computer hangs when trying to follow directions for malware removal

[Drd]

Hi: I have something wrong with my Sony VAIO series F laptop. This runs a Windows 7. I noticed first that I had a problem using a "share screen" feature from the GoToMeeting application. The screen of the person showing the screen showed up as a transparent frame.
Then, I noticed the next day that a computer game I play, "Kitchen Scramble" was acting slowly.  But until then everything else was normal so I thought maybe it was a problem with the graphics card or something.
  The next day my whole computer seemed gummed up, working very slowly, and then hanging.  I was unable to even do a reset.  I just let it alone for a few hours and started up again.
 Now, I'm trying to follow your instructions, but it's nearly impossible. Sometimes my mouse won't move at all. Sometimes it moves, but when I click, it has not effect. Othertimes, after I click the thing that I want to happen, finally happens after about 5 minutes or so.
 Right now, I'm writing to you on my notebook. What do you suggest I do to save my laptop?

Thanks!

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
You will need to start the computer in Safe Mode. Install MBAM and run it in Safe Mode. If it runs successfully, you can try running it in Normal Mode.
*********************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

[Drd]

Hello Super Dave. I will have to purchase either a CD-RW (which I assume is a CD? I don't know much so please bear with me!) or a flash drive, is that what you mean by USB device? I also have an external hard but I don't think we want to risk that getting infected as it has the only good data I was able to salvage on that.
  So, I'll wait to hear from you again regarding exactly what I need to buy. Please imagine you are speaking to a total newbie who has landed in a time machine from 100 years ago. Sorry, but that's about the extent of my computer vocabulary.
 I appreciate your help and look forward to hearing from you. 

Dr. D.

[SuperDave]

Yes, a CD-RW is a CD that you can erase and use again and again. If you use a flash drive (USB) you should hold down the Shift key for about 10 secs. while inserting the device to prevent infections.

[Drd]

Hi: I've found that if I restart, the computer works ok for about ten minutes, so I'm trying to do this through there. Right now, I'm doing the download for Malwarebytes. I'll keep you posted. Thanks

[Drd]

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.07.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16750
Zeynab :: ZEYNAB-VAIO [administrator]

Protection: Enabled

2/7/2014 9:42:35 PM
mbam-log-2014-02-07 (21-42-35).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 224085
Time elapsed: 6 minute(s), 54 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 6
HKCR\CLSID\{291BCCC1-6890-484a-89D3-318C928DAC1B} (PUP.Optional.BabylonToolBar.A) -> Quarantined and deleted successfully.
HKCR\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F} (PUP.Optional.BabylonToolBar.A) -> Quarantined and deleted successfully.
HKCR\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68} (PUP.Optional.BabylonToolBar.A) -> Quarantined and deleted successfully.
HKCR\esrv.BabylonESrvc.1 (PUP.Optional.BabylonToolBar.A) -> Quarantined and deleted successfully.
HKCR\esrv.BabylonESrvc (PUP.Optional.BabylonToolBar.A) -> Quarantined and deleted successfully.
HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 4
C:\Users\Zeynab\AppData\Local\Temp\CT3225826 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\xpi\defaults (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

Files Detected: 9
C:\Users\Zeynab\AppData\Local\Temp\KMP_3.6.0.87.exe (PUP.Optional.Softonic) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\nsjF790.tmp (PUP.Optional.Somoto.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\nsx6D2C.tmp (PUP.Optional.Somoto.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\Downloads\iLividSetup-r781-n-bf.exe (PUP.Optional.Bandoo) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\conduit.xml (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\CT3225826.xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\version.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\xpi\install.rdf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Zeynab\AppData\Local\Temp\CT3225826\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

(end)

[SuperDave]

Please download AdwCleaner by Xplode onto your Desktop.

• Please close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
  
• Click on Delete or Clean.
  
• Confirm each time with OK
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile in your reply.
• You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.
  

*********************************************
Please download Junkware Removal Tool to your desktop.

•Warning! Once the scan is complete JRT will shut down your browser with NO warning.

•Shut down your protection software now to avoid potential conflicts.

•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator

•The tool will open and start scanning your system.

•Please be patient as this can take a while to complete depending on your system's specifications.

•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

•Copy and Paste the JRT.txt log into your next message.
*****************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

[Drd]

Hi:Here is the next log (I never know when the computer will hang so  I'm posting these one by one).

# AdwCleaner v3.018 - Report created 07/02/2014 at 23:16:35
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Zeynab - ZEYNAB-VAIO
# Running from : C:\Users\Zeynab\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

• Folder Deleted : C:\ProgramData\Browser Manager

Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\Program Files\Babylon
Folder Deleted : C:\Users\Zeynab\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\[email protected]
File Deleted : C:\Users\Zeynab\AppData\Local\Temp\Uninstall.exe
File Deleted : C:\Users\Zeynab\AppData\Roaming\Mozilla\Firefox\Profiles\a5xai85g.default\invalidprefs.js
File Deleted : C:\Users\Zeynab\AppData\Roaming\Mozilla\Firefox\Profiles\a5xai85g.default\searchplugins\Ask.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Ask.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml

***** [ Shortcuts ] *****

[Drd]

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Zeynab on Fri 02/07/2014 at 23:24:51.16
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Zeynab\appdata\locallow\datamngr"
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{39755CCC-8ECD-4269-BCD1-23E55B789461}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{3FCBF7AE-F2A1-4369-9DC8-DA53D57260A2}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{4FA77247-2B24-4487-BA19-E4A371FC3D24}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{5A1E782C-64B7-4AA4-9676-786D1059E0DE}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{7D6520F7-2891-4122-9EEA-3D1A82DD1742}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{8228962D-7FD5-48B8-8D56-3CCFC9E6D132}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{92CFA24B-6B85-4FF7-A7ED-D903C24F3D73}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{B0E6241F-0113-4BEA-91B7-664412F41185}
Successfully deleted: [Empty Folder] C:\Users\Zeynab\appdata\local\{B2EB6CFE-B820-4613-945D-5986250ECBAF}



~~~ FireFox

Emptied folder: C:\Users\Zeynab\AppData\Roaming\mozilla\firefox\profiles\a5xai85g.default\minidumps [173 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 02/07/2014 at 23:32:22.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Drd]

 UNSUPPORTED OPERATING SYSTEM! ABORTED!

this is the log report from checkup. all my log reports are now complete.

Thanks

[SuperDave]

Malwarebytes' Anti-Rootkit

Please download Malwarebytes' Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page for performing a scan.
• Caution: This is a beta version so also read the disclaimer and back up all your data before using.
  
• When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
  
• Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
• Copy and paste the contents of these two log files in your next reply.

[Drd]

Thanks again, SuperDave. I'm  working on this last instruction.  The scan is taking time and the computer tends to go into hibernate or something like that when nothing is visibly happening, so I keep waking it up.  So this is happening, but slowly.

  Be back to you with the log as soon as this completes.
Thanks.

[Drd]

Hi superdave: I ran the anti-rootkit but at the end it said, congratualtions no malware found, and didn't produce a log or anything like that.

what next?
the computer still works slowly. It doesn't hang completely like before, but still works really slowly.  Could this be a hardware problem or may there still be hidden malware.

[Drd]

Double trouble!  Now the notebook that I use to work on, and to pick up your emails is acting like the laptop.  This is a Sony VAIO that runs Windows 8. 

Symptoms: hangs when trying to shut down, cannot do a restart; when it hibernates, it doesn't wake up. I have to do a hard shutdown (hold down the start button). 

and, once, this really weird thing happened (which was one of the symptoms of the laptop too), when a web page is supposed to come up, the whole page doesn't come up, rather, when I run the mouse over the page, it works like a digital erasing, erasing the page on top and revealing the web page below. Weird, right?

Anyway, here is what these two devices share: one folder of documents and excel files copied from the laptop  to an external drive and now onto the notebook.

also, I recently played a game on this for the first time, a game I frequently played on the laptop, called Kitchen Scramble from playdom. com;  and I downloaded SKYPE.

Otherwise, this is a brand new notebook. I haven't been using it for more than about two weeks.

Please help!
thanks

DrD

[SuperDave]

How does it work in Safe Mode?