Computer illiterate...Please help!

Okay, I've been out of town, and couldn't get to my pc until now.

I've run everything everyone suggested, except for the Windows updates, which I will be getting to soon.

I am, unfortunately, still having problems.
Every night, usually after I've been online for a bit, my internet will slow down, and my AIM will kind of freeze up, although both still say I'm online.

After a while, my AIM will tell me it's trying to reconnect because the connection's been interrupted.
My browser window will also begin moving at normal speed again.

It's very odd, since I've run all the virus scans and spybot detection programs that were suggested, and I'm getting clean reads on all of them.

Is this a connection problem, or should I try to find another hijacker or virus?



Thanks!

You need to post another hijackthis log as the tools you ran were only preliminaries :) . There WILL be more to remove.

Hi Jess,

It would be helpful, if you posted information about your computer, such as which operating system you are using. Likewise for anti-virus, and whether or not you are using a software firewall.

Cheers,

Linda

:D :rolleyes: :D

You must consider the Windows updates as top priority. maybe you dont quite understand, simply by being connected without certain patches, windows has vulnerabilities that allow certain viruses to infect it. That means you dont have to do anything such as open emails, go to websites, etc. to get infected, it will just happen and you may not even know it's happened.

As a simple example, if you were to start installing XP from scratch and had a live network cable plugged in, you would quite possibly be infected before the install is complete.

Get that system up to date, quick.

I would like to add that before you run Spybot or adaware make sure to update them..., they don't update the installers that often...

shadow1- it's not as simple as you may think..., there are way to many updates for one using dail-up to download..., I hardly ever update my windows... and I hardly ever have a problem..

I don't even have the Blaster or Sasser patches installed yet..., my firewall does a good enough job with them.., I think that once SP2 comes out I'll bring my computer to a friends house (with DSL) and update it there....

However, it is very important to have a Firewall and AV program running at all times (or at least when you are connected to the internet), and have them update periodically...

I hope this helps,
Byan

Actually, to be on the safe side, Microsoft do have a service whereby they send you out a CD with all the current updates on free of charge. mine came through within 2 weeks.

Jess,

I agree with Shadow1. Your top priority needs to be downloading and installing the critical Windows updates, as well as the updates for your OS.

Go to

http://v4.windowsupdate.microsoft.com/en/default.asp

and then scan your computer and it will tell you which updates that you need to download. Some of the updates have to be downloaded by themselves and once installed, then you must reboot.

I also have dialup and what I do is start the download process before I get ready to retire for the evening.

Go here to do an online Panda anti-virus scan. Panda has software for removing the different viruses and worms, etc.
Although I have previously used Norton AV and McAfee AV, I have been using Panda's Platinum, which includes both the AV as well as the software firewall. I have been using this on all of my computers for the past 3 years and I am very pleased.

http://www.pandasoftware.com/actives..._principal.htm

IMO, there are two AV products that you should stay away from and they are Norton and McAfee.

If you want to take more time to decide which AV and software firewall software that you want to purchase, then here are some freeware alternatives that you can use, until you make those decisions.

Once you have completed this process, then the next thing that you need to do, if you don't have an AV or software firewall, is to download the freeware version of AVG, install it and reboot. When you decide which AV that you are going to purchase, you will have to uninstall the freeware AVG.

http://www.grisoft.com/us/us_dwnl_free.php

Then download the freeware version of Zone Alarm, install it and reboot. When you decide which software firewall that you are going to purchase, you will have to uninstall ZA.

http://www.zonealarm.com/store/conte...tCBO20AAocGXYn!-1273003560!-1062696903!7551!7552!1658765805!-1062696905!7551!7552?lid=ho_za

When you run Ad-Aware, always click the button to check to make sure that you have the latest updates. Then run Ad-Aware, delete anything that it finds and then immunize your system. Reboot your system.

http://www.lavasoftusa.com/

Then run SpyBot, click the button to check to make sure that you have the latest updates. Then run SpyBot, delete anything that it finds, and then immunize your system. Reboot your system.

http://www.safer-networking.org/index.php?page=download

Then run SpywareBlaster, click the button to check to make sure that you have the latest updates. Run SpywareBlaster. Reboot your system.

http://www.javacoolsoftware.com/spywareblaster.html

Ad-Aware and SpyBot identifies spyware already on your system, so that it can be removed.

SpywareBlaster prevents the spyware from being installed on your computer.

You can set your AV software up for live updates. Initially, you may want to run Ad-Aware, SpyBot and SpywareBlaster on a weekly basis. But I am sure that after you run this for 3-6 weeks and your system comes up clean, you will probably decide to do what I do, which is to run them on a monthly basis.

There are two other software packages that I use that I recommend and both are produced by Firetrust, http://www.firetrust.com/.

Mailwasher Pro -- Mailwasher Pro allows the user to preview their email while it is still on your ISP's email server. This allows you to prevent any malware from being downloaded. The problem with most automated spam programs is that these programs generate both false positives and false negatives.

If you have an associate, who sends you email from a new email address, it will be blacklisted. Likewise, some spammers and malware distributers, use the user's email address in the from address. Obviously, you don't want to blacklist your own email address.

I do not allow anything to be downloaded to my computer if it is not someone that I know, a vendor / associate that I deal with, newsletters that I have subscribed to or an email message with substantive content. The other part of safe computing is not going to high risk websites such as music download sites (Kazza, etc.) or porn sites.

Mailwasher has the following email status codes, friend, blacklist, possibly SPAM, possibly legitimate, possible virus.

Benign is the other program and it neutralizes any malware, which may occur as a result of html vulnerabilities or which is embedded in graphic images.

Firetrust has an interesting policy, which is that your purchase of this software entitles you to all future updates.

I have been using this software and following these practices for the past 3 years and to date, none of my computers have been infected with any form of malware.

I hope that this helps.

Cheers,

Linda

:D :rolleyes: :D

Jess,

Pertaining to Hongman's suggestion about the security CD, I do not recommend this approach because the security updates are only through October 2003, so you would still need to run Windows update. Windows Update allows you to select which updates that you want to download and install. For instance, I have chosen not to download or install the Direct X updates because this isn't pertinent to how I use my computer.

Cheers,

Linda

:)

Really? My UpdateCD is dated Feb 2004...

Point is, if you have dialup then you can install the majority of the updates until Feb 2004, then just download the minority. This applies especially with things like Service Packs. The CD covers all updates and SP's for NT, 2000 and XP.

It also comes with EZ Antivirus (do a search on the forum, it comes up highly recommended), with 1 years free subscription.

Up to you, but well worth it in my opinion. Especially if you have dialup.

Regards

Hong

Here is a post from another thread here that is on point to this discussion. The name of the thread is "What "little" program could you simply not do without?" and it is in the "General and Business Software" confence. Here is the link.

http://discussions.virtualdr.com/sh...4614#post824614

Fuelm@n
Content Adviser

Registered: Jan 2002
Location: Texas, USA
Posts: 2568

Startup Inspector for Windows seems to be a cool little tool also.
http://www.windowsstartup.com

Startup Inspector for Windows is a Windows™ platform software that helps Windows™ user to manage Windows™ startup applications. On www.windowsstartup.com, there are more than 4,100 known programs in the database. Startup Inspector for Windows can thus provide a consultative information on the programs that are running at your Windows startup process. Whether a program is necessary to the system, or is the program a spyware.

Scans all programs that are in the Windows Startup Folder, Registry and provide you with a background information of the program.

Remove harmful programs like spyware, virus, dialers, make your system healthier.

Remove unnecessary programs like reminders, monitors, improve your systems performance.

Startup Inspector for Windows is Freeware. If you are satisfied by this little program you can always make appreciation through PayPal.

__________________
"A man would do nothing, if he waited until he could do it so well that no one at all would find fault with what he has done." - Cardinal Newman


05-03-2004 03:15 PM

Quote:

---

Originally posted by LindaHewitt
I also have dialup and what I do is start the download process before I get ready to retire for the evening.

---

*shrug*, I just think that what help are the updates. Even if I have them, I am still going to have my antivirus and my firewall running. There really isn't much point to it in my opinion..., I have not had a problem since that nasty backdoor ache trojan that was causing me problems, which was when I decided to get a firewall.... (and no update fixes that...)

Its true that using a firewall can stop such things as blaster and sasser which feed on Windows vulnerabilities but some are now smart enough to shut down your firewall while it sneaks onto your computer.

Sasser would not have been such a problem worldwide if every XP system was patched. I personally dont use a firewall for several reasons and one being its high use of resources and another is network restrictions. I do agree that a firewall is an additional measure of security and I have used them in the past. But now I feel my router is protection enough, when combined with common sense. I also rarely have my antivirus dynamic scan enabled because it takes so much resource and slows me down.

If it gets to the point of using up so much of your computer's resources just to protect you on the internet, it starts to lose it's appeal.

I've installed the patch, and it's just still slow going with updating everything else.

Unfortunately, the connection is still being very touchy, so updating some of the protection programs ha been tough.

Since everyting I could do has been takn care of, I'll run another HijackThis scan and post the results.

Thanks for listening yet again...:rolleyes:

Here 'tis.

Logfile of HijackThis v1.97.7
Scan saved at 8:13:36 PM, on 6/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\smsc.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\wuammgr32.exe
C:\WINDOWS\System32\landriver32.exe
C:\PROGRA~1\AIM95\aim.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\scrgrd.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\up twice.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://us7.hpwis.com/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Freedom Popup Killer - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Microsoft Update] wuammgr32.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\Run: [LAN Driver] landriver32.exe
O4 - HKLM\..\Run: [regsrv] scvhost.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuammgr32.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\RunServices: [LAN Driver] landriver32.exe
O4 - HKLM\..\RunServices: [regsrv] scvhost.exe
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Microsoft Update] wuammgr32.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKCU\..\Run: [LAN Driver] landriver32.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] smsc.exe
O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] smsc.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: MktBrowser (HKLM)
O9 - Extra 'Tools' menuitem: MarketBrowser (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...152.7921296296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{307CFA87-D74F-439A-8A16-3D07D3FB7F40}: NameServer = 63.90.67.10 63.90.67.11

Internet Exploder should be closed when scanning with HJT. Also, I cannot see where hijackthis is running from. It should be in it's own, permanent folder before fixing any of the following.

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked' :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [Microsoft Update] wuammgr32.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\Run: [regsrv] scvhost.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuammgr32.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\RunServices: [regsrv] scvhost.exe
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [Microsoft Update] wuammgr32.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] smsc.exe
O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] smsc.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe

O9 - Extra button: MktBrowser (HKLM)
O9 - Extra 'Tools' menuitem: MarketBrowser (HKLM)

Reboot into safe mode following the instructions here & navigate to & delete the following if found:

C:\WINDOWS\System32\wuammgr32.exe< file
C:\WINDOWS\System32\scrgrd.exe< file

C:\Program Files\VBouncer< folder

Reboot normally.
Please locate the following file, right click on it & select properties. Please copy as much info as you can get from it back here.
C:\WINDOWS\System32\landriver32.exe< file

Go here for an on-line scan & set it to autoclean for you.

Post a new log with your reply please.