.

[kylethedarkn]

Nothing Malicious in the log. I'm guessing the laggyness is just from too many process running at once or too much space is taking up by uneeded programs.

Heres a couple things you can do to help with that.

Go to the start menu and then run. Type "msconfig"(without the quotes) into the box. Now go to the startup tab. Uncheck any boxes that have programs next to them that dont need to load when you first turn the computer on, such as QuickTime Task, or microsoft office. This will make the computer turn on faster.

Now i would like you to download and install the following program to delete temp files and folder you don't need.

Begin by downloading CCleaner, and specifically choosing the most recent version.

Then, follow these steps:

1. Close all programs so that you are at your desktop.
2. Double-click on the "My Computer" icon.
3. Select the "Tools" menu and click "Folder Options".
4. After the new window appears select the "View" tab.
5. Place a checkmark in the checkbox labeled "Display the contents of system folders".
6. Under the "Hidden files and folders" section select the radio button labeled "Show hidden files and folders".
7. Remove the checkmark from the checkbox labeled "Hide file extensions for known file types".
8. Remove the checkmark from the checkbox labeled "Hide protected operating system files". 9. Press the "Apply" button and then the "OK" button and shutdown My Computer.
10. Now your computer is configured to show all hidden files.

Now, install the program. Open it, and choose the 'Options' tab. Inside, hit the 'Custom' tab, and add the following folders (Note: Not all of these files are on every computer. If one of these isn't present, skip it):

C:\Windows\Temp
C:\Temp
C:\Documents and Settings\<Every user listed>\Local Settings\Temp
C:\Documents and Settings\<Every user listed>\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\<Every user listed>\Local Settings\History
C:\Documents and Settings\<Every user listed>\Cookies
C:\Windows\Prefetch

After doing this, move back to the 'Cleaner' tab, and inside this, be sure your open to the 'Windows' tab. Inside, check the box labeled 'Custom Files and Folders'.

Next, after following all of these steps, you're ready to scan. Run scans in both the 'Cleaner' and 'Issues'. Note: It might take several scans in each to remove all of the junk.

I would also advise that you and your sister go through C:/Programfiles/ and My documents and delete anything that isn't needed anymore. Also run CCleaner after you do this. Hope this helps speed up the comp a little.

[vundofixer]

What is the Operating System version and patch level, processor type and speed, and how much RAM is in the system?

[Snatch98]

Thank you for responding. I've run CCleaner at least once prior to posting this and it seemed to have worked wonderfully. I'll run it a few more time and also reconfigure the CPU and see if that helps like you said Kyle. I initially chalked it up to processing speed and lack of ram but wanted to make sure there wasn't anything malicious hence the reason I posted this thread.

Vundo,

The operating system is Windows XP Home Edition. *Version 2002
Service Pack 2
Processor Mobile AMD athlonXP220+ 518 MHz, RAM 192mb

It's an older CPU and at the time of purchase seveal years ago was a fairly decent lap top i guess. It still serves it's puropose currently so it's not a big deal. Essentially internet surfing & research and word processing.

THank again for the replies.

[kylethedarkn]

I can see why it was being so slow. All those processes running with only 192 MegaBytes of RAM. If you want you can mark this thread as solved.(Theres a link under most current post)

[Snatch98]

Where is the best place to go and pick up additional RAM. I know a few of the main CPU chain type stores like COMPUSA will run promotions etc, is there anywhere online that most turn for such needs? Additionally if more ram is added to the Laptop what do you think would be a good number? Just a bump to 512 or something more significant?

[kylethedarkn]

Theres a pretty good site i found called tigerdirect.com. It sells everything factory direct and has tons of memory chips that you could get pretty cheap. I would recommend you get 512mb to 1G or ram. 1G would make your computer extremely fast. On tiger direct you can get a Gig for around 50-60 dollars.

[aioiddy]

many thanks for the valuable information
-----------------------------------------
Shareware
http://www.mostshareware.org

[gerbil]

Snatch, she has two resident AV services running. That is not at all for the good, cos they interfere terribly - you must remove one of them AVG7 or Avast.. you choose. I certainly would not load up another one.... Apart from that she is clean.
I would hope that just one AS service would suffice - they do not interfere but they both run so there goes more RAM and CPU time.... AVG AS or Defender - I suggest one should go. I can see CounterSpy sitting in there also. I run AVG AS on demand only, about once every couple of months is all I can bear....Spywareblaster fends off a lot.
128 MB of RAM is okay for XP, 512MB is naturally better, but it costs. You could do a lot to help by removing all those autostart entries - they stay resident and chew up valuable ram space. Some just waste connection time.
eg:
Google and Yahoo toolbars, browser helpers and desk-search - does she need them? Google runs very nicely from its website... I see there is also a google updater service running....
O4 - HKLM\..\Run: [CARPService] carpserv.exe : this one lets you hear the modem squeal.... and does nothing else.
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime : this checks for quicktime updates. Every logon.....??!
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe : ditto for HP software.
OFFICE, yeah she's a student, and HP imaging she may be happy to keep on fast start.... but gee, how often does she scan or print?
Windows Media Player\WMPNSCFG.exe is the media player network share... if you wish to be rid of it it requires a registry tweak...
Remember, one Resident AV only.