Computer slow, popus reply to emeraldnzl

Emeraldnzl, Ok, I've done the things you have recommended and here are the two logs. The first is the log from Malewarebytes, the second from OTL Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4184 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/9/2010 5:05:10 PM mbam-log-2010-06-09 (17-05-10).txt Scan type: Quick scan Objects scanned: 181752 Time elapsed: 16 minute(s), 12 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Sonic RecordNow! deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages:C:\WINDOWS\system32\iifgghIA deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 2877 bytes User: Hunter ->Temp folder emptied: 24264303 bytes ->Temporary Internet Files folder emptied: 22986275 bytes ->Java cache emptied: 1 bytes ->Apple Safari cache emptied: 241700 bytes ->Flash cache emptied: 7993 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 65670 bytes User: LocalService.NT AUTHORITY.003 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 141714323 bytes ->Flash cache emptied: 11852 bytes User: Owner User: Rob ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 25493627 bytes ->Flash cache emptied: 84 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 40096 bytes %systemroot%\System32 .tmp files removed: 1383572 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 8967787 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 13500498 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33726 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 228.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.5.3 log created on 06092010_153423 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFB21A.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFB225.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFB281.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFB28C.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFB2BB.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFB2C6.tmp not found! C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\VKXGMC5C\aceUAC[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\VKXGMC5C\computer_slow_popus_t112480[1].html moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\VKXGMC5C\stCAGB389E moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\VKXGMC5C\st[10] moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\VKXGMC5C\st[11] moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\RPIXOVT4\fc[3].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\RPIXOVT4\welcome[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\PII9IIGJ\iframe[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\PII9IIGJ\md[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\PII9IIGJ\st[9] moved successfully. File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\AJDAZ4YO\iframe[1].htm not found! C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\AJDAZ4YO\st[4] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IW42HEY8\see_through_1[1].flv moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8MV26MOW\MC_spotxchange[1].swf moved successfully. C:\WINDOWS\temp\fla3E.tmp moved successfully. File\Folder C:\WINDOWS\temp\Perflib_Perfdata_bf4.dat not found! Registry entries deleted on Reboot…

Hi woolybugger,

• Close all windows and open OTL again.
• Under the Custom Scan box paste this in
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\user32.dll /md5
  %systemroot%\system32\ws2_32.dll /md5

• Click Run Scan and let the program run uninterrupted
• It will produce a log for you. Post the log here.

Emeraldnzl, My apologies for taking so long to reply (away on vacation), and for not following directions on my last post. I've gone back through and done as you have directed. At one time i did have McAfee in addition to Malwarebytes, but McAfee was removed about a month or two ago. I've double checked on my add/remove and there was nothing related to it on there. I have also run the OTL as you directed, as well as Malwarebytes, and I will attach their logs. Thanks. All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Sonic RecordNow! not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages:C:\WINDOWS\system32\iifgghIA deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Hunter ->Temp folder emptied: 1288803956 bytes ->Temporary Internet Files folder emptied: 55352122 bytes ->Java cache emptied: 10680381 bytes ->Google Chrome cache emptied: 819568 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 7838 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33186 bytes User: LocalService.NT AUTHORITY.003 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 101303737 bytes ->Flash cache emptied: 35955 bytes User: Owner User: Rob ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 14992669 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 9487886 bytes Total Files Cleaned = 1,413.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.5.3 log created on 06282010_142617 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE000.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE084.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE10A.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE115.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE217.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE222.tmp not found! C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\UD9Y4NX5\iframe[2].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\OK6N2BYI\like[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\AHAH1SM2\like[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\5D3R34BG\computer_slow_popus_t112480[1].htm moved successfully. C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\2HO0H8YB\computer_slow_popus_reply_emeraldnzl_t112552[1].html&pid=659255 moved successfully. File\Folder C:\WINDOWS\temp\Perflib_Perfdata_18c.dat not found! Registry entries deleted on Reboot… Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE000.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE084.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE10A.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE115.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE217.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE222.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\UD9Y4NX5\iframe[2].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\OK6N2BYI\like[1].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\AHAH1SM2\like[1].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\5D3R34BG\computer_slow_popus_t112480[1].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\2HO0H8YB\computer_slow_popus_reply_emeraldnzl_t112552[1].html&pid=659255 not found! File\Folder C:\WINDOWS\temp\Perflib_Perfdata_18c.dat not found! Registry entries deleted on Reboot… Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE000.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE084.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE10A.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE115.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE217.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temp\~DFE222.tmp not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\UD9Y4NX5\iframe[2].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\OK6N2BYI\like[1].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\AHAH1SM2\like[1].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\5D3R34BG\computer_slow_popus_t112480[1].htm not found! File\Folder C:\Documents and Settings\Hunter\Local Settings\Temporary Internet Files\Content.IE5\2HO0H8YB\computer_slow_popus_reply_emeraldnzl_t112552[1].html&pid=659255 not found! File\Folder C:\WINDOWS\temp\Perflib_Perfdata_18c.dat not found! Registry entries deleted on Reboot… Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4251 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/28/2010 3:27:54 PM mbam-log-2010-06-28 (15-27-54).txt Scan type: Quick scan Objects scanned: 184705 Time elapsed: 16 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Topics merged. woolybugger, please use the Add Reply button when replying. Don't start a new topic.

Sorry. It actually had not been letting me. I would be sent to a screen that said something to the effect of certified responders only could reply. Of course I got through to do this one, so I'm not sure what I did wrong. I will try to do so again.

Sorry to be a pain, but I just went back to that thread and there was not even an option to reply. Just "closed" or "new topic".