WE'RE SURE THAT YOU'LL LOVE US!

We invite you to ask questions, share experiences, and learn. It's 100% free. Did we mention that it's free. It is. It's free. Join 91599 other members! Anybody can ask, anybody can answer. Consistently helpful members with best answers are invited to staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

unresponsive windows and constantly crashing [Solved]

Started by lisafunkypants , May 21 2014 02:06 PM

This topic is locked

42 replies to this topic

#1 lisafunkypants

Authentic Member

Authentic Member
206 posts

Posted 21 May 2014 - 02:06 PM

hi i am back with this laptop had it sent to pc repair shop, came back unresponsive and worse than when it left me. when i open a window it takes way to long, and just freezes constantly.my mouse key disappears and it then constantly says windows not responding, shockwave flash plug in stopped. ive tried downloading the dds from this site to get a report but avg says its infected, not even sure if the avg is genuine as it came back from the pc shop with it on, any help is greatly appreciated.

Edited by lisafunkypants, 21 May 2014 - 02:07 PM.

Advertisements

Register to Remove

#2 LiquidTension

SuperMember

Classroom Teacher
2,566 posts

Posted 22 May 2014 - 07:23 AM

Hello lisafunkypants, welcome to WhatTheTech's Malware Removal forum!

My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.

======================================================

Important: I have laid out some "ground rules" I would very much appreciate you follow. Please read through the points below, to ensure this process moves as quickly and efficiently as possible.

Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
Ensure you are subscribed to this topic to receive instant email notifications of my responses.
- Scroll to the top of this page and ensure you see the following:
- If you are not set to follow this topic, click the Follow this topic button and follow the prompts.
Please attempt to backup important documents before proceeding with my instructions.
If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
Topics are locked if no response is made after 5 days. Please inform me if you will require additional time to complete my instructions.

======================================================

Please be advised that I am currently in training. My responses will need to be approved by one of our experts before I post them. This is only to ensure you are receiving accurate instructions. I will return as soon as possible.

Would you like to help others with malware removal? Join our Classroom and learn how!

#3 LiquidTension

SuperMember

Classroom Teacher
2,566 posts

Posted 22 May 2014 - 08:03 PM

Hello lisafunkypants,

I am sorry to hear you've had trouble with your PC repair shop. If you are unsatisfied with the work they've done, you are well within your rights to return and request a refund.

ive tried downloading the dds from this site to get a report but avg says its infected

This is a false-positive, and not something to be concerned with. We will however use a different scan. If you receive any warnings from AVG whilst carrying out the instructions below, I would like you to temporarily disable AVG. For instructions, please refer to the following link.

STEP 1
Farbar Recovery Scan Tool (FRST) Scan

Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your desktop.
Note: Run the version compatible with your system. Run both if you do not know your system's bit-type. One will run.
Windows XP: Double-click FRST.exe / FRST64.exe to run the programme.
Windows 8/7/Vista: Right-Click FRST.exe / FRST64.exe and select Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your desktop. Copy the contents of both logs and paste in your next reply.

STEP 2
aswMBR

Please download aswMBR and save the file to your desktop.
Temporarily disable your anti-virus software. For instructions, please refer to the following link.
Double-click aswMBR.exe to run the programme.
Right-Click aswMBR.exe and select Run as administrator to run the programme.
If you are prompted to download the latest anti-virus definitions from avast!, click Yes.
Click the AV Scan: drop down box and click C:\.
Click Scan.
Upon completion, you will see Scan finished successfully. Click Save log.
Copy the contents of the log and paste in your next reply.

Note: Do NOT attempt to click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your desktop. Do NOT click or delete it.

======================================================

STEP 3
Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

FRST.txt
Addition.txt
aswMBR log

Would you like to help others with malware removal? Join our Classroom and learn how!

#4 lisafunkypants

Authentic Member

Authentic Member
206 posts

Posted 25 May 2014 - 11:33 AM

Hi Adam, thank you for your help. if i delay in responding please do not think i am not doing as you ask it just takes so long for the pc to perform tasks i request and seems to stop responding and then restarts again. i have completed the scan after a long wai. may i also say i noticed my pc is on windows 6.1.7601 service pack 1. its a shame as when i first acquired the laptop it was vista!!! then windows 7 (after a hard drive replacement) ....i may also add it constantly tells me windows is using to much memory and should be restarted...If you think it maybe worth me getting a more modern laptop please give me your honest opinion.

thanks Lisa

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe

(Farbar) C:\Users\Admin\Downloads\FRST (2).exe

(Farbar) C:\Users\Admin\Downloads\FRST (4).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2014\avgui.exe [5180432 2014-04-06] (AVG Technologies CZ, s.r.o.)

HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-09-27] (Microsoft Corporation)

HKU\S-1-5-21-2347572414-1306700944-569078958-1000\...\Run: [AVG-Secure-Search-Update_0913b] => C:\Users\Admin\AppData\Roaming\AVG 0913b Campaign\AVG-Secure-Search-Update-0913b.exe /PROMPT --mid c5995cdd0b5647d381aba113f09d87db-06ce4fc639803a2e3563922518183d8e94088cb9 --CMPID 0913b

HKU\S-1-5-21-2347572414-1306700944-569078958-1000\...\MountPoints2: {4cf15741-2482-11e3-b1a6-705ab6796e28} - E:\LaunchU3.exe -a

HKU\S-1-5-21-2347572414-1306700944-569078958-1000\...\MountPoints2: {f58b096e-657a-11e3-9d8c-705ab6796e28} - E:\iLinker.exe

Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 1050 J410 series.lnk

ShortcutTarget: Monitor Ink Alerts - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x062B25518FB8CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://go.microsoft....k/?LinkId=69157

https://www.google.co.uk/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear

BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} http://www.shockwave...h2.1.0.0.67.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll No File

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:

=======

CHR DefaultSearchKeyword: google.co.uk

CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]

CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18]

CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18]

CHR Extension: (Google Search) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18]

CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18]

========================== Services (Whitelisted) =================

S2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3645456 2014-04-18] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [291912 2014-03-27] (AVG Technologies CZ, s.r.o.)

S2 vToolbarUpdater18.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [123160 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [199960 2014-04-18] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [150296 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22296 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [193304 2014-03-27] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [238872 2014-03-27] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [108312 2014-03-31] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [28440 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [211224 2014-03-31] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42272 2014-05-04] (AVG Technologies)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-05-25 15:15 - 2014-05-25 15:16 - 01056256 _____ (Farbar) C:\Users\Admin\Downloads\FRST (4).exe

2014-05-25 15:15 - 2014-05-25 15:15 - 01056256 _____ (Farbar) C:\Users\Admin\Downloads\FRST (2).exe

2014-05-21 21:13 - 2014-05-21 21:13 - 00000000 ____D () C:\Program Files\ESET

2014-05-21 21:12 - 2014-05-21 21:12 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe

2014-05-18 12:15 - 2014-05-18 12:17 - 00010155 _____ () C:\Users\Admin\Downloads\Addition.txt

2014-05-18 12:14 - 2014-05-25 15:20 - 00009193 _____ () C:\Users\Admin\Downloads\FRST.txt

2014-05-18 12:13 - 2014-05-25 15:20 - 00000000 ____D () C:\FRST

2014-05-18 12:13 - 2014-05-18 12:13 - 01056768 _____ (Farbar) C:\Users\Admin\Downloads\FRST (1).exe

2014-05-18 12:12 - 2014-05-18 12:13 - 01056768 _____ (Farbar) C:\Users\Admin\Downloads\FRST.exe

2014-05-18 11:55 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll

2014-05-18 11:54 - 2014-05-18 11:56 - 00000000 ____D () C:\AdwCleaner

2014-05-18 11:54 - 2014-05-18 11:54 - 01016261 _____ (Thisisu) C:\Users\Admin\Downloads\JRT (2).exe

2014-05-18 11:53 - 2014-05-18 11:53 - 01325827 _____ () C:\Users\Admin\Downloads\AdwCleaner.exe

2014-05-18 11:49 - 2014-05-18 11:49 - 00004212 _____ () C:\Users\Admin\Desktop\JRT.txt

2014-05-18 11:45 - 2014-05-18 11:45 - 00000000 ____D () C:\Windows\ERUNT

2014-05-18 11:44 - 2014-05-18 11:44 - 01016261 _____ (Thisisu) C:\Users\Admin\Downloads\JRT (1).exe

2014-05-18 11:43 - 2014-05-18 11:43 - 01016261 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe

2014-05-18 11:42 - 2014-05-18 11:42 - 00000791 _____ () C:\Users\Admin\Desktop\shexview.cfg

2014-05-18 11:40 - 2013-09-05 08:25 - 00054368 _____ (NirSoft) C:\Users\Admin\Desktop\shexview.exe

2014-05-18 11:39 - 2014-05-18 11:39 - 00065973 _____ () C:\Users\Admin\Downloads\shexview.zip

2014-05-05 00:30 - 2014-05-05 00:31 - 00000000 ____D () C:\a71e1a1af861537a1469285b4380cc88

2014-05-04 18:23 - 2014-05-18 11:59 - 00000000 ____D () C:\Users\Admin\AppData\Local\AVG SafeGuard toolbar

2014-05-04 18:22 - 2014-05-04 18:21 - 00042272 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx86.sys

==================== One Month Modified Files and Folders =======

2014-05-25 15:20 - 2014-05-18 12:14 - 00009193 _____ () C:\Users\Admin\Downloads\FRST.txt

2014-05-25 15:20 - 2014-05-18 12:13 - 00000000 ____D () C:\FRST

2014-05-25 15:18 - 2014-01-19 01:05 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-25 15:16 - 2014-05-25 15:15 - 01056256 _____ (Farbar) C:\Users\Admin\Downloads\FRST (4).exe

2014-05-25 15:15 - 2014-05-25 15:15 - 01056256 _____ (Farbar) C:\Users\Admin\Downloads\FRST (2).exe

2014-05-25 15:10 - 2013-09-04 10:48 - 01340659 _____ () C:\Windows\WindowsUpdate.log

2014-05-25 15:05 - 2013-09-04 11:20 - 00000000 ____D () C:\ProgramData\MFAData

2014-05-25 14:58 - 2014-01-19 01:05 - 00000880 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-25 14:58 - 2013-09-04 11:31 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-21 21:13 - 2014-05-21 21:13 - 00000000 ____D () C:\Program Files\ESET

2014-05-21 21:12 - 2014-05-21 21:12 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe

2014-05-21 20:55 - 2009-07-14 05:34 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-21 20:55 - 2009-07-14 05:34 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-21 20:49 - 2014-04-09 15:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-05-21 20:49 - 2013-10-27 22:51 - 00000935 _____ () C:\Users\Public\Desktop\AVG 2014.lnk

2014-05-21 20:32 - 2013-10-30 12:08 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-05-21 20:31 - 2013-10-30 12:07 - 00000000 ____D () C:\Program Files\Common Files\Adobe

2014-05-21 20:27 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-21 20:27 - 2009-07-14 05:39 - 00039829 _____ () C:\Windows\setupact.log

2014-05-18 12:58 - 2013-09-04 11:31 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-05-18 12:58 - 2013-09-04 11:31 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-05-18 12:27 - 2014-01-19 01:06 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-18 12:17 - 2014-05-18 12:15 - 00010155 _____ () C:\Users\Admin\Downloads\Addition.txt

2014-05-18 12:13 - 2014-05-18 12:13 - 01056768 _____ (Farbar) C:\Users\Admin\Downloads\FRST (1).exe

2014-05-18 12:13 - 2014-05-18 12:12 - 01056768 _____ (Farbar) C:\Users\Admin\Downloads\FRST.exe

2014-05-18 11:59 - 2014-05-04 18:23 - 00000000 ____D () C:\Users\Admin\AppData\Local\AVG SafeGuard toolbar

2014-05-18 11:59 - 2013-09-04 13:19 - 00024004 _____ () C:\Windows\PFRO.log

2014-05-18 11:56 - 2014-05-18 11:54 - 00000000 ____D () C:\AdwCleaner