Slow Laptop: Kidly Help

Hi

To fully judge if the slowness issues are not malware related as those scans may miss some types of malware, the below guide is best to be run in full and in the order laid out,

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

You did not follow the directions for not using MSconfig to control startups.
Also you did not do all of step 2 in the READ ME properly.
Don't worry about it now! I will be giving you a registry patch to run below anyway that will fix this. In addition the registry patch will also permanently remove things from Startup that you don't need and you should not be using MSconfig to stop them anyway. It was not deisgned to be used as a long term controller for startups.

You MUST stop editing your log files. You edited user names out of the ShowNew log. When you do this, I cannot provide proper fixes because I cannot tell exactly where files are being stored. Also this is not providing you any additional security since your other logs already have your user ID in them anyway.

I will be posting some things to do in my next message. Note, your main problems may be due to to many antispyware applications being installed and also Spysweeper has lately become an issue. It has started having conflicts some items from Sun Java. We will address this too!

Before I can propose a fix, I first need answers to a few questions:

1. Is Spy Sweeper a paid version or a free trial version?
2. Is Pest Patrol a paid version or a free Trial Version?
3. Is Avg Antispyware a paid version or a free trial version.
4. I also see CA eTrust Internet Security Suite installed! What does this package include? Does it have an antivirus and a firewall?
5. Do you really need this sill Taskbar icon from Dell? IMHO, it is a waste of resources!
   • O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
6. Do you need the below two files that the scanners think are infected? If you already install these, you should not need them anymore, so delete them.
   • C:\Documents and Settings\Simanta Pathak\My Documents\download\WengoPhone-2.0-rc2-windows.exe
   • C:\Documents and Settings\Simanta Pathak\My Documents\My Music\marine2awfree.exe

You can however get started on a few things!

Uninstall CounterSpy now! We no longer need it and it will add to your slowness since you have multiple other antispyware applications installed.

Run thisViewpointKiller to remove the Viewpoint stuff.

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_03
Mozilla Firefox (1.5.0.8)

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Then install the current version of FireFox from: Mozilla Firefox

Attach a new log from ShowNew now after doing all of the above.

 

Make sure viewing of hidden files is enabled (per the tutorial).
Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:

C:\WINDOWS\system32\REN5F.tmp
C:\WINDOWS\system32\REN60.tmp
C:\WINDOWS\system32\bszip.dll
C:\Documents and Settings\Simanta Pathak\Local Settings\Application Data\Sunbelt Software <--- the whole folder
C:\Program Files\Sunbelt Software <--- the whole folder

Now run Ccleaner.

Now we need to Reset Web Settings:

1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!

Now reboot in normal mode

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp\
C:\Documents and Settings\Simanta Pathak\Local Settings\Temp

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

It was not supposed to be in your HJT scan. It was just a file to look for and delete if found. Note: You never fully completed step 2 of the READ ME, thus you will not be able to see hidden system files.

Just the applications you are running/loading at startup. Like McAfee, Mil Shield etc.


Did you install the below?
"VoipCheapCom"="\"C:\\Program Files\\VoipCheapCom\\VoipCheapCom.exe\" -nosplash -minimized"

This is considered to be malware and should be removed. Goto Add/Remove programs and uninstall VoipCheapCom

Also you should fix the below with HJT. The first is malware due to VoipCheapCom. The rest are just not necessary to load at startup and are slowing you down:

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe


After doing ALL steps above, reboot and then attach new logs from ShowNew and HJT.

How are things running now?

 

Yes! It is malware. Read this:

http://spywaredlls.prevx.com/RRGJDA15441184/VOIPCHEAPCOM.EXE.html

I did not expect that removing those would have a significant effect. Only minor, but every little bit helps. Any remaining issues are more than likely not malware. I'll give you two more scans to run just to double check for rootkits but I don't expect to find any. Your biggest hit to performance may just be McAfee.

Please download Blacklight Beta

• Download blbeta.exe and save it to the Desktop.
• Once saved... double click blbeta.exe to install the program.
• Click accept agreement and Click scan
  This app too may fire off a warning from antivirus. Let the driver load.
  Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please post contents of the BlackLight log.

Also let's run a second rootkit detector, sometimes one will find what another does not.
Run this AVG Anti-Rootkit and attach a log from it too.


If the rootkit scans don't find anything, you will have to look into what you are running and also into other NON-malware issues (like defrag, registry cleaning & defragging, checking for RAM problems, adding more RAM etc, over heating). However based on your comment that things are okay 2-3 minutes after startup, I would expect none of these are the problem but rather it is your be getting all the software configured and doing autodownloading of updates etc (if you have that configured) and possibly any autoscanning that is setup. Temporarily disable all McAfee startups AND services using MSconfig and then reboot. Then tell me how it looks. Renable them ASAP to avoid surfing unprotected.

 

It's your decision in the end. But why does it always need to run even when not making calls???? Also could it be impacting your performance.

As I said before. Your remaining issues are not malware. Either uninstall McAfee and the VoipCheap and see what happens or try the Software Forum.

It is not installed. Just delete the file you downloaded.

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Not the same as I requested. I said to uninstall McAfee (all of it). Also uninstall VoipCheap!

 

With McAfee and Voipcheap uninstalled ,attach new logs from ShowNew and HijackThis.

What process type do you have, what is it's speed, and how much RAM do you have?

When is the last time you did a disk error check? How about a defrag?

When you boot into safe mode, is boot up time also slow?

 

Try attaching the ShowNew log again but do it after doing everything below!

Also uninstall McAfee SiteAdvisor!

Some items I had you fix previously came back. Did you reinstall QuickTime?? The startup process is not required and will slow your system down. It should only be run when you need to run QuickTime.

Run HijackThis and fix the below lines:

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)


Note the below two lines are for doing automatic updates. The do slow things down especially at startup. It's up to you whether you really want to always load these and use this feature. Some people like the convience of having something notify them and get the updates for them. Others (like myself) do not want anything updating the PC except when we specifically request it. We don't want anything slowing down all normal operations.
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

So if you feel you don't need these, you can fix them too.

Now reboot! How does the speed look now?

Note: We cannot/should not remain running without an antivirus and firewall for too long. But I don't recommend using McAfee! It is a resource hog. I recommend using what is in here: How to Protect yourself from malware!

 

Attach another HijackThis log so I can see where things stand now; however any remaining problems with your PC being slower than it used to be may be physical issues with your OS, your hard disk, your memory, .....etc. Have you run a registry cleaner? Have you defragged both the registry and hard disk? (These are just other non-malware things I'm throwing out to you. They are not things we discuss in the malware forum though.)

Delete the below folder left over from Authentium's Command Antivirus.

 

Sorry! These two:

C:\Documents and Settings\All Users\Application Data\Authentium
C:\Program Files\Common Files\Authentium Shared


You may want to see if anything in the below procedure (not related to malware) helps with your slow PC:

Computer maintenance

 

Not True! You should do what that links specifies but it may not necessarily help either!

This I cannot address in the malware forum.


You log is still clean!

 

Yes! However first have HJT fix the below non-malware items.

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

 

You're welcome. Surf safely!