Very Slow System and Some Programs Will Not Run

I need help with this system. I was going to run a HJT log and post it but when I downloaded HJT it will not let me open and install it. I have tried in safe mode and it is doing the same thing. The system is running Windows XP. Thanks in advance for any help.

Hi Lee Harrell and welcome to the forums!
I'm Sunyata and I will be helping you with your computer problems.

Please read the following guidelines which will help to make cleaning your machine easier:

• Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
• The fixes I will give you are specific to your problem and should only be used for this issue on this machine.
• Please make sure to carefully read any instructions posted. If you're not sure, please stop and ask!
• Please stay with this thread until I tell you your machine appears to be clean. Absence of symptoms does not necessarily mean that all malware is gone.
• PLEASE DO NOT install/uninstall any programs unless asked to.
• PLEASE DO NOT run any malware scans other than those requested.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
• I will reply back shortly with instructions

Note to Vista and Windows 7 users:

• These tools MUST be run from the executable. (.exe) every time you run them
• These tools MUST be run With Admin Rights (Right click, choose "Run as Administrator")

Please download OTL to your desktop.

• If you are using Firefox, make sure that your download settings are as follows:
  

  -Tools->Options->Main tab
  -Set to "Always ask me where to Save the files".

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
%systemroot%\*. /rp /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Next,

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
  

  Vista and Windows 7 users right click the icon and choose "Run as administrator".

• When asked if you want to download Avast's virus definitions please select Yes.
• Click the Scan button to start scan.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]

In your next post, please include:

• OTL.txt
• Extras.txt
• The aswMBR log

I can download OTL but when I double click it the hourglass comes up then goes away but nothing happens. sometimes when I do this my Norton pops up and says it found a threat. It says the threat is Trojan.ADH.2.

Hello Lee Harrell

Try running those two scans from Safe Mode…

• If you haven't already, also download aswMBR per the instructions in post #2
• Copy the instructions in post #2 and save them to a flash drive.
• Restart your machine and boot into Safe Mode (no networking)
• To boot into Safe Mode…
  
  • Restart the machine
  • As it starts to come back up, tap the F8 key about once every second
  • When the boot menu appears, use the arrow keys to highlight Safe Mode and press Enter
• Once in Safe Mode, follow the instructions from post #2 you saved to the flash drive
• Please post the logs back here

I just tried it in safe mode and it does the same thing. The hourglass comes up then goes away and nothing happens. I am also getting a message when starting the computer that says it can not run ProfileCnt.exe.

Hello Lee Harrell What operating system are you running? XP, Vista, WIndows7?

Windows XP

Hello Lee Harrell

Lets try booting into a Windows XP PE environment…

First, save the following highlighted text to a file named OTLScan.txt on your C:\ drive:

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
%systemroot%\*. /rp /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop

Next,

For this you will need blank CD disk and CD burning drive.
Please print these instruction out so that you know what you are doing

• Download OTLPEStd.exe to and rename it to Lee.exe before saving to your desktop.
• Ensure that you have a blank CD in the drive
• Double click Lee.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, grab a cup of coffee while it loads
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Copy the contents of the C:\OTLScan.txt that you saved previously, and paste it in the window under Custom Scans/Fixes
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Please post the contents of the C:\OTL.txt file in your reply.

I do not have a flash drive with me so I will have to wait until Monday morning to do this. Thank you for your help and I will do everything Monday.

Hello Lee Harrell

I do not have a flash drive

You actually do not need a flash drive. I modified the instructions.
Please see my previous post.

I am sorry but I have to leave and I will do that on Monday. I will not have internet access tomorrow.

I downloaded it just as you described and changed the name to Lee. It is still doing the samething and does nothing when I double click it. Can I save it to disk on another computer?

Hello Lee Harrell

Let's try something simpler first…

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 3 different versions below. If one of them won't run then download and try to run the other one.
You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

• Rkill.com
• Rkill.scr
• Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.

Now download and Run exeHelper from Raktor

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• A log file named log.txt will be created in the directory where you ran exeHelper.com
• Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

If you can now run exe files, please run OTL and aswMBR per the instructions in this post.

I downloaded the first two but they wouldn't run and when I tried to download the third but it said web page could not be found.

OK then, go ahead and create the OTLPE CD by running OTLPEStd.exe on a clean computer. Then carry the CD to the infected computer and boot from it, following the instructions in post #8 starting from

• Reboot your system using the boot CD you just created.