[Closed] slow startup of 64bit OS

My system seems to be very slow in both startup and launching programs. I have run eastcleaner to clean unneccessary files and cleared cookies and internet files. I have also ran Avira virus remover and superantispywear. I am unable to run DDS and rootkits since they dont work on 64bit OS. What can I do to get help? Thanks for your assistance

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:

• Logs from malware removal programs can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instruction that I give you.
  Reading too lightly will cause you to miss important steps, which could have destructive effects.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within five days. I will post a reminder should you seem to fail to do this, however, if you fail to reply within five days then,
  unless I have been notified of your absence in advance, the topic shall be closed!
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your log, I will post back shortly with instructions.

Scanning with OTS
Download OTS to your Desktop

• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program.
• Check the box that says Scan All Users
• Check the box that says 64 bit
• Under Additional Scans check the following:
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EvtViewer (last 10)
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

Running Rooter
Download Rooter.exe to your desktop

• Then doubleclick it to start the tool
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Please make sure you include the following items in your next post:
1. The log that was produced after running OTS.
2. The log that was produced after running the Rooter Scan.
3. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Hello kevin_czarnota! It's been several days since I last posted instructions for you to complete. Do you still require assistance in getting your computer cleaned up? Thanks, SweetTech.

Yes I still need the help. Thanks for all your help during this busy time of the year. 1) I have attached the OTS file. I am not sure I attached it correctly. 📎OTS.Txt 2) When I try to run root.exe. after I click scan, it comes back and says that malware has stopped running. Dont know what that means. 3) System still runs slow

Sorry for the delay.

Running OTS Fix
Start OTS Copy/Paste the information inside the codebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-2707694908-3892883027-3287269716-1001\] > ->
YN -> HKEY_USERS\S-1-5-21-2707694908-3892883027-3287269716-1001\: URLSearchHooks\\"" [HKLM] -> Reg Error: Key error. [Reg Error: Value error.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-2707694908-3892883027-3287269716-1001\] > -> HKEY_USERS\S-1-5-21-2707694908-3892883027-3287269716-1001\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Vista Active Application Exception Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules
YN -> {4AEB4E82-7E42-4BCA-9909-75798BA8D49D} -> profile=private | protocol=17 | dir=in | action=allow | name=bearshare | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe |
YN -> {58BD493F-C473-4586-941E-9122D4C19D16} -> profile=private | protocol=17 | dir=in | action=allow | name=limewire | app=c:\program files (x86)\limewire\limewire.exe |
YN -> {918C607B-9294-4A0C-9DD2-E68FE6C46BE5} -> profile=private | protocol=6 | dir=in | action=allow | name=μtorrent (tcp-in) | app=c:\program files (x86)\utorrent\utorrent.exe |
YN -> {E27F1C6D-C8FA-4196-B29F-089E2D571A93} -> profile=private | protocol=17 | dir=in | action=allow | name=μtorrent (udp-in) | app=c:\program files (x86)\utorrent\utorrent.exe |
YN -> {E4F7F739-6D41-4064-9DF5-815130927EA3} -> profile=private | protocol=6 | dir=in | action=allow | name=bearshare | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe |
YN -> {FB45C07D-4E52-485D-8769-DF3CB7FAB7CC} -> profile=private | protocol=6 | dir=in | action=allow | name=limewire | app=c:\program files (x86)\limewire\limewire.exe |
[Files - No Company Name]
NY -> SmartDefrag.job -> C:\Windows\tasks\SmartDefrag.job
NY -> Smart Defrag.lnk -> C:\Users\Public\Desktop\Smart Defrag.lnk
[File - Lop Check]
NY -> IObit -> C:\Users\Carla\AppData\Roaming\IObit
NY -> IObit -> C:\Users\Guest\AppData\Roaming\IObit
NY -> IObit -> C:\Users\kevin\AppData\Roaming\IObit
NY -> SmartDefrag.job -> C:\Windows\Tasks\SmartDefrag.job
[Empty Temp Folders]
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.

Please make sure you include the following items in your next post:
1. The log that was produced after running OTS.
2. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Thanks for the help. Here is the log file 1) the OTS fix log file All Processes Killed [Registry - Safe List] Registry key HKEY_USERS\S-1-5-21-2707694908-3892883027-3287269716-1001\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks not found. Registry key HKEY_USERS\S-1-5-21-2707694908-3892883027-3287269716-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4AEB4E82-7E42-4BCA-9909-75798BA8D49D} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AEB4E82-7E42-4BCA-9909-75798BA8D49D}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{58BD493F-C473-4586-941E-9122D4C19D16} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58BD493F-C473-4586-941E-9122D4C19D16}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{918C607B-9294-4A0C-9DD2-E68FE6C46BE5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{918C607B-9294-4A0C-9DD2-E68FE6C46BE5}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E27F1C6D-C8FA-4196-B29F-089E2D571A93} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E27F1C6D-C8FA-4196-B29F-089E2D571A93}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E4F7F739-6D41-4064-9DF5-815130927EA3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4F7F739-6D41-4064-9DF5-815130927EA3}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{FB45C07D-4E52-485D-8769-DF3CB7FAB7CC} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB45C07D-4E52-485D-8769-DF3CB7FAB7CC}\ not found. [Files - No Company Name] C:\Windows\tasks\SmartDefrag.job moved successfully. C:\Users\Public\Desktop\Smart Defrag.lnk moved successfully. [File - Lop Check] C:\Users\Carla\AppData\Roaming\IObit\IObit SmartDefrag folder moved successfully. C:\Users\Carla\AppData\Roaming\IObit folder moved successfully. C:\Users\Guest\AppData\Roaming\IObit\IObit SmartDefrag folder moved successfully. C:\Users\Guest\AppData\Roaming\IObit folder moved successfully. C:\Users\kevin\AppData\Roaming\IObit\IObit SmartDefrag folder moved successfully. C:\Users\kevin\AppData\Roaming\IObit folder moved successfully. File C:\Windows\Tasks\SmartDefrag.job not found! [Empty Temp Folders] User: All Users User: Carla ->Temp folder emptied: 80166177 bytes ->Temporary Internet Files folder emptied: 18181867 bytes ->Java cache emptied: 23576494 bytes ->FireFox cache emptied: 58442666 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Guest ->Temp folder emptied: 656619 bytes ->Temporary Internet Files folder emptied: 43821311 bytes ->Java cache emptied: 2931268 bytes ->FireFox cache emptied: 91628235 bytes User: kevin ->Temp folder emptied: 320607 bytes ->Temporary Internet Files folder emptied: 10819843 bytes ->Java cache emptied: 34130260 bytes ->FireFox cache emptied: 96988399 bytes User: kids ->Temp folder emptied: 2776246 bytes ->Temporary Internet Files folder emptied: 105014768 bytes ->Java cache emptied: 4326592 bytes ->FireFox cache emptied: 35571577 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes Windows Temp folder emptied: 1727334 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33109 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 174630 bytes Total Files Cleaned = 583.03 mb < End of fix log > OTS by OldTimer - Version 3.1.10.0 fix logfile created on 12172009_153415 Files\Folders moved on Reboot… File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWDQBLW7\desktop.ini scheduled to be moved on reboot. File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8MKD8MI\desktop.ini scheduled to be moved on reboot. File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J2BLBWON\desktop.ini scheduled to be moved on reboot. File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4SHON69G\desktop.ini scheduled to be moved on reboot. File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot. File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot. Registry entries deleted on Reboot… The system seems to reboot quickly but firefox seemed to take along time loading. longer than it did before the fix Thanks for the help Kevin

Peer to Peer Program
While reviewing your logs I noticed that you currently have Peer to Peer program(s) installed on your computer.

You currently have the following P2P programs installed:

• BearShare
• LimeWire
• uTorrent

Most of the infections that we see today are through P2P file sharing. By uninstalling the programs that I mentioned above you will be doing yourself a favor. It's impossible to trust the source of what is being downloaded from them and a file may or may not be what it appears to be.

Should you decide to keep these programs installed on your computer PLEASE do not use these programs while we are getting your P.C. cleaned up.

How to Uninstall the P2P Programs:

• Click Start
  
• Go to Control Panel
  
• Go to Add/Remove Programs
  
• Find and click Remove for the following (if present):
  
• BearShare
• LimeWire
• uTorrent

PLEASE NOTE: When your uninstalling the P2P Program(s) some questions are worded in various ways to try and deceive you and keep you from uninstalling their Program.

Running Rooter
Go ahead and delete the copy of Rooter that you have on your Desktop and re-download a new copy from here to your desktop

• Then doubleclick it to start the tool
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan.

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time. Please don't go surfing while your resident protection is disabled! Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the [external image: Posted Image] button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option "Remove found threats" is Unchecked
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the [external image: Posted Image] button.
• Push [external image: Posted Image]

Please make sure you include the following items in your next post:
1. The log that was produced after running Rooter.
2. The log that was produced after running MalwareBytes' Anti-Malware.
3. The log that was produced after running ESET Online Virus Scanner.
4. An outstanding issues (if any) that you are experiencing with your computer.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Hello kevin_czarnota! It's been several days since I last posted instructions for you to complete. Do you still require assistance in getting your computer cleaned up? Thanks, SweetTech.

Due to inactivity this topic will be closed. If you need help please start a new thread.