i am experiencing greatly delayed response with my laptop overall. on websites, depending on their complexity, i get a delayed response (sites with mostly text, Google Search etc. take extended times to load) to no response (sites with a lot of pictures, videos, ads will often remain blank and hang).
when using computer apps, i have trouble with things requiring lots of memory (photoshop, pasting a large clipboard with lots of photos into Word). some actions can take forever to execute, and sometimes, if i execute a command too fast before the last one has finished, the app crashes.
and in a not so desultory phillipic, i've been IOBitted, Malawarebyted, Spybotted, and Symantecked 'til i'm blind.
my last hope appears to be Hijack This, for which i've included the log.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:34:53, on 6-10-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
To start off with… it looks like you have two Anti-virus programs running. Bad idea. They can conflict with each other and cause problems similiar to the ones you've described. I suggest that you keep Symantec and remove IoBit using add or remove programs in your control panel.
Then… I need a more thorough scan than what HijackThis provides.
Please download DDS by sUBs from one of the following links and save it to your desktop.
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.
—————————————————
Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Looking around cyberspace… it appears that the 'SrtETmp' issue with system restore seems to be unique to machines with Symantec. Let's try a couple more things, and then we will reset system restore.
Download ComboFix from one of these locations:
Link 1 Link 2 Link 3
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
hi tomk,
miracle of miracles, my laptop now seems to be ok.
i also, before you first replied, had just uninstalled all my Java apps/addons, a version which Mozilla had identified as unstable.
i'm not sure if the improvement is due to that or as you mentioned, the interactions of all the malware, but performance is definitely improved (website loading seems fine, and i can download files and see videos now as well).
i am happy to proceed with combofix if you think that's still warranted.
cybernot
cybernot,
I'm not seeing any specific signs of malware. If things are good… you may want to stop here. There is always a risk (no matter how small it may be) when running any of our "tools".
Your choice.
hi tom,
since you aren't seeing specific signs of malware, i think i'll stop here for now and see if the improved performance continues or if i have any more trouble with websites or slow windows apps (which i haven't tried yet). can you keep this post open for a day or two while i use it real world and can then get back to you with a decisive answer?
thanks very much for your help.
cybernot
Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.
Remove all previous Restore Points
Click Start Menu > Run > copy and paste
cleanmgr
You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab. Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders." Check "Hide protected operating system files."
Click Apply, and then click OK.
The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.
hi tom
i received your last email and understand it. i DO, however, have a few questions.
i don't mean to be impertinent and question a Forum God, however, i was wondering if you could tell me why i want to delete all other restore points? and should i wait the few days until after we feel pretty sure that i'm NOT infected?
also am i hiding file extensions, hidden files/folders and system folders to protect me from myself?
cybernot
i was wondering if you could tell me why i want to delete all other restore points? and should i wait the few days until after we feel pretty sure that i'm NOT infected?
Typically, We ask you to reset your system restore after we have removed the malware from the system because, the infection will be restored if you use a restore point. However, in your case, I do not know if the scans you ran before actually removed anything… but I'd like you to reset your system restore points mainly because often this will correct the problem you've been having with system restore. What happens is… some scanners will find signs of the infection stored in your restore point and will attempt to "clean" it. If a restore point is modified in any way, it is no longer accessible so you can't use it anyway. That all being said… you can choose to not reset your system restore at this point.
also am i hiding file extensions, hidden files/folders and system folders to protect me from myself?
Absolutely. It keeps you from accidentally clicking on the wrong file. Hiding the files serves no other "security" function.
i'm not sure exactly what is wrong with my system restore. when i initially tried to restore, i think BEFORE most of the scans, it wouldn't let me restore ANY point . . . and i tried about 10 of them (i would get the diagnostic "Application failed to initialize because Windows station is shutting down" and the machine would shutdown. oddly, all of the restore points were taken on ONE day, and i think that's because my system clock is buggy and doesn't work. if i manually change the system date, then the system restore establishes a new restore point on THAT date, as i've observed today. but if i ignore the clock (which i've been doing) because it doesn't work, then all the restore points are on the same day. so i guess i need to manually change the date everytime i want to establish a new restore point.
that being said the question is, do you think i got the diagnostic above when trying to restore as a result of a malfunctioning system clock or as you said, possibly due to modified restore points? because if its the clock, then resetting system restore won't help unless i fix the clock?
hi tom,
my laptop still seems to be performing normally, including Office apps, so you can go ahead and close the post.
i'll be sure to reset my restore and check out the CMOS battery and the Microsoft article.
thanks for all your godlike help. ; ) it is truly appreciated.
groetjes,
cybernot
It keeps you from accidentally clicking on the wrong file. Hiding the files serves no other "security" function.