Computer Hope
Software => Computer viruses and spyware => Topic started by: ajamj on November 29, 2008, 06:55:25 PM
-
My computer has been running very slow. It sometimes takes 5 minutes for IE to open and each new window takes just as long. Other programs also seem to take forever to open and if I have several things open (Outlook and IE, for example) it may take even longer. I had thought that maybe all the junk my kids had downloaded was the problem, but they both left home recently and I removed all their files. No help.
Windows XP Home Version 2002
Service Pack 3
Gateway
Intel
Pentium 4 CPU 2.40GHz
2.39 GHz
256 MB of RAM
My logs are attatched, however my daughter used the computer in between steps 2 and 3. Don't know if it matters.
Thank you so very much!
[Saving space - attachment deleted by admin]
-
Go to Add/Remove Programs and uninstall:
Ask.com
Ask Toolbar
or anything with Ask in the name.
----------
Open HijackThis and select Do a system scan only.
Place a check mark next to the following entries: (if there)
- R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
- O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
- O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O2 - BHO: (no name) - {891B76B0-D49C-4D9B-BCB3-40C919F5FD62} - (no file)
- O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
- O3 - Toolbar: (no name) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
- O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
- O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
- O15 - Trusted Zone: http://www.adobe.com
- O15 - Trusted Zone: http://www.drewdavisband.com
- O15 - Trusted Zone: http://*.turbotax.com
- O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} -
- O18 - Filter hijack: text/html - (no CLSID) - (no file)
- O20 - Winlogon Notify: ssqomlm - ssqomlm.dll (file missing)
- O23 - Service: McAfee Application Installer Cleanup (0038321227012829) (0038321227012829mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\003832~1.EXE (file missing)
- O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
Important: Close all windows except for HijackThis and then click Fix checked.
Exit HijackThis.
----------
Download the Norton Removal Tool (SymNRT) (http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039) to your Desktop.
Once downloaded please close ALL open browsers, also save any work because this may require a restart.
- Go to your desktop and double click on the removal tool and then click Setup.
- Once open Click Next
- Accept the license agreement and click Next
- Type in the letters/numbers that you see into the text box then click Next.
- Then click Next and the tool will start running.
- Once finished restart the PC and run the tool again to ensure everything has been removed.
- Delete Nortonremoval tool from your Desktop.
----------
Download Disable/Remove Windows Messenger (http://www.majorgeeks.com/DisableRemove_Windows_Messenger_d2327.html) to the Desktop to remove Windows Messenger.
Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.
Unzip the file on the Desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.
Exit out of MessengerDisable then delete the two files that were put on the Desktop.
Run CCleaner and restart the computer.
----------
Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.
Link #1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link #2 (http://subs.geekstogo.com/ComboFix.exe)
**Note: It is important that it is saved directly to your Desktop
Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.
Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.
Double click combofix.exe & follow the prompts.
For Windows XP Systems install the Recovery Console:
- If you are using Windows XP and do not already have the Recovery Console installed, please ensure your Internet connection is active (if possible) and click Yes.
- If for some reason your Internet is not working click No.
- If you are not using Windows XP, you will not be prompted.
- When prompted to accept the EULA click OK.
- Accept Microsoft's EULA (Click Yes).
- When you are told that the RC is installed correctly click YES to continue scanning for malware.
When finished ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.
Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.
Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.
-
-modest-
Welcome to CH.
As you can see this is a virus related issue and not just regular maintenance.
Please read this thread: Would you like to learn to fight malware? (http://www.computerhope.com/forum/index.php/topic,57605.0.html)
Again, Welcome...
-
And after you take care of your virus issue, buy some more RAM. I do not even try to run Windows with less than 1GB. Windows is a memory hog and loves to eat it. 256MB is just a snack for Windows. You will get a lot of trashing on your system page/swap file, (slow disk I/O) which can slow your system way down.
Even with 1 and 1/2 to 2GB on all my systems, I still use IOBit's Advanced SystemCare SmartRAM utility. Windows is terrible about not freeing up RAM that should be on your free memory list. It is a great freeware tuneup package for adware, registry, disk defragger, privacy, etc. I run it once a week on all my systems. The first time scan found and fixed dozens of potential issues. Just pick any download site listed in the middle column and wait for the dialog box to pop up.
http://www.majorgeeks.com/download.php?det=5927
Good luck.
-
Here are the new logs.
[Saving space - attachment deleted by admin]
-
Windows is terrible about not freeing up RAM that should be on your free memory list.
a bit off-topic- but windows doesn't necessarily free memory such as that used for file buffers, file handles, GDI handles, etc- rather, it caches it- then, if that same file is opened again, then windows will re-use the same handle and buffers.
If another process needs memory and all physical RAM is occupied, the file read buffers will be flushed and the handles deleted, etc.. to make room for the other processes data.
This is essentially what RAM optimization programs do. A very simple ram optimization program would simply be calls to GlobalCompact() and similiar functions every minute or so, as well as a current free memory display.
Another method used is to send WM_COMPACTING to every top-level window in the system, but that greatly reduces performance, and so is not used.
Not to say the programs do no good at all- when in the situations mentioned, with very little total RAM- you don't want to waste it on some old file buffer.
With a lot of memory- the operation takes a lot longer and the benefits are far reduced, though.
-
Open HijackThis and select Do a system scan only.
Place a check mark next to the following entries: (if there)
- O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Important: Close all windows except for HijackThis and then click Fix checked.
Exit HijackThis.
----------
- Click START then RUN
- Now type Combofix /u in the runbox
- Make sure there's a space between Combofix and /u
- Then hit Enter.
- The above procedure will:
- Delete the following:
- ComboFix and its associated files and folders.
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Set a new, clean Restore Point.
----------
Download
ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your Desktop.
Alternate download link (http://majorgeeks.com/ATF_Cleaner_d4949.html)
Note: Vista users must use Run As Administrator (http://vistasupport.mvps.org/run_as_administrator.htm)
- Under Main: Select Files to Delete choose: Select All.
- Click the Empty Selected button.
- If you use Firefox browser click Firefox at the top and choose: Select All
- Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
- If you use Opera browser click Opera at the top and choose: Select All
- Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
- Click Exit on the Main menu to close the program.
Note that your system will run slower for a reboot or two after having used this tool so don't panic.
----------
Download OTCleanIt.exe (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to your Desktop.
- Double-click OTCleanIt.exe.
- Click the CleanUp! button.
- Select Yes when the "Begin cleanup Process?" prompt appears.
- If you are prompted to Reboot during the cleanup, select Yes.
- The tool will delete itself once it finishes, if not delete it yourself.
Important: Restart the computer before continuing.
----------
How is everything now?
.
-
Thank you!
To give it a test, I had Outlook, Media Player, and IE all open and things ran, no stalls, no 5 minute waits! ;D
Which of the programs that I downloaded should I keep?
Thank you!
-
Keep SUPERAntiSpyware and MBAM. Update and run a scan now and then with them.
Disable the System Restore Utility to prevent re-infection from an old one
1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Put a check mark next to Turn off System Restore on All Drives
4) Click the OK button.
5) You will be prompted to restart the computer. Click the Yes button.
Now re-enable System Restore
To re-enable the System Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.
1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Remove the check mark next to Turn off System Restore on All Drives
4) Click the OK button.
----------
Use the Secunia Software Inspector (http://secunia.com/software_inspector) to check for out of date software.
- Click Start Now
- Check the box next to Enable thorough system inspection.
- Click Start
- Allow the scan to finish and scroll down to see if any updates are needed.
- Update anything listed.
.
----------
Go to Microsoft Windows Update (http://windowsupdate.microsoft.com/) and get all critical updates.
----------
Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.
Concerned about Browser Security? Consider using Mozilla Firefox 3.0 (http://www.spreadfirefox.com/node&id=224248&t=324) with Adblock Plus (https://addons.mozilla.org/en-US/firefox/addon/1865) and NoScript (http://noscript.net/)
To prevent unknown applications from being installed on your computer install WinPatrol 2008 (http://www.winpatrol.com/winpatrol.html)
* Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
I suggest using SiteAdvisor (http://www.siteadvisor.com/). SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* (http://www.bleepingcomputer.com/tutorials/tutorial49.html)Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/forums/tutorial49.html)
* If you don't know what ActiveX controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
Check out Keeping Yourself Safe On The Web (http://evilspages.blogspot.com/2008/05/keeping-yourself-safe-on-web.html) for tips and free tools to help keep you safe in the future.
Also see Slow Computer? It May Not Be Malware (http://evilspages.blogspot.com/2008/05/slow-computer-it-may-not-be-malware.html) for free cleaning/maintenance tools to help keep your computer running smooth.