47 replies to this topic

[psuproud]

Files attached. Please help, my computer is so slow!

Attached Files

•  attach.txt   12.46K   8 downloads
•  dds.txt   23.15K   7 downloads

[MrCharlie]

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.
For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.
When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

[psuproud]

RogueKiller V8.2.3 [11/07/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Website: http://tigzy.geeksto...roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Pete and Angie [Admin rights]
Mode : Scan -- Date : 11/08/2012 21:53:56

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤
[TASK][SUSP PATH] Update Check : C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe /s /p 1 -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK7575GSX +++++
--- User ---
[MBR] 0620568a4e92b1a57cf1f725971cb351
[BSP] e71a258848592aa13e93040422faf414 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 689299 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1412093952 | Size: 21842 Mo
3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1456826368 | Size: 4062 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_11082012_02d2153.txt >>
RKreport[1]_S_11082012_02d2153.txt

[MrCharlie]

Not much showing....lets run some scans: (I'm gone for tonight...be back in AM)

First >>>

Please download Listparts64

Run the tool, click Scan and post the log (Result.txt) it makes

~~~~~~~~~~~~~

Next..........

Download TFC to your desktop
Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

~~~~~~~~~~~~

Next.........

Please read the directions carefully so you don't end up deleting something that is good!!

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:
How To Run TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  
  
  
• Put a checkmark beside loaded modules.
  
  
  
• A reboot will be needed to apply the changes. Do it.
  
• TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  
• Then click on Change parameters in TDSSKiller.
  
• Check all boxes then click OK.
  
  
  
• Click the Start Scan button.
  
  
  
• The scan should take no longer than 2 minutes.
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  
  
  Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
  
  
  Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  
• A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
  
• Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.


New window that comes up.


~~~~~~~~~~~~~~~~~~

Last.....


Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.
MrC

[psuproud]

ListParts by Farbar Version: 30-10-2012
Ran by Pete and Angie (administrator) on 09-11-2012 at 19:02:35
Windows 7 (X64)
Running From: C:\Users\Pete and Angie\Downloads
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 28%
Total physical RAM: 8139.6 MB
Available physical RAM: 5844.59 MB
Total Pagefile: 16277.39 MB
Available Pagefile: 13816.99 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:673.14 GB) (Free:571.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (Recovery) (Fixed) (Total:21.33 GB) (Free:2.3 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 698 GB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 199 MB 1024 KB
Partition 2 Primary 673 GB 200 MB
Partition 3 Primary 21 GB 673 GB
Partition 4 Primary 4062 MB 694 GB

======================================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 SYSTEM NTFS Partition 199 MB Healthy System (partition with boot components)

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 673 GB Healthy Boot

======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 D Recovery NTFS Partition 21 GB Healthy

======================================================================================================

Disk: 0
Partition 4
Type : 0C
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 E HP_TOOLS FAT32 Partition 4062 MB Healthy

======================================================================================================

****** End Of Log ******

[MrCharlie]

The rest of the logs?????

MrC

[psuproud]

19:42:18.0583 4564 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
19:42:18.0895 4564 ============================================================
19:42:18.0895 4564 Current date / time: 2012/11/09 19:42:18.0895
19:42:18.0895 4564 SystemInfo:
19:42:18.0895 4564
19:42:18.0895 4564 OS Version: 6.1.7601 ServicePack: 1.0
19:42:18.0895 4564 Product type: Workstation
19:42:18.0895 4564 ComputerName: PETEANDANGIE-HP
19:42:18.0895 4564 UserName: Pete and Angie
19:42:18.0895 4564 Windows directory: C:\Windows
19:42:18.0895 4564 System windows directory: C:\Windows
19:42:18.0895 4564 Running under WOW64
19:42:18.0895 4564 Processor architecture: Intel x64
19:42:18.0895 4564 Number of processors: 8
19:42:18.0895 4564 Page size: 0x1000
19:42:18.0895 4564 Boot type: Normal boot
19:42:18.0895 4564 ============================================================
19:42:19.0316 4564 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:42:19.0316 4564 ============================================================
19:42:19.0316 4564 \Device\Harddisk0\DR0:
19:42:19.0316 4564 MBR partitions:
19:42:19.0316 4564 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800
19:42:19.0316 4564 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x54249800
19:42:19.0316 4564 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x542AD800, BlocksNum 0x2AA9000
19:42:19.0316 4564 \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x56D56800, BlocksNum 0x7EF000
19:42:19.0316 4564 ============================================================
19:42:19.0332 4564 C: <-> \Device\Harddisk0\DR0\Partition2
19:42:19.0379 4564 D: <-> \Device\Harddisk0\DR0\Partition3
19:42:19.0379 4564 E: <-> \Device\Harddisk0\DR0\Partition4
19:42:19.0394 4564 ============================================================
19:42:19.0394 4564 Initialize success
19:42:19.0394 4564 ============================================================
19:42:51.0218 2376 Deinitialize success

[psuproud]

 TDSSKiller.2.8.15.0_09.11.2012_19.46.05_log.txt   535.76K   5 downloads

[psuproud]

About to run combo-fix. Thanks for your help!

[psuproud]

 ComboFix.txt   28.2K   6 downloads

[MrCharlie]

Looks Good.....

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Then............

Please download AdwCleaner from here and save it on your Desktop.

• Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  
• Now click on the Search tab.
  
• Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

[psuproud]

Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.11.09.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Pete and Angie :: PETEANDANGIE-HP [administrator]

Protection: Enabled

11/9/2012 10:21:55 PM
mbam-log-2012-11-09 (22-21-55).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 202325
Time elapsed: 1 minute(s), 51 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[psuproud]

# AdwCleaner v2.007 - Logfile created 11/09/2012 at 22:26:01
# Updated 06/11/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Pete and Angie - PETEANDANGIE-HP
# Boot Mode : Normal
# Running from : C:\Users\Pete and Angie\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\Users\Public\Desktop\eBay.lnk

***** [Registry] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKU\S-1-5-21-3606036441-1526649529-2363943152-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v11.0 (en-US)

Profile name : default
File : C:\Users\Pete and Angie\AppData\Roaming\Mozilla\Firefox\Profiles\0f67sjgf.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1263 octets] - [09/11/2012 22:26:01]

########## EOF - C:\AdwCleaner[R1].txt - [1323 octets] ##########

[MrCharlie]

A couple of items found....lets clear it out.....

• Please re-run AdwCleaner
  
• Click on Delete button.
  
• Confirm each time with OK if asked.
  
• Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

~~~~~~~~~~~~~~~~~~

Then.....

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.

MrC (be back in the am)

[psuproud]

# AdwCleaner v2.007 - Logfile created 11/09/2012 at 22:36:26
# Updated 06/11/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Pete and Angie - PETEANDANGIE-HP
# Boot Mode : Normal
# Running from : C:\Users\Pete and Angie\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Users\Public\Desktop\eBay.lnk

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v11.0 (en-US)

Profile name : default
File : C:\Users\Pete and Angie\AppData\Roaming\Mozilla\Firefox\Profiles\0f67sjgf.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1388 octets] - [09/11/2012 22:26:01]
AdwCleaner[R2].txt - [1448 octets] - [09/11/2012 22:32:44]
AdwCleaner[S1].txt - [1238 octets] - [09/11/2012 22:36:26]

########## EOF - C:\AdwCleaner[S1].txt - [1298 octets] ##########

[psuproud]

Results of screen317's Security Check version 0.99.54
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Security Suite
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
JavaFX 2.1.1
Java 7 Update 9
Adobe Flash Player 11.4.402.287
Mozilla Firefox 11.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

[MrCharlie]

Quote

Mozilla Firefox 11.0 Firefox out of Date! <---------please check for an update

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download TFC to your desktop
Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Reboot and let me know how it is, MrC

[psuproud]

Mr. C - only a small improvement if any..........what do you think?

[MrCharlie]

Make sure the drive is running in DMA mode:

http://www.thewindow...n-windows-7.htm

MrC

[psuproud]

I didn't have any "channels" under the controller.