PC Just Hangs or Slow Response, Slow unresponsive PC(B)

Hi Satchfan Sorry for not getting back to you sooner - I was away and did not get to the PC until today. I have removed the Torrent and the Norton bits and pieces but when I try the Combofix I get the blue screen when it completes task 50. Any ideas why? The Microsoft report tool states driver error. Thanks again David

Hi gtbear

Sorry for not getting back to you sooner - I was away and did not get to the PC until today.

That’s OK but please let me know if you’ll be away for that length of time again and I’ll keep it open for you.

Click the Windows “Start” button, select Run, then copy/paste the following bolded text into the run box and click OK

"%userprofile%\desktop\combofix.exe" /killall

If there is still a problem running it, try it in safe mode.

To Enter Safemode• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY - this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode
• Then press Enter on your keyboard
Satchfan

Thanks Satchfan. I had to run it in SAFEMODE but here the log. David

Submit a file to VirusTotal

Go to VirusTotal and submit this file for analysis:

D:\Documents and settings\The Underwoods.PERCYII\Local Settings\Temp\o1394bul.sys• click on Browse
• locate the file o1394bul.sys click on it and then on Open
• click on Send File.
You will get a report back; post the report into this thread for me to see.

Cheers

Satchfan

Hi Satchfan,

I've tried to send this file to VirusTotal but I can't locate it.

gtbear

gtbear

Don’t worry about that for now.

ComboFix got rid of quite a bit but there is more to do.

=======================================================

Clear all your temporary files

Download ATF Cleaner
• Double-click ATF-Cleaner.exe (on your desktop) to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.
If you use Firefox browser • Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser • Click Opera at the top and choose: Select All
• Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu

=======================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

• start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
• when the scan is complete, click OK, then Show Results to view the results.
• be sure that everything is checked, and click Remove Selected.
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Please let me know how your computer is running

Thanks

Satchfan

Hi Satchfan,

All done so far.

MBAM found one item and cleared it.

Here's the log

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7378

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

04/08/2011 21:31:43
mbam-log-2011-08-04 (21-31-43).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 365422
Time elapsed: 25 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
d:\documents and settings\the underwoods.percyii\favorites\qword search engine.url (Adware.QWO) -> Quarantined and deleted successfully.

The computers running slightly faster but still hangs - possibly hardware needs upgrading

Thanks for your help

David

That looks OK

Let's see what a final scan turns up

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Cheers

Satchfan

Hello gtbear It has been several days since I posted instructions to help with your computer problem. Please let me know if you are having problems and still need help. Thanks Satchfan

Hi Satchfan Sorry for the delay. Scan took ages but with nothing to report David

Hi David

Looks as if all is now OK.

I’d like you to run this check before we tidy up.

Run Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Satchfan

Are you still with us David?