What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow Computer/Adware [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

Please help!!  My daughter is in college and has been complaining that her laptop has been slow for a while.  I just saw her this weekend and told her I would look into it this week and get it back to her next weekend.  I did notice that it is pretty slow when starting up, and when running one of the test programs (aswMBR I think), I got an Adware notice….so I'm convinced that is the problem.  

 

Please take a look at the attached logs and let me know if there is anything I can do, or what I should do.

 

Thanks, in advance, for all your help!

 

ShawBuck

Attachments:

Post #2
Hi and welcome

Please remove/uninstall from the control panel

Define Ext (HKU\S-1-5-21-3521014183-2095995780-1038206286-1002\…\Define Ext) (Version: 8 - DefineExt.com) <==== ATTENTION
LinkSwift 3.0.0 (HKLM\…\LinkSwift) (Version: 3.0.0 - LinkSwift) <==== ATTENTION
Optimizer Pro v3.0 (HKLM-x32\…\Optimizer Pro_is1) (Version: 3.0 - PC Utilities Pro) <==== ATTENTION


~~~

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
Or use this method Press the windows key [external image: Windows_Logo_key.gif]+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
[external image: x1lWQRS.gif]

start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-3521014183-2095995780-1038206286-1002\…\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-3521014183-2095995780-1038206286-1002\…\Policies\Explorer: [NoLogOff] 0
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => No File
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL => No File
HKU\S-1-5-21-3521014183-2095995780-1038206286-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=COSP&conlogo=CT3210127&ptag=G2A1E8265D33C
URLSearchHook: HKLM-x32 - BrowserPlus2 Toolbar - {650598e1-b35a-45d3-b607-896d7acb64c3} - C:\Program Files (x86)\BrowserPlus2\prxtbBrow.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 - BrowserPlus2 Toolbar - {650598e1-b35a-45d3-b607-896d7acb64c3} - C:\Program Files (x86)\BrowserPlus2\prxtbBrow.dll (Conduit Ltd.)
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {C53EB56A-5E90-4916-A1B2-C6BC6BF7A1B9} URL =
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 -> DefaultScope {C53EB56A-5E90-4916-A1B2-C6BC6BF7A1B9} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3309350&CUI=UN59941650127400130&UM=2&UP=SP2EEAA940-FFFA-4312-83EB-1D09FF448A3F&SSPV=
SearchScopes: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3309350&CUI=UN59941650127400130&UM=2&UP=SP38EF7B24-5508-49C1-983C-BF4540886092&SSPV=
SearchScopes: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 -> {C53EB56A-5E90-4916-A1B2-C6BC6BF7A1B9} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3309350&CUI=UN59941650127400130&UM=2&UP=SP2EEAA940-FFFA-4312-83EB-1D09FF448A3F&SSPV=
SearchScopes: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 -> {E1A1345E-9886-421C-8D65-0800B7F144F5} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3309350&CUI=UN59941650127400130&UM=2&UP=SP2EEAA940-FFFA-4312-83EB-1D09FF448A3F&SSPV=
BHO-x32: BrowserPlus2 Toolbar -> {650598e1-b35a-45d3-b607-896d7acb64c3} -> C:\Program Files (x86)\BrowserPlus2\prxtbBrow.dll [2013-07-17] (Conduit Ltd.)
BHO-x32: Define -> {B78F92C8-DEB3-11E2-9A0A-FB64281D6ADE} -> C:\Users\Ellie\AppData\Local\DefineExt\temp.dat [2013-06-26] ()
Toolbar: HKLM-x32 - BrowserPlus2 Toolbar - {650598e1-b35a-45d3-b607-896d7acb64c3} - C:\Program Files (x86)\BrowserPlus2\prxtbBrow.dll [2013-07-17] (Conduit Ltd.)
Toolbar: HKU\S-1-5-21-3521014183-2095995780-1038206286-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Extension: (Yahoo! Toolbar) - C:\Users\Ellie\AppData\Roaming\Mozilla\Firefox\Profiles\eiv39ogp.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-07-12] [not signed]
CHR HomePage: Default -> hxxp://search.conduit.com/?ctid=CT3309350&SearchSource=48&CUI=UN76826798212966106&UM=2&UP=SP38EF7B24-5508-49C1-983C-BF4540886092&SSPV=
CHR Extension: (Extutil) - C:\Users\Ellie\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-04-22]
CHR Extension: (Managera) - C:\Users\Ellie\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-04-22]
CHR HKU\S-1-5-21-3521014183-2095995780-1038206286-1002\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [iigplimlmgilpobjilfbfeilnpiigpgl] - C:\Users\Ellie\AppData\Local\CRE\iigplimlmgilpobjilfbfeilnpiigpgl.crx



Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: BY4dvz9.png]AdwCleaner
  • Please download AdwCleaner and save the file to your Desktop.
    In order to use AdwCleaner, you have to agree the Eula:
  • Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
  • Follow the prompts.
  • Click [external image: A49sxPr.png]Scan.
  • Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
  • Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
  • Click [external image: MqHawIb.png]Clean.
  • Follow the prompts and allow your computer to reboot.
  • After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt
Post #4

Hopefully her system doesn't look too bad

It had quite a bit of infection on it but we're moving in the right direction.
After using the next tool let me know how it's doing now.

Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Here
  • Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
  • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
    [external image: MBAM3_zpsw0f8rn9n.jpg]
  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
  • When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard
  • If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
  • Please paste the log back into this thread for review
  • Exit Malwarebytes
Post #5
Thanks again! If I remember right, there were 16 threats found, which I quaranteened (I didn't see anything to remove them at stated in your directions). 
 
Please review and let me know what needs to be done next..
 
ShawBuck
 
 
 
Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 4/9/17
Scan Time: 3:00 PM
Logfile: 
Administrator: Yes
 
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.96
Update Package Version: 1.0.1693
License: Trial
 
-System Information-
OS: Windows 8.1
CPU: x64
File System: NTFS
User: QUEENELIZABETH\Ellie
 
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 370181
Time Elapsed: 16 min, 8 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 6
PUP.Optional.BrowserPlus, HKLM\SOFTWARE\WOW6432NODE\BrowserPlus2, No Action By User, [6002], [236223],1.0.1693
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{419835E5-B176-450C-B49C-841C9EF7AF28}, No Action By User, [11400], [236886],1.0.1693
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, No Action By User, [2155], [253643],1.0.1693
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, No Action By User, [2155], [253644],1.0.1693
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32Ldr, No Action By User, [5442], [244209],1.0.1693
PUP.Optional.BrowserPlus, HKU\S-1-5-21-3521014183-2095995780-1038206286-1002\SOFTWARE\APPDATALOW\SOFTWARE\BrowserPlus2, No Action By User, [6002], [236221],1.0.1693
 
Registry Value: 10
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244208],1.0.1693
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.xxx|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244208],1.0.1693
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244208],1.0.1693
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244208],1.0.1693
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_removal_tool.exe|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244208],1.0.1693
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_reporter_tool.exe|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244208],1.0.1693
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{419835E5-B176-450C-B49C-841C9EF7AF28}|APPPATH, No Action By User, [11400], [236886],1.0.1693
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|APPINIT_DLLS, No Action By User, [2155], [-1],0.0.0
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|APPINIT_DLLS, No Action By User, [2155], [-1],0.0.0
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32Ldr|{8A4D5A43-C64A-45AB-BDF4-804FE18CEAFD}.SDB, No Action By User, [5442], [244209],1.0.1693
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 0
(No malicious items detected)
 
File: 0
(No malicious items detected)
 
Physical Sector: 0
(No malicious items detected)
 
 
(end)
Post #6

 

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

 

Instructions where to quarantine and if you did,  then good.

In the reply all I see is no action taken,  but if it was allowed to quarantine then we're good.

 

Last scan

 

(If the machine is better)

 

 

  • Download Emsisoft Emergency Kit and save it to your desktop.
  • Double-click icon then click Install
  • A Window should open highlighting Start Emergency Kit Scanner
  • Right click on the icon and select Run as administrator
  • Click 1. Update now!
  • Once the update is completed select Settings under Scan
  • Uncheck Join the Emsisoft Anti-Malware Network
  • Click Scan at the top
  • Click On scan completion
  • Click Quarantine detected objects, then click OK
  • Click Malware Scan
  • Once completed click View Report
  • Save the file to your Desktop using the default file name
  • Copy and paste the report in your reply

 

Post #7

I thought I did click the "automatic quarantine" in the previous set of instructions, but perhaps I didn't….but I did quarantine after the fact though.

 

Definitely does seem to be running better!  Below is the log for the Emsisoft scan, hopefully everything looks good…

 

Thanks again for your help and taking time out of your weekend!

 

 

 

 

Emsisoft Emergency Kit - Version 2017.2
Last update: 4/9/2017 6:51:16 PM
User account: QUEENELIZABETH\Ellie
Computer name: QUEENELIZABETH
OS version: Windows 8.1x64 
 
Scan settings:
 
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
 
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Direct disk access: Off
 
Scan start: 4/9/2017 6:55:01 PM
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534} detected: Application.AdBrowse (A) [279658]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB} detected: Application.AdUpd (A) [280184]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5} detected: Application.AppInst (A) [280231]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534} detected: Application.AdBrowse (A) [279658]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB} detected: Application.AdUpd (A) [280184]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5} detected: Application.AppInst (A) [280231]
 
Scanned 147453
Found 6
 
Scan end: 4/9/2017 7:13:00 PM
Scan time: 0:17:59
 
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5} Application.AppInst (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB} Application.AdUpd (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534} Application.AdBrowse (A)
 
Quarantined 3
Post #8

Definitely does seem to be running better!

 
Unless there is something else happening I think your good to go.
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Click the Run button.
  • – This will remove the specialized tools we used to disinfect your system.
    Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete    ).
*********
  • Answers to common security questions - Best Practices by quietman7, MVP
  • How Malware Spreads - How did I get infected? by quietman7, MVP
  • Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
  • How to Prevent Malware by miekiemoes, MVP
  • How to backup and restore your data using Cobian Backup by YourHighness
  • Slow Computer/browser? It May Not Be Malware by quietman7, MVP
  • AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
  • [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
  • [external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
  • [external image: 6YRrgUC.png]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
  • [external image: jv4nhMJ.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
  • [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
  • [external image: DgW1XL2.png]Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
  • [external image: j1OLIec.png]SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
  • [external image: sHjS79L.png]Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI