Author Topic: PC running slow after virus removal (Read 31791 times)

Michael · « **on:** June 06, 2008, 09:26:39 PM »

A few days ago my computer at work was infected by a virus. So I installed AVG 8.0 and removed the virus and all infected files.
Ever since the removal, the computer has been running slow - slow response and freezes.

During startup, when the computer seems to be ready to use, if I click on My Computer or Start or any other program, it will take a few minutes to response.

After an application is running, e.g. Explorer, IE, MS Words, Photoshop, etc., the applications will run as smooth as usual, until you do something like open a file from the file menu, save, or try to start another application. In those cases, the computer will freeze and take a few minutes to response.

FYI, the other 3 computers on the network which was also infected by the same virus
and cured by AVG as well, do not have the same freezing or slow issue. It is only my computer which I first installed AVG and removed the virus.

All computers are running Win XP Professional SP2. I've rescan all the computers with AVG and no further threats are found.

What could be the reason that only my computer has the issue?

Thanks.

brett74 · « **Reply #1 on:** June 06, 2008, 09:30:44 PM »

hi welcome to computer hope please read this link and a malware specialist will be with you shortly

http://www.computerhope.com/forum/index.php/topic,46313.0.html

Zylstra · « **Reply #2 on:** June 06, 2008, 10:12:28 PM »

I would recommend trying the following until you recieve further assistance after uploading your HiJackThis log and other things in the extremely handy guide that Brett74 has just linked to

Clicking Start> Run
Typing CMD and pressing ENTER
Then type (in the black command prompt window):

sfc /scannow

Have your Windows XP CD Ready

This may repair any files that a virus may have modified (for the worse) or damaged (for the worst...)

Broni · « **Reply #3 on:** June 06, 2008, 11:26:20 PM »

Follow both advice, then couple of questions...
1. What are computer specs: processor speed, amount of RAM, hard drive size/free space?
2. Do other computers have similar specs?

Michael · « **Reply #4 on:** June 08, 2008, 12:49:02 AM »

Thanks for the responses.

While I will not be in the office until tomorrow, I decided to check my own computer at home with the given instructions.

First I did what Zylstra suggested. Then I go to evilfantasy's guide.

Step A: Antivirus I have Avast 4.8 home edition & AVG 7.5 on my PC. When I download the latest AVG 8.0 and try to install/upgrade, I got the error message that I have an unsupported windows version. I'm running Win XP SP2, so I'm wondering.

Step 1: Add/Remove Program No suspicious program/malware.

Step 2: House Cleaning Cleared all those temporary files and cache.

Step 3: SUPERAntiSpyware Here is another problem. During the installation process, Spybot S&D will detect a registry change and prompts me whether to allow or deny it. But before I can even move my mouse, the computer crashes and restarts.

So what do I do now?

Thanks and sorry for jumping to my own computer's issue rather than my original problem with computer at work.

evilfantasy · « **Reply #5 on:** June 08, 2008, 01:16:43 AM »

Quote

Step A: Antivirus I have Avast 4.8 home edition & AVG 7.5 on my PC. When I download the latest AVG 8.0 and try to install/upgrade, I got the error message that I have an unsupported windows version. I'm running Win XP SP2, so I'm wondering.

You should never run two antivirus at the same time. It will do nothing but cause problems. Pick one and uninstall the other.

----------

Shut down Tea Timer during the removal process.

Disable Spybot's TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

First:

Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
Choose Exit Spybot S&D Resident

Second:

Open Spybot S&D
Click Mode, check Advanced Mode
Go To Left Panel, Click Tools, then also in left panel, click Resident
If your firewall raises a question, say OK
Uncheck the box labeled Resident Tea-Timer and OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Michael · « **Reply #6 on:** June 08, 2008, 02:52:27 AM »

I uninstalled Avast but AVG 8.0 still wouldn't allow me to install due to the same unsupported windows reason.

I disabled (unchecked) TeaTimer in SpyBot S&D, but the installation of SUPERAntiSpyware still crashes as it finish.

Also, after I unchecked the TeaTimer checkbox, exit and restart, if I go to the page again, the checkbox is still remain checked.

evilfantasy · « **Reply #7 on:** June 08, 2008, 03:11:15 AM »

I don't know if AVG is refusing to install because you aren't running SP3, but that is the only thing I can think of. You may need to reinstall Avast so you do have an antivirus running until it gets sorted out.

Turn off Tea Timer again but this time do step 3 as well. If needed skip Superantispyware and go on to Malwarebytes.

----------

Disable Spybot's TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

First:

Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
Choose Exit Spybot S&D Resident

Second:

Open Spybot S&D
Click Mode, check Advanced Mode
Go To Left Panel, Click Tools, then also in left panel, click Resident
If your firewall raises a question, say OK
Uncheck the box labeled Resident Tea-Timer and OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Third:

With both Tea timer and SpyBot closed download ResetTeaTimer.zip

Unzip the file.
Double click ResetTeaTimer.bat to remove all entries set by SpyBot's TeaTimer.
Once it's ran, you can delete it. It will not be needed again.

Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

Michael · « **Reply #8 on:** June 08, 2008, 04:22:16 AM »

According to AVG's recource http://www.grisoft.com/ww.special-old-os-app SP2 is suppose to be alright.
Anyway, I've just tried to install AVG 8.0 again, with the old AVG 7.5 uninstalled.
Still same.

I turn off TeaTimer and reset it with the bat file.
Try to install SUPERAntiSpyware again, crash and restart again.

I run the Malwarebytes' Anti-Malware, and the log is attached.

Updated my java to Java 6 Update 6.

Run hijackthis and the log is attached.

[recovering space - attachment deleted by admin]

Broni · « **Reply #9 on:** June 08, 2008, 09:59:46 AM »

First of all, I'd stay away from AVG .0, at least for now.
All kind of problems have been reported all over the net. I experienced them myself. Either go back to ver. 7.5, or go for Avast. Then try Superantispyware again.
Your logs are clean. You ran outdated HJT version, but in XP case, it shouldn't matter.

Michael · « **Reply #10 on:** June 08, 2008, 10:29:47 AM »

I didn't keep the installation file for AVG 7.5, so I re-install Avast instead.
I still couldn't install SUPERAntiSpyware. It still crashes and restarts.
Wonder what is wrong.
Thanks.

Broni · « **Reply #11 on:** June 08, 2008, 10:54:16 AM »

Can you post fresh HJT log? I'd like to check for AVG 8.0 leftovers.

Michael · « **Reply #12 on:** June 08, 2008, 05:34:29 PM »

I've got the AVG 7.5 from filehippo. So I dropped Avast (never like it anyway).

Attached is the HJT log.

Thanks.

[Saving space - attachment deleted by admin]

Broni · « **Reply #13 on:** June 08, 2008, 05:38:43 PM »

Unfortunately, you installed AVG Antispyware, not antivirus

Michael · « **Reply #14 on:** June 08, 2008, 05:39:53 PM »

I just realized the log was before I installed AVG 7.5.

So this is the correct one (5 minutes ago).

Sorry :-P

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #15 on:** June 08, 2008, 05:44:59 PM »

Is your IP in Malaysia?

Broni · « **Reply #16 on:** June 08, 2008, 05:45:20 PM »

That's better.
I assume, you're using Norton, at some point?
If so, open HJT, and checkmark:
- O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Click "Fix checked" button.

How is your computer doing after getting rid of AVG 8.0?

Michael · « **Reply #17 on:** June 08, 2008, 06:30:36 PM »

evilfantasy, yes I am from Malaysia.

Broni, I dropped Norton a few months ago after it expired. I thought AVG performs better than Norton from my experience of using both.

I did not get rid of AVG 8.0 - because it never let me install it due to the weird "unsupported windows version".
Instead, I have some incomplete installation files (folder, shortcut, etc.) from SUPERAntiSpyware as it crashes during installation.

Thanks.

Michael · « **Reply #18 on:** June 08, 2008, 06:32:10 PM »

My computer is doing fine as usual after the AVG 8.0 and SUPERAntiSpyware installation problem.

evilfantasy · « **Reply #19 on:** June 08, 2008, 06:34:54 PM »

Download Combofix by sUBs from one of the below links.

Important! Combofix.exe MUST be saved to and ran from the Desktop.

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
- Click this link to see a list of security programs that should be disabled and how to disable them.
- If yours is not listed and you don't know how to disable it, please ask.
Warning: Combofix disconnects your computer from the internet. The connection is automatically restored before Combofix completes its run.
Double click combofix.exe & follow the prompts.
Choose Yes to accept the Disclaimers.

When finished, it will produce a log for you.
Post that log in your next reply.

Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall

If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If needed, see this Combofix tutorial with screenshots that will detail the downloading and running of combofix more thoroughly.

Michael · « **Reply #20 on:** June 08, 2008, 07:01:23 PM »

Combofix log is attached.
Thanks.

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #21 on:** June 08, 2008, 07:39:26 PM »

Download RegASSASSIN.exe to the desktop.

Open RegAssassin and copy the Registry Key in the Quote box below.

Quote

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor

Now paste it in RegAssassins window and click Delete.

----------

Download SDFix.exe and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Now then reboot your computer in Safe Mode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard).
Finally copy and paste the contents of the results file Report.txt in your next reply.

If SDFix won't run or you get errors, follow the link for instructions on running SDFix. How to use SDFix

Michael · « **Reply #22 on:** June 08, 2008, 08:12:40 PM »

SDFix log attached.
Thanks.

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #23 on:** June 08, 2008, 08:27:48 PM »

Looking better.

Download ATF Cleaner by Atribune.
Note: Vista users must use Run As Administrator

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

----------

Let's clear out the programs we've been using to clean up your computer, they are not suitable for
general malware removal and could cause damage if launched accidentally. These steps will also help secure the work you have done.
.

Click START then RUN
Now type Combofix /u in the runbox
Make sure there's a space between Combofix and /u
Then hit Enter.

.

.
The above procedure will:

Delete:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Set a new, clean Restore Point.

.
----------

Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

----------

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

Go to Start > Programs > Accessories > System Tools and click System Restore
Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Next go to Start > Run and type Cleanmgr
Click OK
Click the More Options Tab.
Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

.
----------

Use the Secunia Software Inspector to check for out of date software.

Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

----------

How is everything now?

Michael · « **Reply #24 on:** June 09, 2008, 08:57:19 AM »

Quote from: evilfantasy on June 08, 2008, 08:27:48 PM

How is everything now?

Well, after all these cleaning processes, I guess it must have been cleaned up a lot.
But I couldn't really tell how much it has improved because I don't have any significant performance issue prior to the cleaning.
But I think the failure of installation of AVG 8.0 and SUPERAntiSpyware must have indicated something not so right.

evilfantasy · « **Reply #25 on:** June 09, 2008, 04:19:34 PM »

Lets do another scan to make sure nothing else is hiding.

Use the Kaspersky Online Scanner

Click Accept.
Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
- Extended
Scan Options:
Scan Archives
Scan Mail Bases

Click OK & have it scan My Computer

When the scan is done, in the Scan is complete window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As...

Next, in the Save as prompt, Save in area, select: Desktop.
In the File name area, use KScan, or something similar.
In Save as type: click the drop arrow and select: Text file [*.txt]
Then, click: Save

Please copy and paste the Kaspersky Online Scanner Report in your next post.[/list]

Michael · « **Reply #26 on:** June 10, 2008, 06:07:17 AM »

Kaspersky Online Scanner log attached.
Thanks.

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #27 on:** June 10, 2008, 09:56:25 AM »

This scanner works with Internet Explorer only
Go to the BitDefender Online Scanner
Click I Agree to the license and then install the ActiveX control.
Please DO NOT change the Scanning Options.
That will make your logs huge and we don't need to see clean files.
Select Start Scan to begin.
This scan can take a while so please be patient and let it complete.

Once Bitdefender completes the scan:
Click-on the Detected Problems tab.
Then select Click here to export the scan report

When the window comes up to save the report, change the Save as type: box to:
Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save

This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later)

This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us

Post the bdscan.txt in the next post.

Michael · « **Reply #28 on:** June 11, 2008, 06:54:46 AM »

I can only save the report as html document, no option for text.
So I rename the file to txt manually.
Thanks.

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #29 on:** June 11, 2008, 11:24:00 AM »

How is everything now?

Michael · « **Reply #30 on:** June 11, 2008, 07:36:46 PM »

AVG 8.0 still would not recognize my Win XP SP2.
SUPERAntiSpyware still crashes during installation.

Other than that, no problem.

Thanks.

evilfantasy · « **Reply #31 on:** June 11, 2008, 07:40:39 PM »

1. Download this diagnostics tool MGADiag.exe and save this to your Desktop.
2. Double-click on MGADiag.exe and click Continue
3. When the program has finished, click on Copy
4. Post the results in your next reply.

Michael · « **Reply #32 on:** June 12, 2008, 09:48:11 PM »

MGADiag result attached.
Thanks.

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #33 on:** June 12, 2008, 10:01:53 PM »

This may be the problem with the installs.

Right now, your computer has a Volume Licensing edition of XP installed, and that installation was done with a now-blocked Volume Licensing Key (VLK). VLKs are blocked by Microsoft at the request of the original keyholder for such reasons as the key was lost, stolen, compromised, misused, or expired. Also, MS may have blocked the key if it notices a pattern of misuse or more installations of XP using that key than authorized.

As a rule, VL editions of XP should not be sold to individual consumers. Businesses, schools and gov'ts normally use VL editions for flexibility in installing many computers.

This may be why you are getting errors on trying to install some programs and you likely aren't able to install any MS updates either.

Look on the computer or in the materials that came with your computer to see if you have a Certificate of Authenticity (COA).

Look for:

1. What edition of Windows XP is it for, Home, Pro, Media Center, or some other edition or version of Windows?
2. Does it read "OEM Software" or "OEM Product" in black lettering?
3. Or, does it have the computer manufacturer's name in black lettering?

Not sure what to look for and more information Click here: http://www.microsoft.com/resources/howtotell/en/coa.mspx

If you have been sold this copy of XP as new then go here:
http://www.microsoft.com/resources/howtotell/reports/report.aspx?displaylang=en

You can call 1-866-PCSAFETY (1-866-727-2338). This phone number is for virus and other security-related support. It is available 24 hours a day for the U.S. and Canada. They will help you get your Windows validated.

Let me know if you need any more information and I will try to help. At this point there isn't much I can do.

Michael · « **Reply #34 on:** June 14, 2008, 04:44:44 AM »

The Windows came together with the computer when I bought it from the shop.
Those information you want me to check is suppose to be on the stickers on the casing, if I'm not mistaken. Unfortunately, my PC is almost 4 years old and I only have some "remaining" of the stickers left on the casing, and I can barely read the printing on it.
You said that "VL editions of XP should not be sold to individual consumers", so I'm wondering whether the shop has bought such VL and use it on the computers sold. While VL allows multiple use of the license, they may have misused the VL on PC sold rather than their own PC at work. Is that possible to happen and is that a fault? I can hardly go back and argue with the shop as it's been so many years and I don't think they will admit the fault.

Anyway, since it's the problem with the Windows license, and my computer seems to be running fine at the moment, I guess that should be it for now.

Thanks for all your support.
Thanks to Broni too.

evilfantasy · « **Reply #35 on:** June 14, 2008, 12:51:35 PM »

The shop probably has a business license to install and sell Windows. The license may have run out and they didn't renew it. Maybe they now install Vista so thought the XP license didn't need to be renewed? Don't know for sure, just speculating. MS is good about working with people on renewing their Windows. It may take supernatural patience and a bit of your time but it would be best to ring them up and give it a try. You may even call the shop who sold it to you. They should know that their license had expired and they have left their customers hanging. They may even know of a better (quicker) way to take care of it. Or they were installing illegitimate copies, Then MS should be made aware of it.

If you have been sold this copy of XP as new then go here:
http://www.microsoft.com/resources/howtotell/reports/report.aspx?displaylang=en

In the event you are a victim of piracy, help is available from this site: http://www.microsoft.com/piracy/

Computer Hope Forum

News:

Author Topic: PC running slow after virus removal (Read 31791 times)

Michael

brett74

Zylstra

Broni

Michael

evilfantasy

Michael

evilfantasy

Michael

Broni

Michael

Broni

Michael

Broni

Michael

evilfantasy

Broni

Michael

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy

Michael

evilfantasy