Slow Process [HiJack log included]

Slow Process

I posted a few days ago about my pc becoming extremely slow. I am on cable which has always been very fast, but about 5 days ago, it started slowing down horribly. I've cleared history, deleted all files and cookies, which seems to work for a couple of web pages, then we're back to a crawl again.
I remembered that I had updated IE 6 and MS Office about that same time. Could either of these cause this? If so, does anyone know what I can do to "put me back the way I was "???

 

OK, this is what it logged. I'm not sure what to do next. I've run SpyBot, Adaware, Hijack This, deleted all history files, cookies, files, Defraged, etc. I'm sure I have duplicated stuff on this pc as well. Is there a software I can download to locate these and remove? Any recommendations will be appreciated.




Logfile of HijackThis v1.99.0
Scan saved at 8:57:48 AM, on 1/16/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 SP1 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\CA\ETRUST EZ ARMOR\ETRUST EZ ANTIVIRUS\ISAFE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\PELMICED.EXE
C:\WINDOWS\DA797.EXE
C:\PROGRAM FILES\CA\ETRUST EZ ARMOR\ETRUST EZ ANTIVIRUS\VETMSG.EXE
C:\PROGRAM FILES\CA\ETRUST EZ ARMOR\ETRUST EZ ANTIVIRUS\VETTRAY.EXE
C:\PROGRAM FILES\CA\ETRUST EZ ARMOR\ETRUST EZ FIREWALL\CA.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\EBAYTBDAEMON.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\EBAYTB.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YCOMP5_3_16_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\EBAYTB.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [da797.exe] da797.exe
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll ",run
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Vet Alert] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VETMSG.EXE
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VETTRAY.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe "
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [CAISafe] C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll ",run
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: &eBay Search - res://C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) -
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ita.sel.sony.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 209.47.15.118,64.157.143.38

 

Also, I've tried removing via "Program Add/Remove" something in there that says "Surfbuddy ", but it is still listed. As a matter of fact, when I highlite to remove, it just flips back as if nothing is there, yet the word "SurfBuddy" is still seen. Does this mean anything??

Also, when I use Window Explorer, it shows several listings of "Robotz Wave Files ". I'm not sure where these came from. My son was here over the holidays and could have installed them, but I'd sure like to get them off the unit if they are not value, yet it blocks me from doing that. Any suggestions??

 

Has an expert had an opportunity to view this log?? Don't know what else to do, but need to work in my pc and the slowness is a real killer.

Thanks for anyone's help.

 

Just wanted to bring you current on things I've noticed and checked.
Checked my system resources and was at 28%.

First, used MSCONFIG and removed all but absolute necessary files including EZArmour Firewall. System Resources came back to 84%.

Opened IE, SR went to 80%
Opened OE, SR went to 73%
Opened EBAY, SR went to 70%
Loaded 2 pics, SR went to 60%

Deleted all history, files and cookies via Internet Options
SR went back to 80%.

Does any of this help? It appears to me that the more pages I visit on the web, SR is gobbled up! And, the pages get slower and slower.

HELP! Really don't know what else to do. Oh yes, I even called the cable company and had them check my connections....all is working fine on the connection.

 

Hi elaine.

Give it a little time. Weekends can be a little strange and spotty on here. Monday should bring you a detailed look.

Oddly enough, the fact that you are running 98 probably has a little to do with the delay. Nothing wrong with 98 at all but most of us are accustomed to looking at 2K/XP logs and have to spend more research time on 98 systems.

 

Hello all

Unless you know what DA797.EXE s proceed as fallows

Set windows to show hidden extensions file's and folder's.
>click here for instructions<.


Run hijackthis Hit "config" then "misc tools" > "open proccess manager'
select and choose KILL Proccess

C:\WINDOWS\DA797.EXE

Hit refresh and see if it came back ?, wheather or not it did move on to the next steps.
Hit >back< then Scan and Place a check next to these, close all browers and programs that show in the taskbar including explorer folder's and hit fix checked

O4 - HKLM\..\Run: [da797.exe] da797.exe
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll ",run
O4 - HKCU\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll ",run
==========================

Go here and submit that file and tell us what happens
C:\WINDOWS\DA797.EXE
Online malware scan-Submit a file: http://virusscan.jotti.dhs.org/


Post a new log

 

Hi Newt,
Thanks for getting with me. DA797.exe was no longer there, but something strange happened while I was doing all this stuff. I tried to respond and send HJT log from within my email to BBS. Suddenly, gillions of IE "page cannot be displayed" started popping very quickly....and warning "SR dangerously low ".
Also, I remembered that I had also downloaded EBAY's TOOL BAR about the same day that I updated MS OFFICE and IE when the issues started. I went into MSCONFIG and unchecked the EBAY TOOLBAR, but when I went to the EBAY site, it came back! So, I used "find" and manually deleted everything there that looked like EBAY. I'm going to try and send this to you, then come back and paste the HJT log.

 

Hope someone can help! BTW, under "find" I noticed I have 2 HJT, both saying applications. I'm sure I probably downloaded it twice with all this frustration. Does anyone know of a program that will detect all duplicate programs, etc?



Logfile of HijackThis v1.99.0
Scan saved at 8:26:42 AM, on 1/17/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 SP1 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\PELMICED.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\EBAYTB.DLL (file missing)
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YCOMP5_3_16_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\EBAYTB.DLL (file missing)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: &eBay Search - res://C:\PROGRAM FILES\EBAY\EBAY TOOLBAR2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) -
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ita.sel.sony.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 209.47.15.118,64.157.143.38

 

Just wanted to also tell you that I have to run LSPFIX and reboot each time I try to access the net. Even after doing that each time, I can only go to one or two pages (with normal speed), then I get a "Page cannot be display ". I don't know what more to do! It's getting worse, not better! I don't mind paying for a program that will analize this thing and fix it, so if anyone has any suggestions after all these posts, please advise.

Many thanks.

 

LSPFIX ?

What file are you removing with it, and its location ?

 

Not removing it.....I had downloaded this from a link on BBS site before doing MSCONFIG. There was statements that this was smart to do because some of the process might prevent accessing the web pages, and I guess that is true, because when I use this "fix ", I can access the first 2 or 3 pages, then I get the "cannot display page" error.
Wanted to ask if you would suggest to upgrading to WinXP.....if so, is that offered online? If that will correct my issues, I'll do that now because I'm wasting a lot of time. BTW, can we still contact via email in the event this thing gets worse and I can't get back to this site?

 

when we suggest lsp fix it for a specific problem with instructions, you dont just run it

see attachment. everything on the left is usualy a good guy if any show in the right they should be removed, If we spot a bad dll sometimes we suggest moving it from the left to the right

 

Sorry it has taken so long to respond, but I became so frustrated that I went ahead and upgraded to WinXP yesterday. Can't really tell you that things are better because even XP Support kept me on the phone for 4 straight hours last night trying to gain access to the web. We ended up with accessing some sites, but will not access others. At this point, I think it may be because I need to do the upgrade add ons that have been introduced with XP that was not on the installation disc, BUT, can't get on Microsoft site to get the download. Boy,this is NUTS!
If anyone has any suggestions for this problem, please let me know. At this time, their Senior Support, (which is in India) is supposed to call back again tonight to see if they know what to do.
Any suggestions??

Thanks to all of you for your assistance...

 

Hi

Post another new log.

What type of connections service is it you have ? and who is it from ?

Have you scaned with and cleaned up with SpyBot version 13. and Ad-Aware SE 1.5 ?

 

I am on cable connection with Comcast.net which has been checked and re-checked...all is fine.

With all that has been tested, I think the problem is not being able to connect via the domain name. I can connect if I have the ip address.

 

A question or two which I believe is important at this point.

How did you upgrade ?

Did you now have XP Home or XP Pro ?

Did you put XP over top of 98SE ?

If you did that could very possibly make things WORSE. And even if not worse may not be fixed.

If you formated and did a clean install them things are far more technical than I am able to handle.

BillyBob

 

Hi Elaine,
You were just to quick to panic or we were to slow to respond. Remember this blast from your past:
http://www.windowsbbs.com/showthread.php?p=160842#post160842
Notice the reference to da797.exe (Trojan)

Also you had some things indicated as running which were not needed along with a couple of things that were running that were questionable such as your mouseware (I think indicated two mice), the fugi camera related thingy REGSHAVE.EXE /AUTORUN which I don't believe should have been auto running if you had removed the fugi camera software already. You also apparently had two firewall programs running zonelabs and eztrusts. While I also use Copernic it is a resource hog and can be fussy. I would not have been using it as IE's default and would have advised un-intigrating it with IE as much as posiible. I wouldn't be surprised if that wasn't a major cause of those IE sites or urls not being found. So many other things that you were allowing to autorun or run in the background also were not needed. We didn't even get a chance to address the IE version issue. Ebay comes with it's set of issues. That ProxyOverride setting has always raised a few eyebrows. The meaning, use and ramifications of this are beyond my knowledge though. I just recognized that it has been advised on many googled hijackthis.logs that this be checked for fixing.....I could go on but this may be crying over spilled milk by now, since you have upgraded to XP.

It is never a good idea to upgrade an operating system on top of an already troubled/problematic system unless you're doing it clean. So BillyBob's question's certainly need to be addressed!

I think we all need to take a deep breath and regroup. Start attacking this fresh.