Might have gotten a trojan/virus and can't "cure"

Viruses and worms
21

I ran another scan, and here’s the log. Haven’t got the chance to look into startup lite yet, but will do it later!

22

One other thing I found out today is that FF does not remove the old Java console when it is updated and this slows down FF - so I will remove them… Otherwise what I am doing is disabling the run command for non-essential programmes but the programmes themselves will stay and run when you need them

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.

[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> 
YN -> HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.bigseekpro.com/facesmooch/{8AFBD76D-1D7D-41A0-A3BA-8F2F060847A2}
YN -> HKEY_CURRENT_USER\: URLSearchHooks\\"{00000000-6E41-4FD3-8538-502F5495E5FC}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< FireFox Extensions [Program Folders] > -> 
YY -> Java Console   -> C:\Programmer\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
YY -> Java Console   -> C:\Programmer\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
YY -> Java Console   -> C:\Programmer\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
YY -> Java Console   -> C:\Programmer\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
YY -> Java Console -> C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "{30F9B915-B755-4826-820B-08FBA6BD249D}" [HKLM] -> [Conduit Engine]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "eRecoveryService" -> []
YN -> "IAAnotif" -> C:\Programmer\Intel\Intel Matrix Storage Manager\IAAnotif.exe [C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe]
YN -> "Nokia FastStart" -> ["C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart]
YN -> "RtHDVCpl" -> C:\Windows\RtHDVCpl.exe [RtHDVCpl.exe]
YN -> "WarReg_PopUp" -> C:\Programmer\eMachines\WR_PopUp\WarReg_PopUp.exe [C:\Program Files\eMachines\WR_PopUp\WarReg_PopUp.exe]
YN -> "WinampAgent" -> ["C:\Program Files\Winamp\winampa.exe"]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "DAEMON Tools" -> C:\Program Files\DAEMON Tools\daemon.exe ["C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.

23

Ran the fix, here’s the log =)

24

How is it running now ?

25

Well, it’s not functioning. It still freezes pretty regularly… Really strange…
I don’t know if it means anything, but there’s currently 7 processers open that looks pretty odd.
csrss
hkcmd.exe - hkcmd module
igfxext.exe - igfxext module
igfxpers.exe - persistence module
igfxrsvc.exe - igfxsrvc module
igfxrsvc.exe - igfxsrvc module
igfxtray.exe - igfxTray module

26

They are legitimate and part of intel graphics and the keyboard

Did you try startup lite ?

27

Yes, and i tried to diasble the quicktime task, hotkeycmds and persistence task - but without succes…
A message pops up saying
“Error on value: Quicktime Task. There was an error creating a MSConfig Key”
“Error on value: Hotkeycmds. There was an error creating a MSConfig Key”
"Error on value: Persistence Task. There was an error creating a MSConfig Key

28

Hmm weird error I will check that out

When the system locks is the hard drive churning or does everything go quiet ?

29

Well everything goes quiet and it just locks. it happens at least a cuple of times pr. day…

30

Download Speedfan and install it. Once it’s installed, run the program and post here the information it shows. The information I want you to post is the stuff that is circled in the example picture I have attached.
If you are running on a vista machine, please go to where you installed the program and run the program as administrator.

http://artellos.geekstogo.com/speedfan.png

(this is a screenshot from a vista machine)

31

Okay, i attatched a screenshot… But I only get the tempature info… really weird.
And i might add that regularly a norton window pops up, claiming that it’s scanning my computer

32

Your temperatures are high and that will cause locks and malfunctions. Could you check that all the vents are clear and if it is a desktop then open the casing up and using a tin of compressed air remove the dust