Slow internet and applications not opening

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by zombie7899, Nov 7, 2015.

  1. zombie7899

    zombie7899 Private E-2

    Never had something this intense before. I've got multiple chrome and explorer processes running in the background, and can only access the internet with explorer, but very slow in page loading.

    I ran the read and run me first, but could not run mbam. The process opened but the application would never open. TDDskiller would not run, used fixtdds and nothing was found. The trial period for hitman pro is expired, so I bought a license, but the key will not activate, just keeps thinking. So hitman would not run either.

    Looked at the hijacking/redirection thread and followed those steps. Ran jrt and hijack this opened, saying I had a lot of hijacked domains. Never had hijacked domains so this is new to me.

    Attached are all the logs that could run. Thank you for any help.
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Re run RogueKiller and have it fix these entries on the files tab:

    [PUP][Folder] C:\ProgramData\{D76294E6-03B8-4971-AF2E-3F846161A690} -> Found
    [PUP][Folder] C:\ProgramData\{E1ED556E-3EA0-4F44-8BE7-CC5FB0F4B424} -> Found


    Follow these instructions to reset your host file:


    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    • Reboot the machine.
    • Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
    • Now see if you are able to run Malware Bytes and Hitman Pro.
     
    Last edited: Nov 7, 2015
  3. zombie7899

    zombie7899 Private E-2

    Reran roguekiller and deleted those 2 files.

    Wasn't able to access the instructions for reseting the host file, the page would never load, so I found this https://support.microsoft.com/en-us/kb/972034
    followed that for windows 7. When I rename the Host file to host.old in the %WinDir%\System32\Drivers\Etc folder a new one appears as a fun2save file type.

    I stopped there and haven't done anymore of the steps. Thanks again for the response.
     
  4. zombie7899

    zombie7899 Private E-2

    the instructions page finally loaded and they are not the same. When i open the original host file it has a bunch of asian characters in it. Attached is the host file.
     

    Attached Files:

  5. zombie7899

    zombie7899 Private E-2

    The fixMe.reg was successful. Was able to run hitman pro, and reran mgtools. mbam was still not loading.

    attached are the logs that were able to run.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The items in the hosts file are due to installing Covenant Eyes. ;)
     
  7. zombie7899

    zombie7899 Private E-2

    So covenant eyes has become corrupted, or should I uninstall it altogether?
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No! This is part of what it does.
     
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Thankyou Chaslang. I forgot this about covenant eyes.

    zombie are you able to run Malware Bytes in safe mode at all?
     
  10. zombie7899

    zombie7899 Private E-2

    mbam was able to run in safe mode, attached is the log.

    I noticed during the safe mode i only had 31 processes running...in normal mode i have 78 running. Not sure if that helps or not.
     

    Attached Files:

  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Normal. In safe mode alot less is loaded.

    So how's the machine running? No malware has been found, just some junk that Hitman fixed....
     
  12. zombie7899

    zombie7899 Private E-2

    Performance is slightly better, but chrome still won't load. Internet explorer is still slow loading any page.
     
  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.


    After reboot, check to see if your Chrome is working.
     
  14. zombie7899

    zombie7899 Private E-2

    ran the windows repair tool and chrome is now working and behaving normal, and internet explorer is now behaving normal.
     
  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    That is good news! :)

    Ready for final steps?
     
  16. zombie7899

    zombie7899 Private E-2

    Sweet!

    Let's do this :-D
     
  17. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

    7. After doing the above, you should work thru the below link:
     
  18. zombie7899

    zombie7899 Private E-2

    Sweet,

    Thanks again for all of your help :)

    PS - How do I do a thank you in the forum?
     
  19. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You are most welcome. ;)

    How do you thank? Well there's a thankyou button you can click too.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds