What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer is running very slow! [Closed]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Rootkit::
c:\users\client\AppData\Local\Temp\catchme.dll

Folder::
c:\users\client\AppData\Local\temp
c:\users\user\AppData\Local\temp


In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]
Post #17 last edited
ComboFix 12-01-28.01 - client 01/28/2012 11:35:10.12.2 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.2.1033.18.2035.1013 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\client\Desktop\CFScript.txt . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\client\AppData\Local\temp c:\users\user\AppData\Local\temp . . ((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-28 ))))))))))))))))))))))))))))))) . . 2012-01-28 16:45 . 2012-01-28 16:45 ——– d—–w- c:\users\client\AppData\Local\Temp 2012-01-28 16:43 . 2012-01-28 16:43 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-01-28 16:43 . 2012-01-28 16:43 ——– d—–w- c:\users\Guest\AppData\Local\temp 2012-01-28 16:43 . 2012-01-28 16:43 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-01-27 04:01 . 2012-01-06 04:19 6557240 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{145068DE-FAF4-4142-8CD8-1085E0F33CD4}\mpengine.dll 2012-01-03 20:20 . 2012-01-03 20:20 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll 2012-01-03 20:20 . 2012-01-03 20:20 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll 2012-01-03 20:20 . 2012-01-03 20:20 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll 2012-01-03 20:20 . 2012-01-03 20:20 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-06 04:19 . 2011-11-10 22:53 6557240 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-04 09:26 . 2009-10-10 20:58 236576 ——w- c:\windows\system32\MpSigStub.exe 2011-12-26 09:26 . 2011-12-23 21:17 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-11-10 10:54 . 2010-06-03 19:52 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-01-03 20:20 . 2011-04-03 04:22 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-10-11 1232896] "Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968] "VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-11-20 2590456] "ooVoo.exe"="c:\program files\ooVoo\oovoo.exe" [2011-05-18 22631608] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] "Facebook Update"="c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-07-14 137536] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656] "PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] . c:\users\client\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768] LOLRecorder.lnk - c:\program files\LOLReplay\LOLRecorder.exe [2011-10-24 409600] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-01-28 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job - c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 03:13] . 2012-01-28 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job - c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 03:13] . 2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 01:09] . 2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 01:09] . 2012-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job - c:\users\client\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-28 22:36] . 2012-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job - c:\users\client\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-28 22:36] . . ——- Supplementary Scan ——- . uInternet Settings,ProxyOverride = ;*.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\client\AppData\Roaming\Mozilla\Firefox\Profiles\kl6gjpcx.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - user.js: yahoo.homepage.dontask - true . . ************************************************************************** scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ———————— Other Running Processes ———————— . c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Microsoft LifeCam\MSCamS32.exe c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\conime.exe c:\windows\system32\igfxsrvc.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\WUDFHost.exe c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe . ************************************************************************** . Completion time: 2012-01-28 11:51:46 - machine was rebooted ComboFix-quarantined-files.txt 2012-01-28 16:51 ComboFix2.txt 2012-01-26 22:47 ComboFix3.txt 2011-09-15 20:35 . Pre-Run: 97,378,422,784 bytes free Post-Run: 97,251,049,472 bytes free . - - End Of File - - 0E5A36F084BAA09AE2F0529CCAB8713E
Post #19
It's running much faster now, maybe a little delays when I try to open my browser but other than that it's fine. Was there anything wrong with my computer?
Post #20
There were rootkits hidden somewhere in your computer. But let's check for remnants.

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as MyEsetScan. Alternatively, look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
  • Push the Back button.
  • Select Uninstall application on close check box and push [external image: Posted Image]
===================================================

Re-run Malwarebytes' Anti-Malware
  • Double-click MalwareBytes' (Note to Vista users, please right-click and select Run as Administrator.)
    • Go to Update tab to update Malwarebytes' Anti-Malware
  • Then click Check for Updates.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform Quick Scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please copy and paste the log back into your next reply
Note:
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  • Or via the Logs tab when Malwarebytes' Anti-Malware is started.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

On your next reply please post :
ESET log
MBAM log


Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI