I've done everything mentioned here including defrag and changing some things in services.msc but this thing runs like the dinasaur that it is. My friend thinks I'm some genious that I'm not. Any help would be appreciated. Thanks guys.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:23:18 PM, on 11/28/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\ATT-SST\McciTrayApp.exe
C:\Program Files\AT&T\Internet Security Wizard\ISW.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O3 - Toolbar: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATT-SST_McciTrayApp] "C:\Program Files\ATT-SST\McciTrayApp.exe"
O4 - HKLM\..\Run: [ISW.exe] "C:\Program Files\AT&T\Internet Security Wizard\ISW.exe" /AUTORUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [ATT_WCC] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [HitmanPro35] "C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe" /scan:boot
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet (User 'Default user')
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178768969203
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe

--
End of file - 7172 bytes

I dont understand why the guys on bleepingcomputer do NOT want you to run combofix. Whats the big deal?

need some help...
 

Hey yall! My name is Shante and I am stoked to be here. I was at a friend's house after watching a game a couple weeks ago and we were looking at this forum for different fans and their thoughts. After reading for a while, I decided it was time for me to get my own laptop and hook up to the net so that I could be a part of it. I really was motivated by this forum and my love of movies to boot up; but I do have worries. i have heard stories from my friends about internet security violations and what not, and after picking their brains for some time, I am still kinda trying to figure out a solution I feel comfortable with.

I was wondering if there was anyone here, maybe, who could point me in the right direction...

I have been using Win XP, and it comes with a firewall, but I am worried it isn't strong enough.

I am thinking about getting Zonealarm’s DataLock data encryption software. Basically I think that for laptops, it is a good way to make sure that if it gets stolen or I lose it (the reality is more like forget it) that nobody can access my data. It seems to run in the back ground so that you don’t know it is actually running.

They say that it uses a pre-boot authentication in which users must provide the correct username and password before the operating system boot process will even begin. They also have a 24/7 password recovery service incase you forget your password.

A couple of questions:

1) Is this pre-boot authentication something that will help keep the data secure?
2) What kind of encryption is used?
3) How hard will DataLock make getting the data from my hard drive?

I just got over my MalWare problem with some help from a guy on bleeping computer. That guy talked me through every step and now everything is back to normal and better than ever with my computer. I would recommend you check it out. Cool people and don't mind helping others a bit it seems like. Saved me some $$ that's for sure. I was about to the point of throwing it out and buying a new tube.
My computer was so jacked it would take IE 3-4 minutes to load a page at the first. and FireFox kept crashing plus the stuff I had wouldn't even let me post my logs after checking with HIJack. There were many other problems it showed also.
Download the TDDS killer that they recommend run it then dl the Norman Malware Cleaner also and run it....took it 3-4 hrs but between both of them the cleaned up my stuff.
Anyway just check them out if you have time!

http://www.bleepingcomputer.com/forums/

I've been trying to tell people here for years now.... Combofix is not a good general fix for computer issues, and never has been. Especially if you're not familiar with advanced troubleshooting and registry editing and the like. It has the ability to really screw up your system instead of fixing it. It's very limited in scope compared to other programs like Malwarebytes. It was designed to remove a limited handful of specific infections, and the creators themselves warn against using it for anything else. It doesn't have any type of update server to easily update the engine or definitions. And it haphazardly uses quite a few Windows processes, like Windows Recovery Console, in an unsupported manner. It routinely breaks the internet connection of machines it is "fixing", which requires a manual fix. It is even reported as a virus by some other security apps, due to it being a rootkit itself. There is even a type of malicious rootkit out there, that when it's detected by Combofix, it causes Combofix to automatically delete all the files on the drive. Seriously.

Combofix has it's purpose. But seeing it recommended by inexperienced people for all different types of infections just makes me cringe. This is a bad idea, unless a well trained tech who actually knows what he's doing instructs you to run it. There are much better and much safer utilities for the average user that will fix a helluva lot more than Combofix will.

Datalock
 

I have been looking at this also. It seems that the pre-boot authentication is a good feature, because it will not allow someone to boot the laptop without the password. Basically, at that point they would pull the drive, and wipe it so they can at least use the laptop with a new install.

My understanding is that Datalock is 256k - which is the strongest.

Datalock runs in the background, and I have not found anyone saying that it is slow.

I just bought a new laptop. To connect with the wireless I need the network security key, which apparently we never wrote down. Is there somewhere on my old computer settings that I can find it?

There's freeware out there if you Google 'find wireless password', but I've never used any of them, so I don't know if it's reliable. If it's a Linksys router, you can go to 192.168.1.1 in your internet browser on your old computer or while wired with your new laptop to get into your router... the default user/password to get into the router is admin/admin, and you can find the key under Wireless -> Wireless Security.

What kind of router?

What type of router do you have? If you set a password, you can always hit a tiny button on the back of the router to manually reset it, but that also erases any configuration you've made with the router. That may or may not be a problem. If you tell us the type of router, we can tell you the name and password needed to log in after you reset it.

Thanks for the responses. I think this is the router- It says Ubee on it and Time Warner set it up. I'm really dumb with this stuff.

Go into your browser, type in 192.168.1.1. Then a prompt should show up that asks for a username and password. The username is "user" and password is "user" by default for ubee routers. (if its not, try admin/admin).

That should get you into the router. Then you'll navigate to the wireless section, and reset it there.

That worked. It ended up as a different number for the router, and I had to plug the new computer into the router itself to do it, but it ended up working.
Thanks a lot for your help.

Well, i got a big problem...


Got something on the other comp, malwarebytes didn't pick it up, but symantec did. got one of the two it was messing with in quarantine, but it is giving me major RAM, memory, and hard drive not found errors.

Files are missing from my documents, i tried sticking in a usb card, but apparanantly it was instantly corrupted, so no dice adding anymore anti viruses.

keeps trying to get me to "defrag" using "Good Memory", whatever the hell that is... looks like a fake defrag/antivirus program.

Any ideas? i can't get into safe mode either... says windows vista, and i have XP

Didn't your XP come with a "restore" option? Just go in there and restore to a time before these events started occuring.