Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Infected with something slowing down my PC

  • This topic is locked This topic is locked
2 replies to this topic

#1 hkoncke


  • Members
  • 2 posts
  • Local time:08:03 PM

Posted 04 March 2011 - 10:11 AM

Hello from Uruguay, and thanks a lot in advance for whatever you can do to help me.
Since a couple of months, I have been noting my laptop running slower and lazy, specially during startup time.
Immediately after booting the "starting Windows" screen appears and lingers there for a minute or so; after that, it blanks out, and after a too long while, the login interface finally appears.
Then, after logging in, some other 4 to 5 minutes go before I can do anything with my computer. The wallpaper appears, ande then, slowly, very slowly, one by one, icons start to be shown, and then a program I run at startup (PostIt Notes Lite), manages to start.

I have running McAfee Internet Security, updated daily, I have a border router for my Internet connection, and I've run a lot of tools looking for malware, rootkits and the like, with negative results. But ... last night I grabbed the mouse tail: running Active Ports I detected a covert connection to vip1.G-anycast1.cachefly.net. I googled it, and that's how I got to your page and forums.
Now I did all my homework previously to contact you, so I hope you can help me somehow with this.
Here's the DDS log file:

DDS (Ver_10-12-12.02) - NTFSx86
Run by papato at 8:57:39,25 on 04/03/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.34.3082.18.1012.562 [GMT -2:00]

AV: McAfee Anti-Virus y Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Archivos de programa\iolo\Common\Lib\ioloServiceManager.exe
C:\Archivos de programa\McAfee\SiteAdvisor\McSACore.exe
C:\Archivos de programa\Archivos comunes\McAfee\McSvcHost\McSvHost.exe
C:\Archivos de programa\Archivos comunes\McAfee\SystemCore\mfevtps.exe
C:\Archivos de programa\Sony\PMB\PMBDeviceInfoProvider.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Archivos de programa\Archivos comunes\McAfee\SystemCore\mcshield.exe
C:\Archivos de programa\Archivos comunes\McAfee\SystemCore\mfefire.exe
C:\Archivos de programa\Google\Update\GoogleUpdate.exe
C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Archivos de programa\Microsoft ActiveSync\wcescomm.exe
C:\Archivos de programa\3M\PSNLite\PsnLite.exe
C:\Archivos de programa\Clarus\Samsung Auto Backup\ISFGuage.exe
C:\Archivos de programa\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
C:\Archivos de programa\Clarus\Samsung Auto Backup\ISFTimerD.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Active Ports\aports.exe
C:\Archivos de programa\Mozilla Firefox\plugin-container.exe

============== Pseudo HJT Report ===============

uStart Page = about:blank
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c0a&s=0&o=xph&d=0209&m=aoa150
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\archiv~1\mcafee\sitead~1\mcieplg.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\archiv~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\archivos de programa\archivos comunes\mcafee\systemcore\ScriptSn.20101114115443.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\archiv~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\archivos de programa\java\jre6\bin\jp2ssv.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\archiv~1\mcafee\sitead~1\mcieplg.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [gStart] c:\garmin\gStart.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\archivos de programa\microsoft activesync\wcescomm.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AzMixerSel] c:\archivos de programa\realtek\audio\installshield\AzMixerSel.exe
mRun: [SynTPEnh] c:\archivos de programa\synaptics\syntp\SynTPEnh.exe
mRun: [eRecoveryService] c:\acer\empowering technology\erecovery\eRAgent.exe
mRun: [mcui_exe] "c:\archivos de programa\mcafee.com\agent\mcagent.exe" /runkey
mRun: [LManager] c:\archiv~1\launch~1\QtZgAcer.EXE
mRun: [LaunchApp] Alaunch
mRun: [Adobe Reader Speed Launcher] "c:\archivos de programa\adobe\reader 10.0\reader\Reader_sl.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\papato\menini~1\progra~1\inicio\samsun~3.lnk - c:\archivos de programa\clarus\samsung auto backup\ISFGuage.exe
StartupFolder: c:\docume~1\papato\menini~1\progra~1\inicio\samsun~2.lnk - c:\archivos de programa\clarus\samsung auto backup\ISFRealTimeD.exe
StartupFolder: c:\docume~1\papato\menini~1\progra~1\inicio\samsun~1.lnk - c:\archivos de programa\clarus\samsung auto backup\ISFTimerD.exe
StartupFolder: c:\docume~1\alluse~1\menini~1\progra~1\inicio\post-i~1.lnk - c:\archivos de programa\3m\psnlite\PsnLite.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\archiv~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\archiv~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\archiv~1\archiv~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\papato\datosd~1\mozilla\firefox\profiles\yqnhjfle.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.uy/advanced_search?hl=es
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - component: c:\archivos de programa\mcafee\siteadvisor\components\McFFPlg.dll
FF - plugin: c:\archivos de programa\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\archivos de programa\google\update\\npGoogleOneClick8.dll
FF - plugin: c:\archivos de programa\quicktime\plugins\npqtplugin8.dll
FF - plugin: c:\archivos de programa\quicktime\plugins\npqtplugin9.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\archivos de programa\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\archivos de programa\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\archivos de programa\java\jre6\lib\deploy\jqs\ff
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\archivos de programa\mcafee\SiteAdvisor
FF - Ext: NetVideoHunter: netvideohunter@netvideohunter.com - %profile%\extensions\netvideohunter@netvideohunter.com

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-1-16 386840]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-5-2 84072]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-2-25 98392]
R2 ioloFileInfoList;iolo FileInfoList Service;c:\archivos de programa\iolo\common\lib\ioloServiceManager.exe [2009-9-20 724664]
R2 ioloSystemService;iolo System Service;c:\archivos de programa\iolo\common\lib\ioloServiceManager.exe [2009-9-20 724664]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\archivos de programa\mcafee\siteadvisor\McSACore.exe [2009-4-19 88176]
R2 McMPFSvc;McAfee Servicio Personal Firewall;"c:\archivos de programa\archivos comunes\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-2 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\archivos de programa\archivos comunes\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-2 271480]
R2 McProxy;McAfee Proxy Service;"c:\archivos de programa\archivos comunes\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-2 271480]
R2 McShield;McShield;c:\archivos de programa\archivos comunes\mcafee\systemcore\mcshield.exe [2010-5-2 171168]
R2 mfefire;McAfee Firewall Core Service;c:\archivos de programa\archivos comunes\mcafee\systemcore\mfefire.exe [2010-5-2 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\archivos de programa\archivos comunes\mcafee\systemcore\mfevtps.exe [2010-5-2 141792]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\archivos de programa\sony\pmb\PMBDeviceInfoProvider.exe [2009-10-24 360224]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-5-2 55840]
R3 M3000Srv;Acer Crystal Eye webcam Driver;c:\windows\system32\drivers\M3000KNT.sys [2008-5-5 151936]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-4-19 152960]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-4-19 52104]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-5-2 313288]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-5-2 88544]
S2 SSHNAS;SSHNAS;c:\windows\system32\svchost.exe -k netsvcs [2008-4-13 14336]
S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-2-13 96856]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\b.tmp --> c:\windows\system32\B.tmp [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-5-2 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-5-2 84264]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-4-19 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-4-19 40552]

=============== File Associations ===============

regfile=NOTEPAD.EXE %1
scrfile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2011-03-02 20:16:57 -------- d-----w- c:\docume~1\papato\config~1\datosd~1\Identities
2011-02-27 22:14:19 -------- d-----w- C:\respaldo_fotos_8
2011-02-25 22:07:34 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-25 22:07:34 27984 ----a-w- c:\windows\system32\sbbd.exe
2011-02-24 23:39:12 49664 ----a-w- c:\windows\unvise32.exe
2011-02-24 23:39:07 -------- d-----w- c:\archivos de programa\Active Ports
2011-02-24 22:00:21 -------- d-----w- c:\archivos de programa\CCleaner
2011-02-23 20:51:10 -------- d-----w- c:\archivos de programa\Sophos
2011-02-17 18:28:15 -------- d-----w- c:\archivos de programa\Mapear V9.20
2011-02-07 22:52:17 -------- d-----w- c:\archivos de programa\Investintech
2011-02-07 21:46:28 -------- d-----w- C:\respaldo_fotos_7

==================== Find3M ====================

2011-01-21 14:44:08 441344 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:03:41 1855104 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34:22 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:51:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:51:57 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:51:57 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25:43 734720 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55:37 385024 ----a-w- c:\windows\system32\html.iec
2010-12-09 15:15:17 742912 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:13:50 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:13:49 2151424 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:29:50 33280 ----a-w- c:\windows\system32\csrsrv.dll

============= FINISH: 8:59:29,37 ===============

Attached Files

BC AdBot (Login to Remove)


#2 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:11:03 PM

Posted 11 March 2011 - 07:42 PM


Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

  • Please reply to this post so I know you are there.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks :thumbup2:
Posted Image
m0le is a proud member of UNITE

#3 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:11:03 PM

Posted 17 March 2011 - 05:43 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.
Posted Image
m0le is a proud member of UNITE

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users