[Solved] Machine a lot slower than it used to be

My machine is a lot slower than it used to be, what should i be doing?

Hi thecatpebbles,


My name is Blottedisk, I'll be happy to assist you with all your malware problems you have on your computer. Solving any malware-related problem may or may not solve other issues you have with your machine. Before we start fixing your computer, there are a few points you need to know:

• Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
• Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice. This may cause a delay in response time, but I will do my best to keep it as short as possible.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.

Please bear with me, I will post back to you shortly with instructions.

Thanks

Hi and thanks for your help, look forward to hearing from you, Regards Les

Hi again,


What do you think could have caused this slowness? Have you made any recent changes to your computer (installing or downloading a program, opening a suspicious email, etc.)?


Please follow these steps:


Step 1 | Please download OTL from one of the following mirrors:

This is THE Mirror

——————————————————————–

• Save it to your desktop
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Minimal Output at the top
• Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
• Double click inside the Custom Scan box at the bottom
• A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
• Click the OK button and navigate to the file scan.txt which we just saved to your desktop
• Select scan.txt and click Open. Writing will now appear under the Custom Scan box
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in this topic.
• You may need two posts to fit them both in.

Step 2 | Please download GMER from one of the following locations and save it to your desktop:

Main Mirror - This version will download a randomly named file (Recommended)
Zipped Mirror - This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

——————————————————————–

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.

Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]

• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
• Make sure all options are checked except:
  
• IAT/EAT
• Drives/Partition other than Systemdrive, which is typically C:\
• Show All (This is important, so do not miss it.)

[external image: Posted Image]
Click the image to enlarge it

• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and re-enable all active protection when done.

– If you encounter any problems, try running GMER in Safe Mode.


Logs to include with next post:

OTL.txt
Extras.txt
Gmer.txt

Hi, I don't seem to be able to download from either of the two mirrors mentioned, I am running Avira and Outpost Firewall 2009 so they could be making a difference. I have not altered anything to my knowledge ( I tend to be a bit careful about what I download) but I must admit this machine is not used just by myself. My son was here over christmas and my daughter after the new year. I should have the machine to myself for a bit now though. Regards Les

Hi,


The links are working for me. What happens when you click on them?
Let's disable Avira and Outpost and try again; they may be interfering with the downloads.


Please have a look at the following topic on how to disable both Avira Antivir and Outpost Firewall:

http://forums.whatthetech.com/index.php?showtopic=96260

Once you have disabled them, try to download OTL again and follow the instructions in my previous post.

If you still can't download the tools, go to another computer, download them and transfer them over using an USB memory.

Hi still getting a problem, so decided to do this a step at a time. Have uninstalled AVIRA ant-virus software still unable to download have uninstalled Outpost firewall. When I click on THIS is THE MAIN MIRROR I get an Internet message showing Blank page and a line saying To help with security internet has blocked this site etc click here for more info, following click I get a number of options I click on download file and then nothing happens but the DONE message appears at the bottom of the screen. Regards Les

Hi, Which browser are you using? Could you please copy or type the exact message that it displays when you try to download the tools? Also, if you have access to another computer, you could download the tools there and transfer them over via USB.

Hi I am using Internet Explorer 8 if you require more info please let me know. I have tried using another machine and I get the same result using This is The Mirror. ie Internet message showing Blank Page followed by a line saying To help protect your security, Internet Explorer blocked this site from downloading files to your computer. Click here for options….After clicking, three options appear in a box. Download File … What's the risk —————————— Information Bar Help after I click on download file nothing happens but it does come up with done message in the bottom left hand corner. Can you give me the address of the sites where the dowloads are coming from ? Regards Les

Hi there,


Yes, that's an Internet Explorer security policy; for some reason it appears to be interfering with the tool's download. I don't think you could do much with the addresses, it will be the same. Please follow the steps below to temporarily disable this security option (we will turn it on again when we are done):

• Open Internet Explorer, click Tools, and then Internet Options.
• In the Internet Options dialog box, from the Security tab, select the Internet zone, and then click Custom level…
• Scroll down to "Downloads". Under "Automatic prompting for file downloads", select Disable. Then accept.
• Now try to download the tools and follow the steps to use them.

Hi I did as requested and got a little box with a yellow triangle with the message "Your current security settings do not allow this file to be downloaded". I asked for the site naming details so that I could then add the site to the trusted sites section and get around this problem. Regards Les

Have since gone on Internet Browser and reset all to default in the security section

Hi,


Adding the sites to the trusted sites could be of help indeed. Here're the links:

OTL:
http://oldtimer.geekstogo.com/OTL.exe

GMER:
http://gmer.net/download.php

Hi, I have managed to download and run OTL and have attached the outputs but can not get GMER to run, it just seems to hang there and I end up having to reboot the computer, as I just get the message of program not responding, sorry but I don't know how to do a screen print so that you can see what is happening. Regards Les

Hi,


Dont worry about GMER. Just delete it's random-named file and follow these steps:



Step 1 | Please go to the following site to scan two files: http://www.virustotal.com/

• Click on Browse, and upload the following files for analysis :
  
  
  • E:\WINDOWS\UKCpInfo.sys
    E:\WINDOWS\System32\ctrldll.dll
• Note: You will not be able to upload and scan all files at once. You will have to submit and scan each file separately.
• Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
• If it says already scanned – click "reanalyze now"
• Please post the results in your next reply.

Step 2 | Please download RootRepeal from the following mirror:

http://ad13.geekstogo.com/RootRepeal.exe

——————————————————————–

• Save it to your desktop
• Double click RootRepeal.exe to start the program
• Click on the Report tab at the bottom of the program window
• Click the Scan button
• In the Select Scan dialog, check:
  
  • Drivers
  • Files
  • Processes
  • SSDT
  • Stealth Objects
  • Hidden Services
• Click the OK button
• In the next dialog, select all drives showing
• Click OK to start the scan

The scan can take some time. DO NOT run any other programs while the scan is running

• When the scan is complete, the Save Report button will become available
• Click this and save the report to your Desktop as RootRepeal.txt
• Go to File, then Exit to close the program

If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.