Computer grinding toahalt

W

Wits End 18 years ago

Recently, I have found that my laptop almost gives upon me - it takes an age to start up, seems to have something draining the memory, refuses to allow AdAware to update and generally slows down until it is virtually unusable. And it's getting worse!

Can anyone suggest whether or not malware is the issue?

The Hijack this thread is below.

Cheers

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:32:42, on 26/08/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal

Running processes: C:\\WINDOWS\\System32\\smss.exe C:\\WINDOWS\\system32\\winlogon.exe C:\\WINDOWS\\system32\\services.exe C:\\WINDOWS\\system32\\lsass.exe C:\\WINDOWS\\System32\\ibmpmsvc.exe C:\\WINDOWS\\system32\\svchost.exe C:\\WINDOWS\\System32\\svchost.exe C:\\WINDOWS\\system32\\svchost.exe C:\\WINDOWS\\system32\\S24EvMon.exe C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe C:\\WINDOWS\\Explorer.EXE C:\\WINDOWS\\system32\\spoolsv.exe C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgamsvr.exe C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgupsvc.exe C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe C:\\WINDOWS\\system32\\CTsvcCDA.EXE C:\\Program Files\\Common Files\\EPSON\\EBAPI\\SAgent2.exe C:\\Program Files\\IBM\\IBM Rapid Restore Ultra\\rrpcsb.exe C:\\WINDOWS\\System32\\QCONSVC.EXE C:\\WINDOWS\\system32\\RegSrvc.exe C:\\WINDOWS\\System32\\svchost.exe C:\\WINDOWS\\system32\\TpKmpSVC.exe C:\\WINDOWS\\system32\\tp4serv.exe C:\\WINDOWS\\system32\\igfxtray.exe C:\\WINDOWS\\system32\\hkcmd.exe C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe C:\\Program Files\\ThinkPad\\PkgMgr\\HOTKEY\\TPONSCR.exe C:\\Program Files\\ThinkPad\\PkgMgr\\HOTKEY_1\\TpScrex.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.Exe C:\\WINDOWS\\system32\\dla\\tfswctrl.exe C:\\IBMTOOLS\\UTILS\\ibmprc.exe C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCTRAY.EXE C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE C:\\WINDOWS\\system32\\RunDll32.exe C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\rundll32.exe C:\\Program Files\\TCM\\TCM Mouse Only\\MouseDrv.exe C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S10IC2.EXE C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe C:\\Program Files\\Trust\\GM-4200 Gamer Mouse Optical\\Panel.exe C:\\Program Files\\iTunes\\iTunesHelper.exe C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe C:\\WINDOWS\\system32\\ctfmon.exe C:\\Program Files\\Digital Line Detect\\DLG.exe C:\\Program Files\\iPod\\bin\\iPodService.exe C:\\PROGRA~1\\MOZILL~1\\FIREFOX.EXE C:\\Program Files\\HijackThis.exe

R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL =

formatting link

- HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page =

formatting link

- HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL =

formatting link

- HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL =

formatting link

- HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page =

formatting link

- HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page =

formatting link

- HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Window Title = Internet Explorer Provided By Sky Broadband R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

- C:\\Program Files\\Adobe\\Acrobat 7.0\\ActiveX\\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\\WINDOWS\\system32\\dla\\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\Program Files\\Java\\jre1.6.0_02\\bin\\ssv.dll O4 - HKLM\\..\\Run: [S3TRAY2] S3Tray2.exe O4 - HKLM\\..\\Run: [TrackPointSrv] tp4serv.exe O4 - HKLM\\..\\Run: [IgfxTray] C:\\WINDOWS\\system32\\igfxtray.exe O4 - HKLM\\..\\Run: [HotKeysCmds] C:\\WINDOWS\\system32\\hkcmd.exe O4 - HKLM\\..\\Run: [TPKMAPHELPER] C:\\Program Files\\ThinkPad\\Utilities\\TpKmapAp.exe -helper O4 - HKLM\\..\\Run: [TPHOTKEY] C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe O4 - HKLM\\..\\Run: [TP4EX] tp4ex.exe O4 - HKLM\\..\\Run: [EZEJMNAP] C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.Exe O4 - HKLM\\..\\Run: [UC_Start] C:\\Program Files\\IBM\\Updater\\\\ucstartup.exe O4 - HKLM\\..\\Run: [UpdateManager] "C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe" /r O4 - HKLM\\..\\Run: [dla] C:\\WINDOWS\\system32\\dla\\tfswctrl.exe O4 - HKLM\\..\\Run: [IBMPRC] C:\\IBMTOOLS\\UTILS\\ibmprc.exe O4 - HKLM\\..\\Run: [QCTRAY] C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCTRAY.EXE O4 - HKLM\\..\\Run: [QCWLICON] C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE O4 - HKLM\\..\\Run: [BMMGAG] RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor O4 - HKLM\\..\\Run: [BMMLREF] C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.EXE O4 - HKLM\\..\\Run: [BMMMONWND] rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\\..\\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\\..\\Run: [WireLessMouse] C:\\Program Files\\TCM\\TCM Mouse Only\\MouseDrv.exe O4 - HKLM\\..\\Run: [SunJavaUpdateSched] "C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe" O4 - HKLM\\..\\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe O4 - HKLM\\..\\Run: [TkBellExe] "C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe" -osboot O4 - HKLM\\..\\Run: [AVG7_CC] C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP O4 - HKLM\\..\\Run: [EPSON Stylus C42 Series] C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42" O4 - HKLM\\..\\Run: [ZoneAlarm Client] "C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe" O4 - HKLM\\..\\Run: [Trust Gaming mouse] "C:\\Program Files\\Trust\\GM-4200 Gamer Mouse Optical\\Panel.exe" O4 - HKLM\\..\\Run: [QuickTime Task] "C:\\Program Files\\QuickTime Alternative\\qttask.exe" -atboottime O4 - HKLM\\..\\Run: [iTunesHelper] "C:\\Program Files\\iTunes\\iTunesHelper.exe" O4 - HKLM\\..\\Run: [NoteBurner] C:\\Program Files\\NoteBurner\\VTBurnerGUI.exe /silence O4 - HKCU\\..\\Run: [Creative Detector] C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe /R O4 - HKCU\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\ctfmon.exe O4 - HKCU\\..\\Run: [MsnMsgr] "C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe" /background O4 - HKUS\\S-1-5-19\\..\\Run: [AVG7_Run] C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\\S-1-5-20\\..\\Run: [AVG7_Run] C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\\S-1-5-18\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\\.DEFAULT\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.6.0_02\\bin\\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.6.0_02\\bin\\ssv.dll O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} -

formatting link

(file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe (file missing) O11 - Options group: [JAVA_IBM] Java (IBM) O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{07AD21C6-CBEE-4CAB-88F1-80178860B5B4}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{2ED3D74B-4B9F-4652-9C3A-1B707CDBFB25}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{5286690A-2E52-4528-B337-FD593684B538}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{562D2C36-B2EB-4533-9C12-B5F19DB1AF86}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{67193EE9-EB56-433C-BC2D-988DDAC712FE}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{7D8B2982-5E72-4A6F-BA9D-C1DE2CBB12ED}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{B04C4B4A-1F4D-426E-8815-857288BD0E3E}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CS1\\Services\\Tcpip\\Parameters: NameServer =

85.255.113.132
85.255.112.84 O17 - HKLM\\System\\CS1\\Services\\Tcpip\\..\\{07AD21C6-CBEE-4CAB-88F1-80178860B5B4}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CS2\\Services\\Tcpip\\Parameters: NameServer =
85.255.113.132
85.255.112.84 O17 - HKLM\\System\\CS2\\Services\\Tcpip\\..\\{07AD21C6-CBEE-4CAB-88F1-80178860B5B4}: NameServer = 85.255.113.132,85.255.112.84 O17 - HKLM\\System\\CCS\\Services\\Tcpip\\Parameters: NameServer =
85.255.113.132
85.255.112.84 O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\\WINDOWS\\system32\\CTsvcCDA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\\Program Files\\Common Files\\EPSON\\EBAPI\\SAgent2.exe O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\\Program Files\\IBM\\IBM Rapid Restore Ultra\\rrpcsb.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\\WINDOWS\\System32\\ibmpmsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\\WINDOWS\\system32\\PsaSrv.exe (file missing) O23 - Service: QCONSVC - IBM Corp. - C:\\WINDOWS\\System32\\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\\WINDOWS\\system32\\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\\WINDOWS\\system32\\S24EvMon.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\\WINDOWS\\system32\\TpKmpSVC.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe

-- End of file - 10549 bytes

Vote

S

Sebastian G. 18 years ago

And you wonder? Your system is loaded full of s*it.It is infected with IBM driver stuff, Epson printer s*it, Creative driver s*it, a mouse driver, well known malware like ZoneAlarm, GMail Notifier, MSN Messenger, RealPlayer and iTunes. Your IE was hijacked by SkyBroadband and Yahoo after the system has been rooted.

Nothing else than being utterly broken is to be expected.

Vote

W

Wits End 18 years ago

****.It is infected with

Yeah, I wondered. I didn't realise that just asking for help would prompt that type of response. How helpful.

Vote

B

Bud 18 years ago

Expect it from Sebastian who knows no good software. :-)

Vote

A

alf 18 years ago

These are malicius DNS servers, usually seen in a case of malware infection.

Beside this, I don't see any other malicius process. So Hijackthis is either tricked by malware (try to rename hijackthis executable), or you have running rootkit or process infector. These DNS servers show that your system is compromised, i.e. your computer is *infected*

Disconnect from internet ASAP, flatt and rebuild your system (format then clean installation).

formatting link

Vote

C

Chilly8 18 years ago

RealPlayer is NOT malware.

Vote

S

Sebastian G. 18 years ago

I know a lot of good software. However, in this case it's only important to know bad software. All of the mentioned one are highly suspectible to cause the described symptoms.

And yes, usually bad software is a much more reasonable explanation than malware.

Vote

S

Sebastian G. 18 years ago

- puts a useless tray icon into the notification area

- always bogs around with file associations

- highly complex configuration, and if you don't access it through the control panel applet it will connect to the net without any chance to cancel

- annoys with a lot of advertisement

- limits your ability to save streams based upon a flag without offering any choice

- hogs system resources like hell

Definitely malicious behaviour with the matching intend behind.

Vote

C

Chilly8 18 years ago

However, it is what is required if you want to listen to music from many Internet radio stations, and with one deal the RIAA concluded America, many internet stations will have to use anti-streamripping technology only found in RealPlayer or Windows Media Player, so you network admins had better get used to your users downloading and/or installing either Windows Media Player or RealPlayer on their workstations.

And dont forger, with the one subscription anonymity service, in Bajamar, Mexico, back on line, it once again enables to ability to hide what you are doing becuase the traffic is encrypted until it reaches the node you are connecting through, where it is then decrypted and sent to whatever site you are requesting.

Vote

S

Sebastian G. 18 years ago

Bullshit. VideoLanClient exists, MPlayer exists.

Or almost any stream-ripping tool.

Vote

C

Chilly8 18 years ago

Well, DRM-protected streams require either WMP or Real Player to listen. ]

However, a change to the DMCA, made last year, now makes personal use of cracks illegal. Prior to Octoner of last year, personal use of cracks was not illegal, but the DMCA was amended to change that.

It is that change that makes it illegal for employer to try and figure out what is going on, if somoene is listening to a DRM- protected stream, as any attempt to crack the encryption is a felony crime in America, Sweden, and Britain. It is now illegal to crack DRM for any reason, including monitoring of employees.

Vote

J

Jamin Davis 18 years ago

I think a complete reinstall is your only option. And go easy on the add-ons, hey, why not try Linux this time round? You know you'll love it :).

Vote

S

Sebastian G. 18 years ago

No. DRM-protected streams requires a virtual machine running a Windows installation with horribly insecurity and misconfiguration, plus an audio recording application in the host OS.

This is no crack. It is about using a computer as what it is: an universal calculation machine. Just this fact alone disproves the claim of any kind of protection.

Oh, so you enjoy spreading this bullshitty propaganda?

LOL? DRM is illegal and therefore doesn't enjoy any legal protection. Besid ethat, we're talking about typical computers, where by definition no copy protection scheme can exist at all.

Vote

K

Kayman 18 years ago

Once done > run HijackThis > save a scan log and post it to /any/ of the following (expert) forums for analysis.

*Note, //registration// *is* required prior to posting a log.

- Not listed in any particular order -

formatting link

Vote

A

Ansgar -59cobalt- Wiechers 18 years ago

Or he could not post the log to any of those forums and just use [1] instead. However, I agree with @lf that the nameservers look really fishy (the addresses belong to an ukrainian hosting company), so I second the suggestion to flatten and rebuild the box.

[1]

formatting link

cu 59cobalt

Vote

C

Chilly8 18 years ago

DRM is is legal, and is protected by the DMCA. Any attempt to crack, sniff, or analise DRM, in the U.S., is illegal. As far as the Feds are concerned DRM is protected under the DMCA.

Vote

C

Chilly8 18 years ago

Windows is a MUST for computing existence. The colleges drum it into the students from day 1 that Bill Gates is GOD when it comes to computing. You cannot do anything without Windows.

Vote

M

Mr. Arnold 18 years ago

formatting link

;-)

Vote

S

Sebastian G. 18 years ago

DRM is about tricking the user to install a malicious software that illegaliy enforces unlawful restrictions against the user. Clearly illegal.

LOL? How should it? My sour gerkies aren't protected by the DCMA either.

Vote

C

Chilly8 18 years ago

The DMCA says otherwise. And also software license agrrements say so. One thing that is slowing the migration to Vista is a clause that says that you will activate the product and "assign" it to a device, and not do anything like bomb your hard disk and reinstall Vista every 30 days (like a lot of people do with XP), or attempt to use any cracks, such as WPA_KILL. The software agreement makes it legal, so its legal. The EULA is a legally binding agreement, so Microsoft has the right to impose its version of DRM on Vista users, becuase its written into the agreement and enforceable under the DMCA.

The DMCA and/or software EULAs make such practices legal.

Of course, since you are in Germany, where the are is no DMCA-like law (yet), you can circumvent DRM to your hearts content, and the software the music companies cant do anything about it, as long as its for your own personal use,' but users in the U.S., U.K., Australia and Sweden ARE subject to these laws, and Microsoft is ALLOWED to enforce such agreements, BY LAW in those countries.

In the U.S, U.K, Australia, and Sweden, DRM is legal and protected by DMCA-type laws.

Vote

Computer grinding toahalt

Join the Discussion

Didn't find your answer?