Computer Hope

Software => Computer viruses and spyware => Topic started by: Michael on June 06, 2008, 09:26:39 PM

Title: PC running slow after virus removal
Post by: Michael on June 06, 2008, 09:26:39 PM
A few days ago my computer at work was infected by a virus. So I installed AVG 8.0 and removed the virus and all infected files.
Ever since the removal, the computer has been running slow - slow response and freezes.

During startup, when the computer seems to be ready to use, if I click on My Computer or Start or any other program, it will take a few minutes to response.

After an application is running, e.g. Explorer, IE, MS Words, Photoshop, etc., the applications will run as smooth as usual, until you do something like open a file from the file menu, save, or try to start another application. In those cases, the computer will freeze and take a few minutes to response.

FYI, the other 3 computers on the network which was also infected by the same virus 
and cured by AVG as well,  do not have the same freezing or slow issue. It is only my computer which I first installed AVG and removed the virus.

All computers are running Win XP Professional SP2. I've rescan all the computers with AVG and no further threats are found.

What could be the reason that only my computer has the issue?

Thanks.
Title: Re: PC running slow after virus removal
Post by: brett74 on June 06, 2008, 09:30:44 PM
hi welcome to computer hope please read this link and a malware specialist will be with you shortly


http://www.computerhope.com/forum/index.php/topic,46313.0.html
Title: Re: PC running slow after virus removal
Post by: Zylstra on June 06, 2008, 10:12:28 PM
I would recommend trying the following until you recieve further assistance after uploading your HiJackThis log and other things in the extremely handy guide that Brett74 has just linked to

Clicking Start> Run
Typing CMD and pressing ENTER
Then type (in the black command prompt window):

sfc /scannow

Have your Windows XP CD Ready

This may repair any files that a virus may have modified (for the worse) or damaged (for the worst...)
Title: Re: PC running slow after virus removal
Post by: Broni on June 06, 2008, 11:26:20 PM
Follow both advice, then couple of questions...
1. What are computer specs: processor speed, amount of RAM, hard drive size/free space?
2. Do other computers have similar specs?
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 12:49:02 AM
Thanks for the responses.

While I will not be in the office until tomorrow, I decided to check my own computer at home with the given instructions.

First I did what Zylstra suggested. Then I go to evilfantasy's guide.

Step A: Antivirus I have Avast 4.8 home edition & AVG 7.5 on my PC. When I download the latest AVG 8.0 and try to install/upgrade, I got the error message that I have an unsupported windows version. I'm running Win XP SP2, so I'm wondering.

Step 1: Add/Remove Program No suspicious program/malware.

Step 2: House Cleaning Cleared all those temporary files and cache.

Step 3: SUPERAntiSpyware Here is another problem. During the installation process, Spybot S&D will detect a registry change and prompts me whether to allow or deny it. But before I can even move my mouse, the computer crashes and restarts.

So what do I do now?

Thanks and sorry for jumping to my own computer's issue rather than my original problem with computer at work.
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 08, 2008, 01:16:43 AM
Quote
Step A: Antivirus I have Avast 4.8 home edition & AVG 7.5 on my PC. When I download the latest AVG 8.0 and try to install/upgrade, I got the error message that I have an unsupported windows version. I'm running Win XP SP2, so I'm wondering.

You should never run two antivirus at the same time. It will do nothing but cause problems. Pick one and uninstall the other.

----------

Shut down Tea Timer during the removal process.

Disable Spybot's TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

First:

Second:
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 02:52:27 AM
I uninstalled Avast but AVG 8.0 still wouldn't allow me to install due to the same unsupported windows reason.

I disabled (unchecked) TeaTimer in SpyBot S&D, but the installation of SUPERAntiSpyware still crashes as it finish.

Also, after I unchecked the TeaTimer checkbox, exit and restart, if I go to the page again, the checkbox is still remain checked. 
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 08, 2008, 03:11:15 AM
I don't know if AVG is refusing to install because you aren't running SP3, but that is the only thing I can think of. You may need to reinstall Avast so you do have an antivirus running until it gets sorted out.

Turn off Tea Timer again but this time do step 3 as well. If needed skip Superantispyware and go on to Malwarebytes.

----------

Disable Spybot's TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

First:

Second:
Third:

With both Tea timer and SpyBot closed download  ResetTeaTimer.zip (http://www.techsupportforum.com/sectools/ResetTeaTimer.zip)
Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 04:22:16 AM
According to AVG's recource http://www.grisoft.com/ww.special-old-os-app (http://www.grisoft.com/ww.special-old-os-app) SP2 is suppose to be alright.
Anyway, I've just tried to install AVG 8.0 again, with the old AVG 7.5 uninstalled.
Still same.

I turn off TeaTimer and reset it with the bat file.
Try to install SUPERAntiSpyware again, crash and restart again.

I run the Malwarebytes' Anti-Malware, and the log is attached.
 
Updated my java to Java 6 Update 6.

Run hijackthis and the log is attached.



[recovering space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: Broni on June 08, 2008, 09:59:46 AM
First of all, I'd stay away from AVG .0, at least for now.
All kind of problems have been reported all over the net. I experienced them myself. Either go back to ver. 7.5, or go for Avast. Then try Superantispyware again.
Your logs are clean. You ran outdated HJT version, but in XP case, it shouldn't matter.
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 10:29:47 AM
I didn't keep the installation file for AVG 7.5, so I re-install Avast instead.
I still couldn't install SUPERAntiSpyware. It still crashes and restarts.
Wonder what is wrong.
Thanks.
Title: Re: PC running slow after virus removal
Post by: Broni on June 08, 2008, 10:54:16 AM
Can you post fresh HJT log? I'd like to check for AVG 8.0 leftovers.
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 05:34:29 PM
I've got the AVG 7.5 from filehippo. So I dropped Avast (never like it anyway).

Attached is the HJT log.

Thanks.

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: Broni on June 08, 2008, 05:38:43 PM
Unfortunately, you installed AVG Antispyware, not antivirus :)
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 05:39:53 PM
I just realized the log was before I installed AVG 7.5.

So this is the correct one (5 minutes ago).

Sorry :-P

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 08, 2008, 05:44:59 PM
Is your IP in Malaysia?
Title: Re: PC running slow after virus removal
Post by: Broni on June 08, 2008, 05:45:20 PM
That's better.
I assume, you're using Norton, at some point?
If so, open HJT, and checkmark:
- O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Click "Fix checked" button.

How is your computer doing after getting rid of AVG 8.0?
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 06:30:36 PM
evilfantasy, yes I am from Malaysia.

Broni, I dropped Norton a few months ago after it expired. I thought AVG performs better than Norton from my experience of using both.

I did not get rid of AVG 8.0 - because it never let me install it due to the weird "unsupported windows version".
Instead, I have some incomplete installation files (folder, shortcut, etc.) from SUPERAntiSpyware as it crashes during installation.

Thanks.
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 06:32:10 PM
My computer is doing fine as usual after the AVG 8.0 and SUPERAntiSpyware installation problem.
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 08, 2008, 06:34:54 PM
Download Combofix by sUBs from one of the below links.

Important! Combofix.exe MUST be saved to and ran from the Desktop.Warning: Do not mouseclick combofix's window while it is running. That may cause it to stallCF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If needed, see this  Combofix tutorial (http://www.bleepingcomputer.com/combofix/how-to-use-combofix) with screenshots that will detail the downloading and running of combofix more thoroughly.
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 07:01:23 PM
Combofix log is attached.
Thanks.

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 08, 2008, 07:39:26 PM
Download  RegASSASSIN.exe (http://"http://www.malwarebytes.org/RegASSASSIN.exe") to the desktop.

Open RegAssassin and copy the Registry Key in the Quote box below.

Quote
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor

Now paste it in RegAssassins window and click Delete.

----------

Download SDFix.exe (http://downloads.andymanchesta.com/RemovalTools/SDFix.exe) and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Now then reboot your computer in Safe Mode by doing the following:

If SDFix won't run or you get errors, follow the link for instructions on running SDFix. How to use SDFix (http://www.bleepingcomputer.com/forums/topic131299.html)
Title: Re: PC running slow after virus removal
Post by: Michael on June 08, 2008, 08:12:40 PM
SDFix log attached.
Thanks.

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 08, 2008, 08:27:48 PM
Looking better.

Download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune.
Note: Vista users must use Run As Administrator (http://"http://vistasupport.mvps.org/run_as_administrator.htm")
If you use Firefox browser
If you use Opera browser
Click Exit on the Main menu to close the program.

----------

Let's clear out the programs we've been using to clean up your computer, they are not suitable for
general malware removal and could cause damage if launched accidentally. These steps will also help secure the work you have done.
.
.
(http://i154.photobucket.com/albums/s258/evilfantasy69/combofixu-1.jpg)
.
The above procedure will:.
----------

Download OTMoveIt2 by OldTimer  OTMoveIt2.exe (http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe) and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

----------

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.
.
----------

Use the  Secunia Software Inspector (http://secunia.com/software_inspector) to check for out of date software.
----------

How is everything now?
Title: Re: PC running slow after virus removal
Post by: Michael on June 09, 2008, 08:57:19 AM
How is everything now?
Well, after all these cleaning processes, I guess it must have been cleaned up a lot.
But I couldn't really tell how much it has improved because I don't have any significant performance issue prior to the cleaning.
But I think the failure of installation of AVG 8.0 and SUPERAntiSpyware must have indicated something not so right.
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 09, 2008, 04:19:34 PM
Lets do another scan to make sure nothing else is hiding.

Use the  Kaspersky Online Scanner (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html)When the scan is done, in the Scan is complete window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As...

(http://i154.photobucket.com/albums/s258/evilfantasy69/kscancomplete.jpg)

(http://i154.photobucket.com/albums/s258/evilfantasy69/Kas-Savetxt.gif)

Please copy and paste the Kaspersky Online Scanner Report in your next post.[/list]
Title: Re: PC running slow after virus removal
Post by: Michael on June 10, 2008, 06:07:17 AM
Kaspersky Online Scanner log attached.
Thanks.

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 10, 2008, 09:56:25 AM
This scanner works with Internet Explorer only
Go to the  BitDefender Online Scanner (http://www.bitdefender.com/scan8/ie.html)
Click I Agree to the license and then install the ActiveX control.
Please DO NOT change the Scanning Options. 
That will make your logs huge and we don't need to see clean files.

Select Start Scan to begin.
This scan can take a while so please be patient and let it complete.

 Once Bitdefender completes the scan: 
 Click-on the Detected Problems tab.
 Then select Click here to export the scan report

(http://i154.photobucket.com/albums/s258/evilfantasy69/Tutorials/bit.jpg)
 
 When the window comes up to save the report, change the Save as type: box to:
 Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save

(http://i154.photobucket.com/albums/s258/evilfantasy69/Tutorials/bit2.jpg)
 
 This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later)
 
 This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.
 
 If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us
 
 Post the bdscan.txt in the next post.
Title: Re: PC running slow after virus removal
Post by: Michael on June 11, 2008, 06:54:46 AM
I can only save the report as html document, no option for text.
So I rename the file to txt manually.
Thanks.

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 11, 2008, 11:24:00 AM
How is everything now?
Title: Re: PC running slow after virus removal
Post by: Michael on June 11, 2008, 07:36:46 PM
AVG 8.0 still would not recognize my Win XP SP2.
SUPERAntiSpyware still crashes during installation.

Other than that, no problem.

Thanks.
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 11, 2008, 07:40:39 PM
1. Download this diagnostics tool  MGADiag.exe (http://go.microsoft.com/fwlink/?linkid=52012) and save this to your Desktop.
2. Double-click on MGADiag.exe and click Continue
3. When the program has finished, click on Copy
4. Post the results in your next reply.
Title: Re: PC running slow after virus removal
Post by: Michael on June 12, 2008, 09:48:11 PM
MGADiag result attached.
Thanks.

[Saving space - attachment deleted by admin]
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 12, 2008, 10:01:53 PM
This may be the problem with the installs.

Right now, your computer has a Volume Licensing edition of XP installed, and that installation was done with a now-blocked Volume Licensing Key (VLK).  VLKs are blocked by Microsoft at the request of the original keyholder for such reasons as the key was lost, stolen, compromised, misused, or expired.  Also, MS may have blocked the key if it notices a pattern of misuse or more installations of XP using that key than authorized.

As a rule, VL editions of XP should not be sold to individual consumers. Businesses, schools and gov'ts normally use VL editions for flexibility in installing many computers.

This may be why you are getting errors on trying to install some programs and you likely aren't able to install any MS updates either.

Look on the computer or in the materials that came with your computer to see if you have a Certificate of Authenticity (COA).

Look for:

1.  What edition of Windows XP is it for, Home, Pro, Media Center, or some other edition or version of Windows?
2.  Does it read "OEM Software" or "OEM Product" in black lettering?
3.  Or, does it have the computer manufacturer's name in black lettering?

Not sure what to look for and more information Click here:  http://www.microsoft.com/resources/howtotell/en/coa.mspx

If you have been sold this copy of XP as new then go here:
http://www.microsoft.com/resources/howtotell/reports/report.aspx?displaylang=en

You can call 1-866-PCSAFETY (1-866-727-2338).  This phone number is for virus and other security-related support. It is available 24 hours a day for the U.S. and Canada. They will help you get your Windows validated.

Let me know if you need any more information and I will try to help. At this point there isn't much I can do.


Title: Re: PC running slow after virus removal
Post by: Michael on June 14, 2008, 04:44:44 AM
The Windows came together with the computer when I bought it from the shop.
Those information you want me to check is suppose to be on the stickers on the casing, if I'm not mistaken. Unfortunately, my PC is almost 4 years old and I only have some "remaining" of the stickers left on the casing, and I can barely read the printing on it.
You said that "VL editions of XP should not be sold to individual consumers", so I'm wondering whether the shop has bought such VL and use it on the computers sold. While VL allows multiple use of the license, they may have misused the VL on PC sold rather than their own PC at work. Is that possible to happen and is that a fault? I can hardly go back and argue with the shop as it's been so many years and I don't think they will admit the fault.

Anyway, since it's the problem with the Windows license, and my computer seems to be running fine at the moment, I guess that should be it for now.

Thanks for all your support.
Thanks to Broni too.
Title: Re: PC running slow after virus removal
Post by: evilfantasy on June 14, 2008, 12:51:35 PM
The shop probably has a business license to install and sell Windows. The license may have run out and they didn't renew it. Maybe they now install Vista so thought the XP license didn't need to be renewed? Don't know for sure, just speculating. MS is good about working with people on renewing their Windows. It may take supernatural patience and a bit of your time but it would be best to ring them up and give it a try. You may even call the shop who sold it to you. They should know that their license had expired and they have left their customers hanging. They may even know of a better (quicker) way to take care of it. Or they were installing illegitimate copies, Then MS should be made aware of it.

If you have been sold this copy of XP as new then go here:
http://www.microsoft.com/resources/howtotell/reports/report.aspx?displaylang=en

In the event you are a victim of piracy, help is available from this site: http://www.microsoft.com/piracy/ (http://www.microsoft.com/piracy/)