kangaroo
Topic Starter
I am helping a friend remove Norton (NIS, NSW, N360, NLiveUpdate) and references to her ex-husband from her PC. The PC is a Packard Bell D815AW 1.5GHz which had 128Mb increased to 384Mb RAM with Windows XP Home sp2 purchased late-2001. She uses a dial-up connection with an internal modem. Her PC had stopped responding with the last update to a Norton product (she was unsure which).
Being a Packard Bell, there would have been an icon on the desktop to create a recovery CD from the OS in a hidden partition. Her ex-husband did not do this and there is no recovery CD (I would have preferred to reformat the HDD and start fresh). I used TweakUI to check for the hidden partition but it has been removed (probably to make space as it is only a 35Gb)
It takes 1:05 mins to open the Desktop + a further 1:10 to complete the startup process. It takes 1:15 to shutdown.
It still seems to be quite slow in responding to programs; eg, opening a search windows takes about 30secs.
I've:
used the Norton removal Tool to remove: NIS, NSW, N360, NLU.
removed accounts no longer required.
changed Computer Owner Name to her name (she had bought the PC but her ex-husband had taken it over).
To install SP3 I had to remove a "Documents" folder in C:\ that had no owner and no permissions; I did this by modifying the security settings for it and its sub-folders (it looked like a newly created MyDocuments folder when Windows is first installed). Once this was done, the folder disappeared and SP3 installed without the failure to copy "beethov9.wma" which had been occurring repeatedly.
In the process of removing this "Documents" folder, I've then gone in Safe Mode | CMD prompt; I found and removed the contents and directories under C:\Apps\Norton (various).
As any attempt to use IE or OE invoked an ISP's signup version of the Internet Connection Wizard, I installed Chrome browser.
I installed:
Kaspersky Internet Security 2010.
OpenOffice.org v3.1
Thunderbird e-mail client.
When I've returned the PC and connected to her dialup account I'll install Mailwasher v6.1 Free to check mail on sever before downloading.
I've deleted most of the $NTinstallKB* folders in C:\Windows (some, although selected, did not delete).
I've uninstalled Microsoft Money 2002 (left over from MS Works which did not appear on the Add/Remove list).
I've used:
EasyCleaner to remove invalid registry entries and "unnecessary" files including Internet temporary files, Cookies and History.
NTregOpt to defrag the registry,
Diskcleanup to remove temporary files.
I've defragmented the C: drive; I have 71% free space on the HDD.
I then turned off System rstore to remove old restore points; turned System restore back on and created a post-Cleanup restore point.
I've installed and run MalwareBytes AM tool; there were 3 items found:
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Files Infected:
C:\WINDOWS\system32\spoolsvc.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\videosd32.exe (Backdoor.Bot) -> No action taken.
EasyCleaner reports csrss.exe as a suspect startup item. This file is located in the Windows\system32 folder; I think this is a required part of Windows.
KIS reports Windows\system32\drivers\MSIKBD2K.SYS as a PDM.Keylogger. The motherboard is an MSI one and I think this is a keyboard driver.
I've reduced the startup programs to just KIS2010, OOo quickstart, HPmonitor, Network connection and ATi video control.
I've not changed the hosts file.
I've stopped the Indexing Service.
I've removed Windows components Internet Explorer and Outlook Express (they were ISP versions which would only invoke the Internet Connection Wizard).
I've got the MBAM and HiJackThis logs I ran after cleaning the PC as best I could.
Is there anything else I could do (without being able to reformat the HDD to start afreash) to speed up this PC?
