Slow and freezing computer [Closed]

Hello Sarit and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested


Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download one of these to your desktop:

for a 32-bt system download this version.
for 64-bit use this one

.

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

Satchfan

Okay. I ran the program and here's the report:

There are a lot of entries that need to be dealt with but I have noticed a date change to “2036” in quite a lot of the entries so instead of fixing those I’ve found, I’d like you to run some more scans to see what is happening.

Run aswMBR
 

• download aswMBR.exe to your desktop.
• double click the aswMBR.exe to run it
• if asked, accept the AVAST virus definition download
• click the "Scan" button to start scan
• on completion of the scan click Save log, save it to your desktop and post in your next reply. Note - do NOT attempt any Fix yet.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

Please include the aswMBR log and checkup.txt with the next post.

Thanks

Satchfan

Yeah.  When I bought the computer from my coworker, it had the date changed to 2036.  But here are the scans.

aswMBR Report

Okay.  I had problems with combofix.  I tried running it three times and each time it totally froze the computer so I couldn't get it to run.  I checked my virus scanner and it says I have mcafee but I had uninstalled that a long time ago.  And I was using windows defender but it says that is off so I don't know what could have affected it.  I'm including the log for the other program though.

Try running ComboFix in safe mode:

• restart your computer.
• when the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with the Windows Advanced Boot Options menu
• select the option for Safe Mode using the arrow keys
• then press Enter on your keyboard to boot into Safe Mode.

Satchfan

Let’s try a different scan.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.

32-bit
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
64-bit
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• double-click to run it. When the tool opens click Yes to disclaimer.
• press Scan button.
• it will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• the first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply

Satchfan

 

It's 2 30am here in the UK so I'll need time to look at this tomorrow.

I'll reply as soon as I have had some sleep.

Satchfan

StopZilla

First, I would urge you to remove StopZilla and refrain from visiting their website. Read more here.

To uninstall it:

• click Start, Control Panel, Programs and Features
• click on StopZilla and then Uninstall
• repeat this for the other programs listed above.

================================================

P2P - I see you have P2P software, (uTorrent), installed on your machine.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. Those who write malware use P2P file-sharing as a major vehicle to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Open notepad (Start >All Programs > Accessories > Notepad). Please copy the entire contents of the code box below.

SearchScopes: HKLM - DefaultScope {41396b1b-447e-473b-a34b-bb583136c7fc} URL =
SearchScopes: HKLM - {7BCFC7A9-435C-46D7-917E-81F1A6B16947} URL = http://www.google.co…ge={startPage};
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
SearchScopes: HKCU - {105E99FF-8B9A-4492-B155-06194B9056D2} URL = http://search-gala.c…q={searchTerms}
SearchScopes: HKCU - {7BCFC7A9-435C-46D7-917E-81F1A6B16947} URL = http://search-gala.c…q={searchTerms}
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo….p={searchTerms}
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File
Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} -  No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
FF SearchEngineOrder.1: Ask.com
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: BetterLinks - C:\Users\rac\AppData\Roaming\Mozilla\Firefox\Profiles\q8bpoqvj.default\Extensions\[removed] [2036-09-02]
S2 xsewmzvga; \??\C:\Windows\system32\drivers\epwxtgux.sys [X]
2036-05-16 21:35 - 2036-05-16 21:35 - 00000432 _____ () C:\Windows\system32\Drivers\kgpfr2.cfg
2036-05-16 17:27 - 2036-05-16 21:36 - 00009640 _____ () C:\Windows\system32\Drivers\kgpcpy.cfg
2036-05-15 12:34 - 2036-05-15 12:34 - 00000000 _____ () C:\Windows\system32\REN9A6C.tmp
2036-05-15 12:34 - 2036-05-15 12:34 - 00000000 _____ () C:\Windows\system32\REN9A4C.tmp
2036-05-15 12:34 - 2036-05-15 12:34 - 00000000 _____ () C:\Windows\system32\REN9A3B.tmp
2036-05-15 10:20 - 2036-05-10 18:30 - 00000110 _____ () C:\Windows\system32\Drivers\etc\hosts.bak
2036-05-06 20:33 - 2036-05-10 18:20 - 00010756 ___SH () C:\Users\rac\AppData\Local\t0m8ctog368483w04675vl7l06dw6i5r6krf
2036-05-06 20:33 - 2036-05-10 18:20 - 00010756 ___SH () C:\ProgramData\t0m8ctog368483w04675vl7l06dw6i5r6krf
C:\Windows\system32\drivers\epwxtgux.sys
C:\Windows\system32\Drivers\kgpfr2.cfg
C:\Windows\system32\Drivers\kgpcpy.cfg
C:\Windows\system32\REN9A6C.tmp
C:\Windows\system32\REN9A4C.tmp
C:\Windows\system32\REN9A3B.tmp
C:\Windows\system32\Drivers\etc\hosts.bak
C:\Users\rac\AppData\Local\t0m8ctog368483w04675vl7l06dw6i5r6krf
C:\ProgramData\t0m8ctog368483w04675vl7l06dw6i5r6krf
C:\Users\rac\protect.dll
HKU\S-1-5-21-2030314185-2794812908-1279502003-1000\Software\Classes\.exe: exefile =>  <===== ATTENTION!
HKU\S-1-5-21-2030314185-2794812908-1279502003-1000\Software\Classes\exefile:  <===== ATTENTION!

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in to the same folder as FRST
• run FRST then click Fix just once and wait
• it will create a log Fixlog.txt; please post it to your reply.

======================

It appears that ComboFix created a log so I’d like you to send that too.

The  ComboFix log is located at C:\qoobox\combofix.txt.

======================

Also, do you know what this is?:

C:\ProgramData\e135217


Logs to include in the next post:

Fixlog.txt
combofix.txt

Thanks

Satchfan