75 replies to this topic

[Angel2121]

Hello,

I have been having problems with my computer for about two weeks now, yet nothing has completely solved my problem. So, the trajectory:

Two weeks ago, my computer acquired a virus of some sort. I'd get these windows popping up that said something like "Windows Vista 2010 Antivirus" had detected a problem. I couldn't get rid of it, so I turned the computer off and decided to deal with it the next morning. The next day, those windows no longer popped up. But I couldn't run any programs because every time I tried to open a program Windows Internet Explorer icons would exponentially pop up. But all you could see in these windows was the bar at the top; the window itself was clear. In fact, if I turned on my computer at all, those windows would pop up so that the number would eventually reach into the hundreds. All of my icons turned into mini-Internet Explorer icons. I could only use the computer in Safe Mode or under another user that I'd created. Virus and Malware scans did not detect anything when I logged in under the other user, and only the antivirus program would work in Safe Mode. Still, it detected nothing. I eventually did a System Restore under the other user. And so the virus was gone.

The computer worked fine for the rest of that day. But the next day, my computer became really, really slow. It would work for a few minutes but then programs would constantly not be responding even if I let the computer sit forever. I could only get programs to work in Safe Mode. Still, even in Safe Mode, my computer gets slower each day.

Still, nothing detected. I can't complete an A-squared scan, however, and various other things don't work. Today, when I tried to scan with A-squared, it stopped at the following point:
HKEY_USERS/Aspnet/Software/SoftActivity/Activity Logger/cstorage

I can still only use my computer in Safe Mode.

I started a topic in the Infections Removal area, and after various steps was told that I should ask for help here. There's more information about what's been going on in that thread: http://forums.whatth...592#entry635592

I'm literally at my wit's end, and I have no idea what to do. Thanks for the suggestions!

Edited by Angel2121, 23 February 2010 - 05:57 PM.

[Don't Spam Me]

From the reports you posted in the other thread, I can't help but get the impression that you are also running a variety of antivirus and antispyware products concurrently. While I am personally (at least lately) a fan of Norton Internet Security (albeit only versions 2009 and 2010), it is rather picky about being the only one of its kind that is running all the time on your system. As such, Symantec recommends to not have SpyBot Search & Destroy, AVG, and various of the other products running on your system concurrently. Otherwise this can result in a sever performance impact, especially if you are running multiple antivirus type products concurrently.

To remedy this situation, select a single suite that you would like to keep running as protection on your system, or - alternatively - select a single product in each category (without overlaps) that will serve a specific purpose (one firewall program, one antivirus product, one antispyware). Preferably uninstall the other products so that there will be no conflicting driver or at a minimum configure them to not run anymore.

To uninstall a program, open the Start Menu, and go to the Control Panel, then double-click on Programs and Features. Now you can right-click the respective application's name and select uninstall.

Once you have removed the extraneous security programs, check if the performance of your computer is any better.


Also, Lets run a PC PitStop test so I can see some details about your computer.

How to run PCPitStop's Overdrive tests:

* Please go to the PCPitStop Overdrive sign-up page, click here, Signup at PCPitStop (You need to use Internet Explorer with this test so that an ActiveX control can be installed.)
* Click "Create a free account "
* Enter in your relevant information on the sign-up page. You must sign-up in order to have your results recorded so that we can take a look at them here.
* After signing up you'll see the "Registration Complete" page, and you can click "Test Your System Now" to return to the test page.
* Login with your newly created e-mail address and password on the left hand side.
* Follow the directions to "Scan this system now." An activeX control will need to be installed. It is safe, and you should allow it to be installed.
* Once the tests have been run, you will see an "Almost there" page requesting further information about your computer and your experience with PCPitStop, just scroll down to the bottom and click "GO."
* A test results page will display, and I need the link to that page.
* Look in the address bar of your browser. It will look like 'http://www.pcpitstop.com/betapit/...' Please copy and paste that here to the forum.

Note: PCPitStop may recommend that you use certain utilities to fix problems on your computer.
At WhatTheTech, the help we provide is free. We do not endorse or recommend the use of any products PCPitStop may suggest.
Instead, we prefer to help you with each issue manually without using possible pay to use programs.



Have a look here, for how to post a link to your Results:
http://www.pcpitstop...ress/howto1.asp

Edited by Don't Spam Me, 23 February 2010 - 10:21 PM.

[Angel2121]

My Norton Antivirus is out of date. My computer won't let me uninstall it. It also won't let me uninstall my Ad-Aware, which is out of date. I uninstalled A-squared successfully, though. My computer is still running slowly, etc.

Here's the link to the scan from PCPitStop: http://www.pcpitstop...?conid=23360595

[Don't Spam Me]

My Norton Antivirus is out of date. My computer won't let me uninstall it. It also won't let me uninstall my Ad-Aware, which is out of date. I uninstalled A-squared successfully, though. My computer is still running slowly, etc.

I have a few questions for you:

• Which tasks are listed in Task Manager as causing the highest CPU load? (to see this, use the key combination Ctrl-Alt-Delete to bring up a screen in Vista that allows you to Start Task Manager; once Task Manager is running, click on the Processes tab and on said tab's screen, click on the header of the CPU column to sort by CPU load. If all of the CPU values you see are zero, click the header of the CPU column again). Please report back the Image Name and CPU entries of the top 5 items.
• What happens when you do a right-click on the Norton Internet Security icon in your task tray (bottom right of the screen) and select Run LiveUpdate? Does Norton download the respective updates? If not, what's the exact error message you are presented with?
• What happens when you do a right-click on the Norton Internet Security icon in your task tray (bottom right of the screen) and select Run QuickScan? Does Norton perform the quick scan? If not, what's the exact error message you are presented with? If yes, what did Norton find?
• What happens when you try to uninstall Ad-aware? Please provide a detailed description of any problems you are encountering and/or the exact (error) message you are faced with.
• What happens when you try to update Spybot Search & Destroy? (To update Spybot without running the application, click on Start > All Programs > Spybot - Search & Destroy > Update Spybot-S&D then click on Search and select a "Mirror", click Continue and then click on Download). Please provide a detailed description of any problems you are encountering and/or the exact (error) message you are faced with.

[Don't Spam Me]

Also, could you please include in your next reply the contents of your hosts file?

To do so, please copy and paste the following into the command bar (white field labeled "Start Search") available when you click the Start button:

notepad c:\windows\system32\drivers\etc\hosts

Once the hosts file has been opened, go to Edit > Select All, then Edit > Copy and paste everything into your reply.

Close the hosts file.

[Angel2121]

1) Task Manager: firefox.exe 75 Isass.exe 14 csrss.exe 08 taskmgr.exe 02 System 02 2) Norton: If I try to do a Live Update, nothing pops up. If I try to run a scan, nothing pops up. Those icons aren't in my tray right now. Also, I haven't purchased Norton; the Norton that's on my computer is an expired free trial that came with my computer. 3) Ad-Aware: If I try to uninstall it, nothing happens. No messages pop up. 4) SpyBot updated successfully. 5) Hosts File: # Copyright © 1993-2006 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost ::1 localhost

[Jacee]

If I may step in here for a bit, download Norton Removal Tool: http://majorgeeks.co...Tool_d4749.html

Go into Services, by typing services.msc in the run box, click ok, then scroll through the services window and set anything with "Norton/Symantec" to disabled.

Now click on the Norton Removal Tool and follow the instructions.

BTW... you have Spybot's TeaTimer, which may be interfering with uninstalling programs. You can disable it by:
Open Spybot and click on Mode and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on System Startup icon.
Uncheck Teatimer box and Uncheck Resident.
Click Allow Change box.
Look at the right hand corner of the screen to see if the icon for Spybot resident is still there. If it is, click it and choose exit.

[Don't Spam Me]

1) Task Manager:
firefox.exe 75

How many tabs do you have open in Firefox? How many Firefox windows do you have open? Also, which add-ons do you have installed in Firefox (see Tools > Add-ons?

4) SpyBot updated successfully.

Now that SpyBot has been updated, you might want to run a SpyBot scan of your computer for good measure and report back what, if anything, was found by SpyBot.

[Angel2121]

I'm not on the computer with issues anymore, but I do want to answer your first question, Don't Spam Me. I only had one Firefox window and tab open at the time when I looked at Task Manager. Also, even if I'm not on Firefox, even if I'm doing nothing on the computer, the CPU usage on Task Manager still says 100%. As for Add-Ons . . . I know I have Foxmarks. Not sure what else I have, if anything else. I'll check when I get home. Jacee, thanks for the helpful advice. I will attempt to do the steps you suggested when I get home as well as run Spybot.

[Angel2121]

I uninstalled Norton, but my computer is still having the same problems. When I'm not running any programs, Task Manager says CPU usage is 100%. At the top of the bar at that point, it says: svchost.exe 97. I am currently running Spybot, but I doubt that it will do anything to fix the problem because I've been updating and running it daily since my problems started, and they still haven't gone away. Before I got the virus, my computer was running just fine. Never too slow, and the CPU usage was never 100%. It was only after I did System Restore and got rid of the virus that my computer became slow. I don't have any programs that I didn't have before then. So, why would that happen? I'll post later with what Spybot has found. I just wanted to give an update in case these facts are relevant.

[Don't Spam Me]

When I'm not running any programs, Task Manager says CPU usage is 100%. At the top of the bar at that point, it says:
svchost.exe 97.

Please download Process Explorer to your desktop (available here) and then double-click it to run Process Explorer.

This tool provides more detailed information than the regular Windows Task Manager. If the following columns are not displayed already, please right-click on the column headings and place check marks in front of the following entries:

• Description
• Path
• Command Line

In addition to the Process (= name) and CPU entry of the offending process, please also report back the aforementioned items for said process.

EDIT: Please hold off on the above until the Spybot scan you are running is finished.

Edited by Don't Spam Me, 24 February 2010 - 04:59 PM.

[Angel2121]

The Spybot scan is finished. It found tracking cookies from the following places: Casale Media DoubleClick FastClick Media Plex Right Media I had Spybot clean it up, but my computer is still slow as ever. Onward to the next step.

[Angel2121]

All right. These are the contents of the file that I saved from Process Explorer-- The high number, usually 95-100, seems to linger at svchost.exe 1056. That would be this line: svchost.exe 1056 100.00 Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe I hope that I've included the right amount of information.

Edited by Angel2121, 24 February 2010 - 05:42 PM.

[Jacee]

This isn't going to help the high CPU load, but your java is outdated and vulnerable to a malicious attack. I saw where sweet tech instructed you to download Java Runtime Environment (JRE) 6u18, please do that.

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "Java Runtime Environment (JRE) 6u18 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.

Also, let's restore your hosts file:
Download the HostsXpert 4.3 - Hosts File Manager.

• Unzip HostsXpert 4.3 - Hosts File Manager to a convenient folder such as C:\HostsXpert
• Click HostsXpert.exe to Run HostsXpert 4.3 - Hosts File Manager from its new home
• Click "Make Hosts Writable?" in the upper right corner (If available).
• Click Restore Microsoft's Hosts file and then click OK.
• Click the X to exit the program.
  
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself. <--- re-immunize with Spybot

One more thing to do ... flush your DNS cache:

Open a command prompt....from the Start menu, select Run > In the box/"open field", enter cmd.exe

type or copy/paste ipconfig /flushdns press 'enter'



Successful DNS Flush /\

When all of this is done, clean out all temporary files/cookies/history and defrag. Reboot/restart you computer and see if it's better than it was.

[Don't Spam Me]

Given that you are still on Vista Service Pack 1, please take the time to install Service Pack 2 (SP2) and all other missing security and critical updates offered by Microsoft.

SP2 included various performance improvements and more importantly addresses several security vulnerabilities in Vista.

Please report back your computer's status once you have taken the steps outlined in the message above and in this message.