HELP!my computer has fallen and cant get up!!!

Re: P.S: HELP!my computer has fallen and cant get up!!!

You should read the tutorial in this Sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log file as an attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT

Make sure you have HJT version 1.98.2 and follow the guidelines on where to install it and how to post a log as an attachment.

 

You have HJT installed incorrectly. Please put it in a directory as requested.

Also you should go to Add/Remove Programs and look for and uninstall:
- WildTangent
- WeatherBug (or similar named)
- Web Offer
- ShopAtHomeBundle (or SAHBundle or similar)

 

After looking for those uninstalls mentioned in my previous message, do the following.

Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).

You should also download LSPFix (http://www.majorgeeks.com/download4180.html) but do not run it yet. We may need it later.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {3AFF3F2B-B541-76BF-8001-665579FB2866} - C:\WINDOWS\System32\qtcd.dll
O2 - BHO: (no name) - {3DF96B2D-E246-2FE8-8250-665579F92B39} - C:\WINDOWS\System32\zlar.dll (file missing)
O4 - HKLM\..\Run: [usxhczyt] C:\WINDOWS\rcwt.exe
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\Owner\LOCALS~1\Temp\bundle.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKCU\..\Run: [Chpa] C:\Documents and Settings\Owner\Application Data\ulas.exe
O4 - HKCU\..\Run: [Ndkwtk] C:\WINDOWS\System32\d?dplay.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.imbum.com/Imbum.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/10469377076b7c4bc106/netzip/RdxIE601.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\System32\qtcd.dll
C:\WINDOWS\rcwt.exe
C:\Documents and Settings\Owner\Application Data\ulas.exe
C:\Program Files\WildTangent <--- the whole directory
C:\Documents and Settings\Owner\Local Settings\Temp\bundle.exe

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You still have HJT in a subfolder of C:\Documents and Settings. You have it here:
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe

We prefer that it not be located there. Try putting in a path like: C:\Program Files\HijackThis\HijackThis.exe

We need a HijackThis log from normal boot mode. Try doing the following:
- boot in normal mode
- rename hijackthis.exe to myhjt.com
- double click on myhjt.com
- if it runs that way, get me a log.

If the above fails to work, do the following:
- Download ProcessExplorer from: http://www.sysinternals.com/files/procexpnt.zip
- Unzip it and now run ProcessExplorer
- We need to configure some options first:
Click View and select Show Lower Pane. And where it says "Lower Pane View" make sure DLL's is checked. Now click on explorer.exe. Now also under the View menu choose "Select columns" and put a check mark on "Image Path".
- Now click on File and then Save As. And save the process list.
- Post it back here as an attachment. Also, from now on if I say to kill a process, use ProcessExplorer instead of Task Manager. Sometimes ProcessExplorer can kill things that Task Manager cannot.

 

I don't see anything bad in your HJT log now. Are you still still having problems?
Have much RAM do you have, what is your processor speed, how big is you hard disk and how much free space is on your hard disk?

You have a lot of processes running. Try shutting some of them down and see if a scan with Spybot speed up. Try ending these processes (only temporarily. I don't want you to uninstall them. Just end them using Task Manager.) (Note: you should not connected to the internet when doing this since I'm asking you to end some processes, like AOL..)

C:\Program Files\AVPersonal\AVGUARD.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe

 

First a note: do not run multiple antivirus applications. I see you had Norton (now you say you uninstalled it) and also AV Personal. You must run only one. Also, do you have multiple, check to make sure you only have one firewall running. I see you upgraded to SP2 along the way. It had a built in firewall that should be disabled if you use any other software firewall application. How did you do the upgrade to SP2 if your PC is so slow? Or did you have a CD with the upgrade?

Please go back on run the online scans that were listed in the READ ME FIRST thread. You have not run them. Did you run Stinger? You should also consider running the items in the Alternative Scans - If still having problems section of that link. I know you are saying things run really slow, but there may be a virus on your PC that does not show in a simple HJT log. We need to locate it.