I HATE doing this, because I know models ask all the time for help and it takes away from your viewing times hehe.. but some of you know I am having computer troubles.

Someone installed a bunch of those stupid "free RPG games" on my computer.. I deleted them, and then my computer started acting crazy and slow.

ctrl+alt+delete shows a ridiculously huge list of processes, some of which I can close..some I can not.

Ive been trying to google them all to deal with them individually but there has to be a better way.

If anyone recognizes one as a trojan, ect.. please let me know!

wuauclt.exe 4,200K
ctfmon 3,200 k
msmpeng.exe (windows defender) 35,000k
ccapp.exe 15,000k
jussched.exe 6k
hkcmd.exe 4k
NPFMNTOR.exe 4k
navapsvc.exe 9k
ccevtMGR.exe 3k
MSAscui.exe 8k
aluschedulersvc.exe 1k
spbbcsvc.exe 3k
SNDsrvs.exe 3k
ccsetmgr.exe 5k
symlcsvc.exe 1k
lsass.exe 2k
nopdb.exe 5k
NProtext.exe 6k


99% of those I have no idea what they are, but when I go to close them it says they are critical processes (yeah right) and it wont let me.

Also, the SVCHOST.exe file is listed about 11 times on the processes list... anywhere from 2k mem usage to 30k! I imagine multiple of these are spywares that renamed themselves to a needed file.

This occurs a few times with things like the winlogon.exe file, services.exe, spoolsv.exe and a few other system files.

My computer is inching itself closer and closer to death.

Norton scans every night and finds nothing.
Windows defender will scan for 3 hours, will find ONE error and quarantine it.. but the problem does not resolve, so i've scanned a few more times..same thing. Takes hours to find one thing, but then every rescan exposes a new error.

What else can I do? I guess I should start backing up my stuff and plan for a format?

Any step by steps would be great... thanks guys!! KISSES and hopefully NAKED BUM soon.. Quote

PCtools found 500+ trojans, spyware, etc etc...... I had to stop it because I realized that to remove the infections you have to register, and I don't have a credit card.

Why cant the free ones find the problems :'(

how the heck am I going to manually delete over a thousand adware/trojans! ahhhhhhhhhhhhhhhh Quote

Save your files.
Reformat the Hard Drive.
Reinstall the operating system.
Reload all of your software.

Its the easiest, safest, least time-consuming option at this point.

Good luck! Quote

i would wait til purg responds before doing anything Quote

haha. I appreciate the vote of confidence. hope Purg is out there.

Once your computer is that infected Scarlett, there is not a whole lot you can do. Better to start over and wipe everything. No security program is going to fix everything. I've been there, many, many times.

What I suggested will take, tops, one hour. Just make sure you back up your files externally.
Quote

down load avg its free and in a couple hours of workin u will be free again. Quote

sounds like a worm ! P.C. should be updated from windows and better free protection . Quote

Install Hijackthis and after you install it and run it , click" Do a system scan and Save a log file", it will do a scan and then open the information in a notepad, copy and paste what there is in the notepad to here .


http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

thats where to get it from

should look something like this in the scan log that comes up in the notepad. Afer that I will tell you what you need to kill off, don't kill anything yourself, you may end up with a system that won't start.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:52:03, on 16/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesWindows DefenderMsMpEng.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesSymantec AntiVirusDefWatch.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesSymantec AntiVirusRtvscan.exe
C:Program FilesUPHCleanuphclean.exe
C:WINDOWSSystem32ups.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:PROGRA~1SYMANT~1VPTray.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesCommon FilesLogiShrdLComMgrLVComSX.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:Program FilesLogitechSetPointSetPoint.exe
C:Program FilesCommon FilesLogishrdKHAL2KHALMNPR.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.co.uk/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdreg.exe
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [vptray] C:PROGRA~1SYMANT~1VPTray.exe
O4 - HKLM..Run: [Windows Defender] "C:Program FilesWindows DefenderMSASCui.exe" -hide
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [LVCOMSX] "C:Program FilesCommon FilesLogiShrdLComMgrLVComSX.exe"
O4 - HKLM..Run: [StartCCC] "C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe" MSRun
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:Program FilesLogitechSetPointSetPoint.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?12307865369 07
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230971515625
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:Program FilesSymantec AntiVirusDefWatch.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:Program FilesiPodbiniPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:Program FilesLavasoftAd-AwareAAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesCommon FilesLogishrdBluetoothLBTServ.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:Program FilesCommon FilesLogiShrdSrvLnchSrvLnch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:Program FilesSymantec AntiVirusSavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:Program FilesSymantec AntiVirusRtvscan.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

--
End of file - 5765 bytes


okay do that and lets try stopping the nasties from starting up 1st then go threw killing their files off later.

Regards

Nabil
Quote

I have better idea can you save the file to your desktop it produces and then upload it to

www.rapidshare.com

and then post the link here please this silly forum removes too much information and makes it harder to figure out where one file name stops and one ends ..


When you have uploaded it to rapidshare just copy the download / share link it gives you and paste it here then I can look at it.

Regards

Nabil Quote

THE BEST PROGRAM I HAVE FOUND AND ONLY ONE I USED AND HAS SAVED MY COMPUTER MANY TIMES IS NORTON INTERNET SECURITY 2009 IT IS THE BEST I WILL FIX 99.9 IF NOT 100 PERCENT OF THE PROBLEM Quote

Scarlett any luck with that pc ? Just bumping this up before you go out and defect to the dark side and buy a bad Apple calculator... I mean computer ...

Shout if you still need help with that pc, if you really are not bothered what is on it format the whole lot and reinstall it to save you any headaches and keep mom off that pc and her RPG habit.. ..

Also stick cyber nanny on to stop mom downloading anything she should not ..


If anything important on that pc and you was thinking of starting again with a clean install of Windows just copy all your data and programs to another backup device, or like I said we can try remove the nasties and get you up and running..

Hope you are well and regards to your mom aka the pc blower upper

Regards

Nabil Quote