Slow windows XP laptop with rootkit evidence (page 2)

helpintoledo · 2013-01-19T14:30:19+00:00

Hello. First, my apologies for dropping the ball recently. I do appreciate the effort put in by the volunteers here, but unfortunately got sidetracked and allowed my previous post to go dormant, and all I succeeded in doing was wasting some of DeltaLima's time, which is fair to no one. It won't happen again. I am resubmitting new logs with my original description and will await new instructions. I will not perform any of the previously suggested actions unless they are repeated here. This laptop has been running slow, along with a few odd hang ups and log-offs, prompting me to run MBAM. MBAM returned four files marked as Extension.Mismatch These have not yet been removed or quarantined, but I did examine one of them (a supposed jpg) in notepad, it had the MV opening suggesting an executable and I found this line: INE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Taskman Q HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoRun 1 Q HKEY_LOCAL_MACHINE

January 20, 2013, 9:16 PM UTC

Hi helpintoledo,

I will have Kelly resume use of her laptop and will advise later today.

Good, before you do we have a couple of tasks to complete.

Please uninstall Coupon Printer for Windows

Run OTL Script

Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).

Copy and Paste the following code into the

textbox. Do not include the word Code



:Commands

[CREATERESTOREPOINT]



:processes

killallprocesses

:otl

CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Documents and Settings\Marc\Local Settings\Application Data\Google\Chrome\Application\plugins\npMozCouponPrinter.dll

O4 - HKLM..\Run: [] File not found

O4 - HKU\S-1-5-21-1708537768-152049171-725345543-1004..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_5_502_110_ActiveX.exe -update activex File not found

:files



:commands

[EMPTYTEMP]

[EMPTYFLASH]

[EMPTYJAVA]

[REBOOT]

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Please let me know how the computer is running once Kelly has used it for a while.