Windows Assistance - No Malaware but slow PC from Virus

Hi there, I just had some trojans and now my computer is clean of malaware. I have been instructed to ask for some assistance in this forum because of the slow log on time and overall decreased performance in my machine. Here's the link to the previous virus assistance I just had. Plus any recommendation on performance

http://forums.whatthetech.com/Virus_Assistance_t103766.html

Thanks in advance for your help.

Had a look through that and tend to agree something has become upset, 1st job is get shot of Norton, it's living off it's past rep, but do NOT try and uninstall it normally, it gets everywhere and a clean uninstall is not easy, instead get and run they're tool and it will remove it completely, then get either Avast or Avir to replace it as they are both free and far superior.

You may find this alone makes a big difference, because one of the biggest gripes against Norton is the slow down it causes many users, but as we are here anyway go to the Pit and get a free account, then run the full set of tests, once on the results screen the url is the link we need back here then we can view those results as well and offer advice on the various areas as needed, by getting the account it means the tests are saved, otherwise you would not be able to give us the link as it would be dead when you left it, but do this and report back and we can move on.

Thanks for spending some time to help me. What about the software NOD32? Either the anitvirus or more so the smartsecurity (because of the firewall)? I was thinking smart security or kaspersky. I have a home office with 3-4 computers setup so I would like to use the same software and be protected with a firewall too. Please let me know what you recommend prior to my uninstalling and reinstalling of antivirus software as that's a pain in the butt. Basically is there a benefit to paying for nod32 or should i just use the free ones and do you recommend one more so than the other?

Yes if you are looking to a paid for solution then that is a great choice, if I were to pay it is the one I would use. As to benefits over free alternatives, it's up for discussion, there are many thoughts about the subject, but putting it simply, no single piece of protection can catch everything, so there are no sure fire unbeatable choices, apart from pulling the net anyway, now the free options I mentioned are free for personal use I think, not sure how that fits with your situation, so check that out, but they are the 2 big hitters that most use and they work well, of course both have paid versions as well. The firewall has a few options, again it depends what you want, I personally prefer separate components rather than all in packages, because the first job of an infection is to shut down your protection, having an all in package means it has only 1 thing to disable the way I see it, by having separate pieces your more likely to notice something going ion before everything gets to far, but others may have a different view to this, but ultimately you can use windows own firewall (not very good IMHO), a 3rd party firewall of an inclusive package that does it all, either of these last choices require the windows firewall is disabled. What I suggest is with this info have a think, check out the free cover and see how it applies to your situation, and check out the costings for the 2 paid solutions you have considered (they are both very good), and bare in mind if using on more than 1 system you will need a multi user licence, I know the Kaspersky one comes with a 3 user licence as standard, not sure about NOD32, but see what you think with this and feel free to ask more if needed.

Are these some examples of firewall software that you use? These were recommended to me in my previous post. I want to try and figure out which antivirus I should buy and which firewall to use in conjunction with it. In the post that recommended this help for window they recommended a bunch of different software. For my business it's my father and me with a few computers and it's a home network. I can set it up for personal use; I just want to make sure that there's no better protection for businesses / major users of the internet (that lack the knowledge of how to protect themselves. # SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. # SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

SpywareBlaster is a definite plus as it consumes no system resources and blocks an extensive list of known-bad URLs. It even runs well with Vista. SpywareGuard (by the same excellent authors at JavaCoolSoftware) is in my opinion less useful and less well updated. It also consumes system resources and has been the single factor of slowing down machines that I've seen. Others may disagree and you may benefit from a "test drive". It is nice to have as a real-time background scan if you can afford the system resources without bogging down. You have not indicated a software Firewall. I use the (free) Zone Alarm others like Comodo which is fine Note: In all cases, when installing (free) versions of utilities, READ the EULA and use the Manual install instead of the automated or "express" install. "Express install" sometimes will throw in some additional features and bloat search engine features that you may not have wanted to have on your machine. Therefore take the extra time to read and manage the installation. Best Regards

I'm amazed by your comment about SpywareGuard Doug, in my experience it uses no resources at all, it is such a lightweight bit of kit it's a no brainer, yes I appreciate the long time gap from it's last update is cause for concern, but they have been questioned about this, and although they say there is a new one in development (no time frame though), this one still works well due to it's heuristics it uses (something like that anyway), but given it's so lightweight I always install it on every system I touch, and I have yet to experience ANY issues with it.

But I agree with SpywareBlaster, also add the Hosts file as well for even more cover, the one you mention covers flash based hosts, but the Hosts covers other types of infection, so one backs the other up so to speak.
The firewall comes down to what you go with overall, eg if you get an inclusive package then the firewall will come with that, you can also run windows own firewall, but TBH I don't rate it and always advise to get another one (remembering to disable the windows one when you do), and the ones above are about the only ones I ever recommend, ZA is my weapon of choice, but there are quite a few people who always seem to have issues with it, personally I have only ever had 1 system play up with it, but when that happens I use Comodo, fantastic firewall, but way to complex for me to use as I like complete control, but it's very good at what it does.

The most important thing to remember is the 1 at a time rule, basically you must only ever have 1 firewall, 1 anti virus and 1 anti spyware product running real time protection at the same time, doing so causes problems and can allow stuff to slip through, you can however have as many standalone scanners as you like, just remember to disable real time cover of the same type before running one of these scanners, but it's always a good idea to double check every so often that nothings got past the real time cover, because no single thing can catch everything.

I will list the files I use, many will say it's overkill, but when you consider most are simply standalone scanners that are ruin on demand and not in real time I don't really have that many things running, but when you look at your options you need to decide whats best for you, we can't 2nd guess your requirements or situation, but we can point out things to watch out for and possible pit falls so you can make the best decision for you, but you need to decide whether you will use an all in one paid for suite, or individual programs, if your busy as I suspect you are, you may find an all in one suite your best way to go, but whichever way you go you can have all the standalone scanners you like, just disable real time cover before running them.

Here is my arsenal of protection I use:-
a-squared Free = Standalone scanner, the paid version offers real time cover.
avast! 4 Home Edition = Free anti virus, they also have a paid version.
Belarc Advisor = Warns if your missing any m$ updates and links to further info\downloads if required.
BugOff = A 1 time use to close security holes m$ haven't, but note if you use OE as a mail client do NOT disable the 1st option, or else you wont be able to read your mail.
CWShredder = A standalone scanner for the CWS infections.
Flash Disinfector = Helps stop thumb drives transferring infection(s) between systems.
Hosts = Mentioned above.
Iconix = Helps warn against fraudulent emails from official sources like bank's, eBay, PayPal etc, the list is constantly growing.
Malwarebytes Anti-Malware = Standalone scanner, the paid version offers real time cover.
SiteAdvisor = A very simple traffic light based warning system when searching and surfing to warn of good\bad pages etc.
Spybot-S&D = Standalone scanner, TeaTimer counts as real time cover, but I personally run without that component so it is a scanner only.
SpywareBlaster = Mentioned above.
SpywareGuard = Mentioned above.
SUPERAntiSpyware = Standalone scanner, the paid version offers real time cover.
ThreatFire = Additional anti virus cover, works with other anti virus's for the most part, but there are exceptions, Kaspersky is one.
WinPatrol = An essential tool to protect your hosts file and home page, also allows control over your start up programs.
WOT = The same as SiteAdvisor basically.
ZoneAlarm = Firewall.

There are 2 suites that if I were to pay would consider, NOD32, pretty much the tops from my understanding, or Kaspersky, also very good, but there are 2 things to bare in mind, what works well for one person, may not do the same for another, there are often quirks in peoples systems that can throw a spanner in the works.
The other is people will have their favourites, which usually come about from using various tools over time they have found certain ones to be the best for what they need, so often you will find like you can see here that sometimes people have different views\experience with certain tools, anyway hope this helps you to choose what you need.

Wow!! That's a lot of information. Let me give you some background because I'm ready to move forward but would appreciate some advice based off my needs. So I use windows xp pro with mainly I.E. (8 or older; 1 computer from a friend doesn't have the license for xp pro updated and I keep getting the winlogon carp**, he corrected it several times but it still has the issue and hasn't updated window in a while (aka years). I use mozilla for research. MS Outlook 2003 and ACT! by Sage 2007 (9.0) Version 9.0.1.162. The computers will be for my father and I using them for work and personal use. I know that ACT has a SQL server running and then I have a fax plugged into one computer and that uses some resources. The HJ for this other computer without updates is at the end of my last string that I was referred over for windows assistance for from malaware. I'm using malawarebytes not paid version, ATF cleaner and I believe that's it. I do have Spybots Search and Destroy and Adaware on both too. But I don't believe I have the tea timer setup because I wasn't sure what it actually does and my father would get asked questions he doesn't know the answer to. Please advise if spyware blaster is better or the same, etc.. I was thinking for anitivirus NOD32 (I believe without the firewall based on your suggestions but won't this be more difficult for my father??) , then using spyware blaster and zonealarm or comodo if I don't get the all in one antivirus/firewall. So I know that's a lot, but any help is greatly appreciated and I believe I'm down to some final decisions and actions. Any idea what I can do for the one computer with the windows issue too?

Your buddy who sold you the machine without a valid XP operating system was not being much of a friend. You remain quite vulnerable with an un-patched Windows operating system. <– not good at all. Is it a "brand name" machine, such as Dell, HP, Compaq ??? If so you may be able to give them the machine identification Model and serial number to allow them to sell you XP at their OEM low cost…. often as little as $30 for the disk. You could then make a fresh installation with that legitimate operating system, adding motherboard chipset drivers, and component drivers. Then you would need to update the service packs, patches, and updates….. before anything else. Then you could safely install your application software and any data necessary.

The most important thing to remember is the 1 at a time rule, basically you must only ever have 1 firewall, 1 anti virus and 1 anti spyware product running real time protection at the same time, doing so causes problems and can allow stuff to slip through, you can however have as many standalone scanners as you like, just remember to disable real time cover of the same type before running one of these scanners, but it's always a good idea to double check every so often that nothings got past the real time cover, because no single thing can catch everything.

I do agree that certain programs cause conflicts with each other and should not be used together under any circumstances. But, I also choose to never run more than one real-time scanner at once for anything (that includes an anti-virus and anti-spyware package - Most anti-virus packages include the anti-spyware nowadays, even if some are better than others) unless I was running on a government super computer. The slowdown and resource hog of this would be unbearable for me personally. Some progams are better than others, and not one program catches everything, like you said. But, I must also add that using EVERY program together would still not catch everything, so where do you draw the line? I'm one to sacrifice "security" for performance, because personally, I don't feel that having 12 programs compared to 2 programs makes any significant improvement in security. The skill level of the user comes into play here. I think most would agree that the majority of infections occur because the user invites them on to their computer under the guise of the next best cleaning tool, or free game. So, again, I question how "secure" any number of programs actually makes a user when they might just be confused by the message and make the wrong decision, or just click past the warning anyways.

But, concerning running multiple products at the same time, this is the way things usually work for me, and are preferrable in my opinion. When I do a supplemental scan, I don't disable my real-time protection. The reason for this is because the scanning "chains" together. For instance, I like to use Avast real-time, and use MalwareBytes as a supplemental scan. I will fire up MalwareBytes, and tell it to scan an entire drive and I will leave Avast running. Whenever MalwareBytes attempts to access a file, Avast nabs it and scans it first, then malwarebytes gets to scan it. So, with one single scan, I get two products scanning every file. Avast grabs most of the files, and whats left over, MalwareBytes grabs, and whats left over in the end, I grab. The only draw back to this (and this is specific to the way Avast and some others function) is that when Avast detects something, it halts everything and requires me to answer what I want to do with it because the real-time scanner is catching it. So, its a bit of a pain if I am scanning a drive that has a lot of malware on it because I have to keep walking over to my laptop and clicking "Delete." so that malwarebytes can continue scanning. For this same reason, this is why I would never run multiple real-time products together even if one was considered an "anti-virus" and the other an "anti-spyware." It doesn't change the fact that you now have TWO programs scanning every file before you get to access it. Generally speaking that would mean that it now takes about twice as long to scan the file, and that your system has slowed down significantly. Just think about all the hundreds of files that are accessed every second when programs are being loaded, and the O/S is performing system functions. That adds up to a lot of lost CPU time.

There is always new stuff coming out, and nothing will ever catch everything, so users should be aware of false security and make safe computing a practice which eliminates the need for a dozen different scanning programs. If your supplemental scan is catching something, you are already possibly infected, because your real-time protection should've stopped it before it got on your computer. This greatly reduces the chances that these same "great" programs can clean the computer anyways.

Ultimately, I think we should be educating users, such as this OP's father, about how to avoid malware so that they can rely less on fallible security products and have security that no number of programs can ever provide.

As you stated, this is definitely a controversial subject, and everyone has a different opinion. I'm not sure that there is any right or wrong for any user. Its a matter of what works for that specific person. For me, I prefer performance. While another might not mind the slowdowns or problems possibly caused by some of these things and prefer the increased security.

No it's not branded, one that he made. He had a valid license for it which is one thing I made certain of; we see how that turned out with friends. It used to be a gamine tower that he used to use, but he had no use for because he was a techie and updated his equipment a lot. He fixed it several times but somehow it keep re-occurring. This is one of the reasons we're not friends because he didn't stand by his work and didn't like me asking for assistance (i.e. updating microsoft). The only thing that seems to be wrong is the invalid key so I don't believe I need to reinstall anything just update but to spend the money on new software license I'm better off just throwing this 4-6 year old thing out (not making tons of cash right now so trying to wait and maybe go mac or upgrade within next 6 -12 months). I totally agree that most people (including dad) click past the firewall. As I joke with him "Yes, you just clicked here to download the virus". This is one reason I wanted to use an all in one for anitivirus, spam and firewall like ESET Smart Security 4. I dislike, due to experiences, Norton, Macafee??, Trendmicro.. So what I need is one that doesn't utilize too many resources and can exclude certain files like my act database & fax software from active scans. But one that can provide me with support or at least have the best protection out there and I believe that ESET Smart Security 4 is the way to go or the plain AntiVirus. Should I keep using Spybots Search and Destroy (?? Do I need this with the rest? Do I use the Tea Timer?), Adaware, SpywareBlaster and Comodo??? This is where it get's tricky. The biggest question I have NOD32 & Comodo or EST Smart Security 4? I agree with the fact that all in one firewall, antivirus is bad. So using NOD32 with Comodo seems to have it's own antivirus with the free firewall? Is there an option for only the firewall in the setup? Please advise and thanks for the feedback.

@ jdurham05, Please don't be panicked by the big list, only 3 items from it would be running at the same time, all the others either allow you to double check your main protection if you have cause to suspect something may be going on, or they add updated definitions to to the system and are simply run once tools so to speak, I don't mean you only use them once, but say once a day or so to check fore updates, takes maybe a minute each time and thats it. Now although I have reservations over all in one packages, I don't have anything bad to say as such, it's more paranoia and expecting the worst case scenario, but given your situation I do actually think NOD32's full suite may be your best choice, using other products such as ZoneAlarm requires the user to grant permission for each time something wants to go online, and that can be very daunting for anyone who's not sure, it's easily dealt with when you know how, but in your case I think this would cause to many stressful moments for yourselves trying to figure what it is wanting to go online each time. The best bet for you is get NOD32 and use the trial that they offer, it will allow you to test drive it and see how you get on with it, this way if you didn't like it, or had problems with it you haven't wasted any money and can swap to another choice, hope this makes things easier for you. @ appleoddity, Yes that is correct and what I was saying basically, although looking back and considering newer programs often contain more than 1 element I should get used to adding an extra line explaining more, but what you suggest about the anti virus containing anti spyware as well still comes under the 1 at a time rule, and if anything raises an even bigger warning over stopping real time cover BEFORE running any other scan of thew same type. Running what I do above has no performance hit whatsoever, you never run more than 3 of them at the same time, the browser add on's some may feel are a performance hit, but for those who don't know what to be aware of the simple traffic light warning system is a great help to users to warn of dangers they would be oblivious to, and although they run in real time they aren't subject to the 1 at a time rule and in all the systems I've set them up on I have yet to notice a slow down. But allowing real time cover to run while running a scan of the same type is very bad, it can cause conflict and miss things, so if your anti virus contains anti spyware as well, you need to disable that from running BEFORE running any other like scan, not doing this breaks the 1 at a time rule, and as the rule states, only 1 item offering real time cover of each type should be run at the same time, so if your anti virus covers anti spyware as well then you do not use a separate anti spyware product running real time as it's already included. I agree education is paramount, but TBH you can never teach a person how to spot a page that has malicious code on it, this is more a personal experience thing where you start to pick up warning signs of issues, this is where the browser add on's support the unknowing user, they take no special knowledge to use, and they warn, and even block in known severe risk to stop the user accessing bad sites, and as it's a simple traffic light everyone knows green is good\go and red is bad\stop, but we all agree no single thing can catch everything, but double checking your real time cover periodically with 3rd party scans is never a bad thing IMHO. @ jdurham05, the system you mention, I can't make out what your saying, does it have a valid licence\sticker with it or not ? You say you made sure it was legit, but you then say it's coming back as not ? There should be no problem running m$ update with a valid licence, and if you have installed WGA (Windows Genuine Advantage) which you often have too to run the update, then if the system did not have a genuine key you would not be able to do anything, every time it boots you would get warning about piracy and to contact m$ to get a full licence, so is any of this happening ?

Yes, I'm getting the WGA at login. He had installed everything and it must be a fake license because he's did updates but then it comes back.

Well only thing you can do is check the sticker on the case and make sure it is the one applied to the system, of course this assumes you can access the system without WGA locking you out until you resolve the issue, but that said by running WGA you should end up being offered an opportunity to reenter the licence and check again that it is a legit one, but if it does turn out to be a dodgy copy then you have no option but to get a new legitimate OS, I believe you can buy a licence from m$ direct from the WGA options.

I have fixed the error with wga. It's updating but the issue I have is that ESET Smart Security firewall will not work on this computer. Any ideas? Here's my hj log. 📎HJTLog.txt