Page 1 of 6 12345 ... LastLast
Results 1 to 10 of 57

Thread: Slos scanspeed

  1. #1
    Member
    Join Date
    Mar 2006
    Posts
    50

    Default Slos scanspeed

    Looking for help to increase scanspeed with Spybot S&D and get rid other problems

    System Info:

    Dell Dimension L933r
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Pentium 3
    127.0 MB RAM

    Computer won't let me run online scans, due to ActiveX controls
    Have not yet been able to complete a Spybot Scan due to time.

    Below is my Spybot Log, if HJ log is needed as well, please advise.

  2. #2
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Welcome woodchips

    Please go here and follow instructions.
    http://forums.spybot.info/showthread.php?t=288
    Post the Hijackthis log here in this thread.
    Someone will then take a look at the system and advise you.

  3. #3
    Member
    Join Date
    Mar 2006
    Posts
    50

    Default

    Quote Originally Posted by LonnyRJones
    Welcome woodchips

    Please go here and follow instructions.
    http://forums.spybot.info/showthread.php?t=288
    Post the Hijackthis log here in this thread.
    Someone will then take a look at the system and advise you.

    That thread was closed. Please see new thread
    http://forums.spybot.info/showthread...6504#post16504

  4. #4
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,516

    Default

    Hello.
    The closed link Lonny gave to you contains information for posting in this forum.
    It is not open for members to post into.

    Please post your log into this topic. Thank you.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  5. #5
    Member
    Join Date
    Mar 2006
    Posts
    50

    Default HJT Log Per Request

    Per your request, here is my HJT Log. Thanks for the help.


    Logfile of HijackThis v1.99.1
    Scan saved at 6:11:09 PM, on 3/21/2006
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\WINDESKTOP.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\HIJACK THIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
    R3 - Default URLSearchHook is missing
    O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL
    O2 - BHO: Class - {64CA2686-435D-CB6D-1C4F-78D558954130} - C:\WINDOWS\WINPT32.DLL
    O2 - BHO: AuthBHO.cBHO - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - C:\PROGRAM FILES\COX\APPLICATIONS\APP\AUTHBHO.DLL
    O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {C6F6E45B-5927-4D51-AE66-FF4E09AC67DB} - C:\WINDOWS\SYSTEM\CHLM.DLL
    O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9620D33362C1} - C:\PROGRAM FILES\COX\APPLICATIONS\APP\AUTHBHO.DLL
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
    O4 - HKLM\..\Run: [windesktop] C:\WINDOWS\SYSTEM\windesktop.exe
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O4 - HKLM\..\RunServices: [windesktop] C:\WINDOWS\SYSTEM\windesktop.exe
    O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKCU\..\Run: [windesktop] C:\WINDOWS\SYSTEM\windesktop.exe
    O4 - Startup: Shortcut to SPOOL32.EXE.lnk = C:\WINDOWS\SYSTEM\SPOOL32.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm
    O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm
    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
    O9 - Extra button: Dell Home - {63D9F689-FA15-4ECF-91BC-C4D0734E14EA} - http://www.dellnet.com (file missing) (HKCU)
    O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab
    O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
    O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\nosuch.mht!http://2awm.com/pop/chm/sext2sp.chm::/on-line.exe
    O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://008i.com/pic//x.chm::/open.exe
    O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
    O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
    O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18c21878...p/RdxIE601.cab
    O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
    O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
    O18 - Filter: text/html - {1F329E35-E353-4D72-93A6-9048ACDCB67A} - C:\WINDOWS\SYSTEM\CHLM.DLL
    O18 - Filter: text/plain - {1F329E35-E353-4D72-93A6-9048ACDCB67A} - C:\WINDOWS\SYSTEM\CHLM.DLL
    O21 - SSODL: OLE Module - {0656A137-B161-CADD-9777-E37A75727E78} - C:\WINDOWS\SYSTEM\abirvalg32.dll
    O21 - SSODL: hbeUYKE - {07D00A18-AD7A-A0B2-CACC-77B04D7E07DE} - C:\WINDOWS\SYSTEM\PZRKD.DLL

  6. #6
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Start Hijackthis and place a check next to ONLY these items If there.
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankInternet
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {64CA2686-435D-CB6D-1C4F-78D558954130} - C:\WINDOWS\WINPT32.DLL
    O4 - HKLM\..\Run: [windesktop] C:\WINDOWS\SYSTEM\windesktop.exe
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O4 - HKLM\..\RunServices: [windesktop] C:\WINDOWS\SYSTEM\windesktop.exe
    O4 - HKCU\..\Run: [windesktop] C:\WINDOWS\SYSTEM\windesktop.exe
    O4 - Startup: Shortcut to SPOOL32.EXE.lnk = C:\WINDOWS\SYSTEM\SPOOL32.EXE
    O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab
    O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
    O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\nosuch.mht!http://2awm.com/pop/chm/sext2sp.chm::/on-line.exe
    O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://008i.com/pic//x.chm::/open.exe
    O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
    O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
    O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18c21878...p/RdxIE601.cab
    O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
    O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe

    O21 - SSODL: OLE Module - {0656A137-B161-CADD-9777-E37A75727E78} - C:\WINDOWS\SYSTEM\abirvalg32.dll
    O21 - SSODL: hbeUYKE - {07D00A18-AD7A-A0B2-CACC-77B04D7E07DE} - C:\WINDOWS\SYSTEM\PZRKD.DLL
    ====================================
    Hit fix checked and close Hijackthis.
    Restart the PC
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Rn aboutbuster, save the log to post later.
    If prompted to restart the pc do so

    Start Hijackthis and place a check next to these items If there.
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankInternet
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {C6F6E45B-5927-4D51-AE66-FF4E09AC67DB} - C:\WINDOWS\SYSTEM\CHLM.DLL
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O18 - Filter: text/html - {1F329E35-E353-4D72-93A6-9048ACDCB67A} - C:\WINDOWS\SYSTEM\CHLM.DLL
    O18 - Filter: text/plain - {1F329E35-E353-4D72-93A6-9048ACDCB67A} - C:\WINDOWS\SYSTEM\CHLM.DLL
    ====================================
    Hit fix checked and close Hijackthis.

    Post a a new hijackthis and that first about buster log.

  7. #7
    Member
    Join Date
    Mar 2006
    Posts
    50

    Default New hijackthis log and first about buster log

    Logfile of HijackThis v1.99.1
    Scan saved at 1:14:50 PM, on 3/22/2006
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\TEMP\UECNTBDP.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\HIJACK THIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
    O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL
    O2 - BHO: AuthBHO.cBHO - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - C:\PROGRAM FILES\COX\APPLICATIONS\APP\AUTHBHO.DLL
    O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9620D33362C1} - C:\PROGRAM FILES\COX\APPLICATIONS\APP\AUTHBHO.DLL
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
    O9 - Extra button: Dell Home - {63D9F689-FA15-4ECF-91BC-C4D0734E14EA} - http://www.dellnet.com (file missing) (HKCU)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O21 - SSODL: hbeUYKE - {07D00A18-AD7A-A0B2-CACC-77B04D7E07DE} - C:\WINDOWS\SYSTEM\PZRKD.DLL

  8. #8
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Scan and fix this item with hijackthis
    O21 - SSODL: hbeUYKE - {07D00A18-AD7A-A0B2-CACC-77B04D7E07DE} - C:\WINDOWS\SYSTEM\PZRKD.DLL

    Had you missed it or has it returned ?

    Post a report from one or better yet both of these free online scanners

    Panda ActiveScan-Free online scanner,
    http://www.pandasoftware.com/products/activescan.htm
    Save the report and post it back here please if there are any that it is unable to deal with.


    Kaspersky Lab - Free Online scan:
    http://www.kaspersky.com/virusscanner
    Click scan settings and place a check next to use [x]extended this database etc etc. Click ok.
    Then choose: my computer: scan all your hard drives and mapped disks.
    when finished click save as text and post that in your reply.

    You have been using msconfig, I need you to re-able anything you have disabled since the problems started then make and post another hijackthis log
    But dont restart the PC yet..

  9. #9
    Member
    Join Date
    Mar 2006
    Posts
    50

    Default It keeps returning

    I have deleted it with hijackthis, three times, but it keeps returning.
    O21 - SSODL: hbeUYKE - {07D00A18-AD7A-A0B2-CACC-77B04D7E07DE} - C:\WINDOWS\SYSTEM\PZRKD.DLL

    I will try the online scans next

  10. #10
    Member
    Join Date
    Mar 2006
    Posts
    50

    Default Panda-ActiveScan

    Panda-ActiveScan: performed scan, but would not disinfect. See log below

    Kaspersky Lab - would not work. It didn't even initalize

    Additional issue now: Can open my computer but when I click on the hard drive no icons appear. It says I still have objects in the lower left hand corner, but nothing is visible. My Documents is still OK, and all files and extensions are marked to be visible. Only happened after trying to run Kaspersky Lab. Please advise.


    Incident Status Location

    Potentially unwanted tool:Application/BrilliantDigital Not disinfected C:\WINDOWS\SYSTEM\bdedata2.dll
    Potentially unwanted tool:Application/BrilliantDigital Not disinfected C:\WINDOWS\SYSTEM\bdeinsta2.dll
    Potentially unwanted tool:Application/BrilliantDigital Not disinfected C:\WINDOWS\SYSTEM\bdeinstall.exe
    Adware:Adware/IdeskBar Not disinfected C:\WINDOWS\SYSTEM\howiper.exe
    Adware:Adware/Spoon Not disinfected C:\WINDOWS\SYSTEM\favset.exe
    Adware:adware/searchaid Not disinfected C:\WINDOWS\SYSTEM\sdkxp32.exe
    Virus:Trj/Downloader.CME Not disinfected C:\WINDOWS\SYSTEM\xdldr24.exe
    Adware:adware/cws.aboutblank Not disinfected C:\WINDOWS\SYSTEM\crhz32.dll
    Adware:adware/cws.008k Not disinfected C:\WINDOWS\SYSTEM\syssy.dll

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •