This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer slow [Solved]

39 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I’m so sorry for not replying sooner. I somehow missed your reply and only saw it when I went to check because your replies are not usually this long.

The good news is that the updates seem to have gone well, (there are more waiting to be installed but we’ll deal with that when we clean up), and there are no signs of infections, just a few bits to get rid of.


Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1992874582-3349113656-4066416677-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S3 catchme; \??\C:\Users\Sharon\AppData\Local\Temp\catchme.sys [X]
S3 eapihdrv; \??\C:\Users\Sharon\AppData\Local\Temp\ehdrv.sys [X]
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system


  • save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
  • run FRST64 then click Fix just once and wait
  • it will create a log (Fixlog.txt); please post it to your reply.

Can you tell me if there are any outstanding problems.

Satchfan

 

 

Satchfan,

 

Below is the log.  Usually you want a log of the FRST scan.  Do you want me to do that?  It seems pretty good now.  I opened up about 7 videos at once and they all seem to be playing with no delay.  Before I was lucky to even play one video.

 

 

Thanks

GB

 

Fix result of Farbar Recovery Scan Tool (x86) Version: 28-07-2015
Ran by [removed] (2015-08-04 11:40:53) Run:2
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
 
==============================================
 
fixlist content:
*****************
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1992874582-3349113656-4066416677-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S3 catchme; \??\C:\Users\Sharon\AppData\Local\Temp\catchme.sys [X]
S3 eapihdrv; \??\C:\Users\Sharon\AppData\Local\Temp\ehdrv.sys [X]
EmptyTemp:
*****************
 
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
"HKU\S-1-5-21-1992874582-3349113656-4066416677-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
catchme => service removed successfully.
eapihdrv => service removed successfully.
EmptyTemp: => 1.6 GB temporary data Removed.
 
 
The system needed a reboot.
 
==== End of Fixlog 11:46:10 ====

That looks and sounds good.

 

I have to leave home very early tomorrow so I'll send clean-up instructions in the morning, (it's 10 20 pm here and I have to be up at 4 30 am).

Got a few minutes now so let's tidy up. :)

 

 

Your computer appears to be clean.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix

  • click START then RUN
  • now type Combofix /uninstall in the runbox and click OK.

Note the space between the X and the /, it needs to be there.

🖼Click to load external image (CFuninstall.jpg)


  • please follow the prompts to uninstall Combofix.
  • once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.

===================================================

Uninstall AdwCleaner

  • double click on adwcleaner.exe to run the tool
  • click on Uninstall
  • confirm with Yes.

You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Download & run Delfix

  • download Delfix from here to remove many of the tools we've used during the cleaning process.
  • ensure “Remove disinfection tools” is checked.

Also place a checkmark next to:


o    Create registry backup
o    Purge system restore


  • click the Run button.

You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Antivirus

You have no active antivirus on your computer. If you use the Internet without an antivirus your computer will certainly become infected again. It is also imperative that you update your Antivirus software at least once a week, (even more if you wish). If you do not update it, it will not be able to catch any of the new variants of malware that come out on a daily basis.

Do NOT install more than one or they will fight against each other and render both ineffective.

Here are the links again for some of the better AV products. Download and install one of them:


Bitdefender Antivirus Free Edition
Free Avast Home Edition - includes Dropbox or Google Chrome during installation - pre-checked by default
Avira AntiVir® Personal Edition Classic - includes an option to install Avira Browser Safety Add-on to your browser
Microsoft Security Essentials - de-select the option to join the customer experience improvement program.
 

===================================================

Windows updates

I notice that more Windows updates are waiting to be installed. Click here for information on how to get the latest Windows updates.

===================================================

Update installed programs

Your versions of Flash Player, Java and Adobe Reader are out-of-date and need to be removed and updated.

Having the latest updates and removing old versions ensures there are no security vulnerabilities in your system.

To remove them:

  • click Start, Control Panel, Programs and Features.
  • click on each of these programs, one at a time, name and then on Uninstall:


Adobe Flash Player 9
Adobe Reader 10.1.10

 

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

NEXT

Visit Adobe and download the latest version of Acrobat Reader.

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

======================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

======================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

======================

Download WOT

Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:



green if it's safe
yellow for caution
red for unsafe
 

You can download the WOT add-on for Firefox, Chrome, Internet Explorer, Opera, and Safari browsers. It does not slow down your browsing experience, it is easy to use and free. Just click “Download” and you are ready to go!

======================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

A couple of links with information here and here which can answer any questions you might have about installing/using it.

======================

Unchecky

Be careful when downloading free software. Many free programs come bundled with adware, many of which cause redirects/popups and verge on being malware. There is a program that automatically “unckecks” the boxes you may not notice when downloading programs.

Download and install Unchecky .

======================

Download and install CryptoPrevent

Crypto Ransomware Warning

There are particularly nasty “Ransomware” infections out there at the moment that encrypt your files and the only way possible to get them “de-crypted” is to pay a ransome. You can read more about this here.

  • download CryptoPrevent
  • save the file to your Desktop and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
  • accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This will launch the program once you click Finish
  • you will get a prompt asking if you purchased a Product Key for Automatic Updates. Click No
  • you will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to
  • click OK to continue and select your protection level. Go ahead and click OK.
  • click the Apply button to set Default protection
  • you may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.

You are now protected.

Note: The free version doesn't provide automatic updates but should be updated often, (at least weekly), as this infection has serious consequences. To update it manually, open the program, select the “Updates” menu then select Check for Updates to see if there are any available.

===================================================

I also recommend that you read the following:

Best Practices for Safe Computing - Prevention of Malware Infection by quietman7

Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams


I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan
 

 

Satchfan,

 

I uninstalled and installed the things you mentioned.  I could not download FileHippo so I went to a site I trust called Major Geeks and got it just fine.  What was the main thing wrong with the computer?  I appreciate you taking the time to help me and put up with me.  Thank you for your service.  Where do you learn the information to "debug""? For the most part, the computer works much better.   

 

Thank you again,

 

GB

I could not download FileHippo

 

The link works fine for me.

 

What was the main thing wrong with the computer?

 

Downloading rubbish "tweaking" tools from "trustworthy" websites was one of the problems.

 

This forum and all the other top Malware Removal forums absolutely discourage the use of any form of cleaner/optimiser/booster/tuneup/tweak-type utilities as they can cause irreversible damage. In your case it invited friends round to help spread the havoc.

 

I appreciate you taking the time to help me and put up with me.  Thank you for your service.

 

You're welcome and did well following the instructions.

 

Where do you learn the information to "debug""?

 

Not quite sure what you mean here but if you mean how did I learn to help with malware removal, then it was here at WTT where I was tutored by the best in the business.

 

Take care.

 

Nina

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI