extremely slow reboot

This is a full scan (4 hours 43 min 8 sec) with updated definitions using Malwarebytes on my C drive finished scanning this AM (10/6/11)

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7882

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

10/6/2011 4:23:38 AM

mbam-log-2011-10-06 (04-23-38).txt

Scan type: Full scan (C:|)

Objects scanned: 299381

Time elapsed: 4 hour(s), 43 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

I download and have been using the Soluto program and have gotten the boot time reduced by removing application from the boot ("keep it paused").  The Soluto program to do what it does adds 21 seconds to the boot.   It has removed McAfee Antivirus Plus 76 sec, Indexing Svc 18 sec, mfevtps.exe  8sec.  The items that remain to potentially pause I think by a google search can be paused and I will check the result in the next few days with reboots:  Microsoft.net Framework Service Pack 2, Microsoft Fix Center, Microsoft.net Framework Client Profile.

When I view control panel > add remove programs > I view Microsoft.NET Framework 1.1; Microsoft.NET Framework 2.0 service pack 2; Microsoft.NET Framework 3.0 service pack 3; Microsoft.NET Framework 3.5 SPI; Misrosoft.NET 4 Client Profile; Microsoft Fix it Center

I have downloaded to my desktop some of the fix it programs where I can click on them which starts the download so I can remove the program or pause it using Soluto.  I am unaware of using Microsoft.NET Framework and will see if it is something to uninstall or keep and pause on reboot (any infor on this?)

Soluto currently has "your boot takes 5.02 minutes", "33 applications run in your boot", Potentially removable 5 applications, 14.6 sec, Cannot be removed with Saluto yet 28 appps, 4:47.4min. 

If I remove Glary utilities I would save 3 sec.  I had found that if I had not set my lexmark printer to start on reboot it did not start manually.  I could reduce the boot time if I learn how to make it work if it can be started on demand.

For malware active protection I noticed that there were many downloads on downloads.com for free microsoft security essentials.  They recommended panda cloud antivirus free edition 1.3 higher.  I am considering others including AVG, Avira and Avast.  Bank of America used to offer a free subscription to McAfee and if it still does I will consider a full uninstall of Mcafee and then checking all results.  I am not sure whether to consider a fresh installation.

For the malware I have run many different scans from different companies and have found no malware as in the preceding reply.  I can overkill by using these programs which I have not used lately:  exterminate, superantispyware, and PC Pitstop PC Matic as they may add something??

The soluto programs appears to be very useful as it cuts down so much time with each boot that if I can reduce it more I may be able to turn off my computer more frequently and then not have to wait as long with each boot.   THANK YOU

[snipped]

The following malware tests have been done on my system and none have found malware:

1. McAfee Security Scan Plus

http://home.mcafee.com/downloads/free-virus-scan?ctst=1

2. Kaspersky Virus Removal Tool

http://www.kaspersky.com/virusscanner

3. Microsoft Malicious Software Removal Tool

http://download.cnet.com/Microsoft-Windows-Malicious-Software-Removal-Tool/3000-2239\_4-76849.html

4. Malwarebytes

http://www.malwarebytes.org/

5. I used to run PC Pitstop PcMatic daily which has their low and high threat detectors and provided system performance results, comparisons with similar systems that ran their studies, and options to improve performance
6. Today I also ran Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

Summary

The following 6 software products have determined from their updated definitions that as of 10/3 to 10/6/2011 there is no malware on my computer:

Trend Micro Hijackthis

Microsoft Malicious Software Removal Tool

Microsoft Safety Scanner

Kapersky Virus Removal Tool

McAfee Security Scan Plus

Malwarebytes

Within the past 48 hours 4 of the above were used twice.

You will notice that many of my threads are old.  They were likely written when I was using PC Pitstop PC Matic daily.

I think you can safely assume at this point that you are malware free, assuming you did the full scans on Malwarebytes and the MS Safety Scanner.

I would now move on to the slow boot issue, and unless you want to dive deep into the details of why this or that process is necessary or not (which will be impossible for anyone here to answer definitively, as none of us is likely to be an expert in everything on your PC) I suggest again that you install and optimize your boot with Soluto (carefully of course.)

Also, at high priority I would uninstall McAfee which you say has expired.  That means it is not updating it's virus definitions, so it's protection is valid up only thru whatever the last set of updates you installed.  Uninstall it first, then make a choice and install the replacement after a quick windows update check, followed by a reboot (reboot even if you don't add any patches.)

I know you are getting a bunch of somewhat varying advice here, so pick your strategy and stick to it.  Your priorities should be:

1. Make sure you are malware free.
2. Get protected (antivirus and firewall.)
3. Optimize PC performance only after 1 & 2 are locked in.

It seems easy to blame things on malware and it seems hard to disprove.  But here are the results of different companies that either provide free software or sell their software to detect malware

The first is today' s result of Trend Micro Hijackthis:  This is the log file:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:02:01 AM, on 10/6/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Soluto\soluto.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Soluto\SolutoService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Safari\Safari.exe

C:\Program Files\Soluto\SolutoConsole.exe

C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\AOL 9.5\waol.exe

C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe

C:\Program Files\AOL 9.5\shellmon.exe

C:\Program Files\Common Files\AOL\1270149381\ee\aolsoftware.exe

C:\Program Files\Common Files\AOL\1270149381\ee\aolsoftware.exe

C:\Program Files\Common Files\AOL\1270149381\ee\anotify.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070517

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070517

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\Soluto\soluto.exe /userinit

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20101025031505.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://*.mcafee.com

O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab

O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} (PCPitstop AntiVirus) - http://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll

O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} (Diagnostics ActiveX WebControl) - http://support.microsoft.com/mats/DiagWebControl.cab

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5865/mcfscan.cab

O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll

O23 - Service: McAfee Application Installer Cleanup (0132241317856773) (0132241317856773mcinstcleanup) - McAfee, Inc. - C:\WINDOWS\TEMP\013224~1.EXE

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe

O23 - Service: Soluto PCGenome Core Service (SolutoService) - Soluto - C:\Program Files\Soluto\SolutoService.exe

O24 - Desktop Component 0: (no name) - (no file)

--

End of file - 8158 bytes

The following malware tests have been done on my system and none have found malware:

1. McAfee Security Scan Plus

http://home.mcafee.com/downloads/free-virus-scan?ctst=1

2. Kaspersky Virus Removal Tool

http://www.kaspersky.com/virusscanner

3. Microsoft Malicious Software Removal Tool

http://download.cnet.com/Microsoft-Windows-Malicious-Software-Removal-Tool/3000-2239\_4-76849.html

4. Malwarebytes

http://www.malwarebytes.org/

5. I used to run PC Pitstop PcMatic daily which has their low and high threat detectors and provided system performance results, comparisons with similar systems that ran their studies, and options to improve performance
6. Today I also ran Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

Summary

The following 6 software products have determined from their updated definitions that as of 10/3 to 10/6/2011 there is no malware on my computer:

Trend Micro Hijackthis

Microsoft Malicious Software Removal Tool

Microsoft Safety Scanner

Kapersky Virus Removal Tool

McAfee Security Scan Plus

Malwarebytes

Within the past 48 hours 4 of the above were used twice.

You will notice that many of my threads are old.  They were likely written when I was using PC Pitstop PC Matic daily.

Yeah, I gotta agree with the others.

Malwarebytes may or may not have removed the entire infection. (It would have been helpful to know its name!)

Also, you are unclear about McAfee. It sounds as if you believe you are still able to receive ongoing updates even though the subsciption has expired (and presumably the program version is not current). At any rate, that doesn't inspire confidence! I really think there is a strong chance you have malware.

Would you go to a doctor who'd lost his license to practice medicine?

Would you still deposit your hard-earned money in a bank that had gone under?

I don't think so...

The following applies to ALL of your threads:

You have been seeing the effects of an ongoing hijackware infection, most likely compounded by a W32/Alureon-variant rootkit infection (or worse).  See...

   • Cleaning a Compromised System

      http://technet.microsoft.com/en-us/library/cc700813.aspx

Follow the instructions in this post of mine in another forum (to-the-letter &in order! ) to return your computer to a secure & functional state: http://aumha.net/viewtopic.php?f=62&t=44636

If you need additional assistance with the clean install, please begin a new thread in this forum: http://answers.microsoft.com/en-us/windows/forum/windows_xp-system

Note: The computer should not be connected to the internet or any local networks (i.e., other computers) in its current state. All of your personal data (e.g., online banking & credit-card passwords) should be considered at-risk, if not already compromised.

Wish I'd had better news for you.  Good luck!

Yup!!

+1