Possible Malware - Here are my logs

grsalaska · Aug 10, 2012

Hi,
I've been struggling with diagnosing my XP computer for a week now and I can't seem to determine at this point if it's malware or some other system problem. The symptoms started a couple of months ago with a slowed down boot process - sometimes taking 3 to 4 minutes to boot. After boot and login, it would work normally. The latest issue was an upgrade to ZoneAlarm which really set things back. I am constantly downloading data and files from various public and private sources, so I keep my virus software and firewall up to date. I finally got the newest version of ZoneAlarm running as well as AVG, but then the system really slowed down. I ended up uninstalling both (using their utilities). Now my symptoms include the following:

Very slow boot time - 4 minutes or more;
Delay in start menu - about a minute after first click (I cleared all bad links already).
Stalling/hanging while in start menu.
Stalling when switching between programs - ie Excel and UltraEdit

Each time the system stalls it's about 30 seconds before I regain control.

As you can see, I have shut down all of the extraneous services and startups.

Here are my log files from your malware detection process README. Any help would be greatly appreciated.

Thanks!
John

Kestrel13! · Aug 11, 2012

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run

Please also download MBRCheck to your desktop

Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)

It will show a Black screen with some information that will contain either the below line if no problem is found:

Done! Press ENTER to exit...

Or you will see more information like below if a problem is found:

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.

MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.

grsalaska · Aug 13, 2012

Kestrel13!
Thanks for taking a look at this. Here are two logs - one from TDS and the other from MBRCheck.

John

Kestrel13! · Aug 14, 2012

Not seeing any malware.

As you can see, I have shut down all of the extraneous services and startups.
Click to expand...

Yes and you shouldn't do, not with MSCONFIG anyway, you should use third party software.

What is this {429CAD59-35B1-4DBC-BB6D-1DB246563521}
Click to expand...

<---Relates to Itunes You should not rename files.

Now your turn to tell me, what is this?

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Second Copy"="\"C:\\PROGRA~1\\SecCopy\\SecCopy.exe\""
Click to expand...

grsalaska · Aug 14, 2012

Re: Possible Malware - Followup

Kestrel13!,
Thanks for taking a look at this. It's interesting you noted that I shouldn't rename files - I actually didn't. Hmmm...

SecCopy is Second Copy - a backup utility that runs as a scheduled task to make mirrored copies of selected files, directories, or drives. I had it shut down for most of my testing, but brought it back up a couple of days ago.

Since this isn't a malware issue, I'll have to take other actions - probably a repair of XP. I am also suspicious that my bios may have been corrupted.

Thanks again,
John

Kestrel13! · Aug 14, 2012

No problem.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Possible Malware - Here are my logs

grsalaska Private E-2

Attached Files:

mbam-log-2012-08-09 (12-35-12).txt

HitmanPro_20120810_1107.log

MGlogs.zip

RKreport[1].txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

grsalaska Private E-2

Attached Files:

TDSSKiller.2.7.48.0_13.08.2012_09.48.33_log.txt

MBRCheck_08.13.12_09.56.46.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

grsalaska Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member