BitDefender is taking a loooong time to run, won't finish

I've been trying to clean up some spyware, viruses, etc. from my home computer and I've been following the instructions on the "Read & Run Me First" string.

I've done everything up to running BitDefender. It starts okay but then the Estimated Time Left just goes up and up. I started it again last night before I went to bed, this morning it said there were over 38 hours left and it had already been running for over 12 hours. Something is not right here. I ran the same program on my laptop to see how long it should take and it took about 4 hours on my laptop. Is this normal?

I am also getting error messages regarding Windows Explorer has encountered a problem and needs to close. This may be related to the BitDefender issue. The computer also runs really slooooooooooow when running BitDefender and I basically have to do a hard shut down in order to start over or do anything with it.

I was going to wait until running BitDefender to post, that way I would have the logs you requested. But I can't seem to get it to work. I've been working on this computer all weekend and can't seem to make any more progress.

If I start the computer in regular mode (I've been doing the scans in safe made as recommended) I get four error boxes that come up right after start up.
1. Windows cannot find 'C:\WINDOWS\inet20001\services.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

2. Could not load or run 'C:WINDOWS\inet20001\services.exe' specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry.

3. Also getting "Windows Explorer has encountered a problem and needs to close. We are sorry for the inconvience." (Are they really sorry?) And it asks me if I want to send an error report to Microsoft.

4. Then I get "sachostp.exe has encountered a problem and needs to close. We are sorry for the inconvience." And it asks me if I want to send an error report to Microsoft.

The computer with the problems is an EMachine D2386. Intel Celeron CPU 2.30GHz, 504 MB of Ram. Running Microsoft Windows XP Pro Version 2002 with Service Pack 2, and Office Pro 2003.

Thank you in advance for all of your help. The scans I have already done have cleaned up a number of viruses and spyware, but I am stuck right now. My intent was to follow the directions you laid out, but for some reason I am not able to. What can I do now?

 

Please see the below thread on how to install and run Ewido Security Suite. After you run this, see if you can run the online scans.

Running Ewido Security Suite ...

 

I ran Ewido as requested and it found a bunch of stuff. I've attached the Ewido log. I had to run Ewido in normal boot mode, I couldn't see it on my desktop when I restarted in safe. I've been having problems with regular safe mode, the computer is very slow to start up and run. Safe mode with networking seems to run fine however.

Once Ewido ran I tried to run BitDefender again but still had the same problem. It starts out okay but just gets slower and slower as the time goes on. It's almost like the computer just gets really bogged down and sort of stops processing.

I started it last night before I went to bed and this morning when I checked it I had a error message on the screen "Windows Explorer has encountered a problem and needs to close". I've been getting this everytime I try to run BitDefender. I closed that window and check the stats on BitDefender - it has been running for 7 hours 32 minutes and the estimated time left is 32 hours 35 minutes and climbing. It was basically at the same files where I left it last night, no progress. I cannot stop BitDefender or do anything with the computer, have to do a hard restart in order to close out and do anything.

Any ideas now? Thank you.

 

Please attach a fresh HJT log from normal mode.

 

Here you go. Thanks again.

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

WinHound

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

F3 - REG:win.ini: run=C:\WINDOWS\inet20001\services.exe

O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: C:\WINDOWS\adsldpbf.dll - {EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6} - C:\WINDOWS\adsldpbf.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 - HKLM\..\Run: [WinHound] C:\Program Files\WinHound\WinHound.exe
O4 - HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe

O20 - Winlogon Notify: avload32 - C:\WINDOWS\SYSTEM32\avload32.dll
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll
O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\WinHound ←–– Delete this whole folder if it exist!

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, procede with the below steps...

Reset Web Settings & Default Security Settings:

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Finally, I would like you to Flush your System Restore Points. Please follow the instructions in this link --->Disable and Re-enable System Restore

• First, turn OFF System Restore to flush any bad Restore Points.
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you have completed this fix, reboot and attach a fresh HJT log. Also try and run the online scans again and post the logs if you can run them.

 

Thanks for all of your help, here's were things are at.

Delted Ewido as directed, no file existed for WinHound.

Ran Hijack this and fixed the lines as directed.

Rebooted in Safe mode with no networking, could not find a file for WinHound.

While in Safe mode with no networking I ran CCleaner. Computer runs very slow in Safe mode with no networking. Took a long time to do the preceeding two steps.

Rebooted in Safe mode with networking and updated and ran Ad-Aware SE and Spybot S&D. Started runnng slow with Spybot, I ended up letting it run all night. When I checked it in the morning there was a "Windows has encountered an error" message on the screen, but the program did run completely.

Rebooted in normal mode and ran PocketKillBox. I was able to delete all of the lines you recommened EXCEPT for "C:\WINDOWS\system32\browsela.dll". Everytime I cut and pasted that line and then hit the red X the program would basically freeze and give me the "not responding" message in the toolbar. I tried this a number of times and it would not work.

I reset the web setting as requested and defaulted all internet explorer security settings.

Flushed all system restore points. System restore was already turned off at this point from earlier attempts to fix the computer.

I ran HJT and I am attaching the log from that scan. I then attemted to run BitDefender again, it seemed to start out okay. I ended up leaving for work at that point with the intent of letting it run all day in case it took awhile.

As soon as I started it it found a problem. It is showing "C:\!KillBox\browsela.dll" infected with: Trojan.Downloader.Delf.CC. This is the same thing that was freezing KillBox earlier and I could not delete.

When I got home this evening the program was still running. It has basically been stuck on the same files were I left it this morning. It has been running for 12 hours and 15 minutes and there is an estimated time of 67 hours and 44 minutes left. It does not appear to be working properly and I was not able to shut down the computer using start-shut down-shut down-etc. I had to turn the power off to start over.

I am attaching the partial scan log from BitDefender.

I did another HJT tonight after all of this and I'm attaching that log as well.

Any ideas from here?

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Now, please look in Add or Remove Programs for the following and Uninstall them if found:

Microsoft AntiSpyware


Next, copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Now scan with HijackThis and Check the Boxes for the following:

O4 - HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 - HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe

O20 - Winlogon Notify: avload32 - C:\WINDOWS\SYSTEM32\avload32.dll
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll

Make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

Now, Copy and Paste C:\WINDOWS\System\svwhost.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\avload32.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\browsela.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\wnlogow.sys into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you have completed the above, and windows has loaded attach a fresh HJT log.

 

When I hit the red X in PocketKillbox with this file (C:\WINDOWS\system32\browsela.dll) it freezes Killbox. This also happened the last time I tried to kill this file. I haven't done anything yet, KillBox is sitting open on my desktop with this file in it.

Should I continue with the rest of the directions minus killing this file? Should I do something else before I restart?

thanks for your help

 

Restart into Safe Mode and try this fix again, if it still freezes we will try my other approach.

 

Ok, I rebooted into Safe Mode With Networking, the computer basically doesn't work in normal Safe Mode - it runs way too slow to do anything.

I still had the problem with KillBox and this file (C:\WINDOWS\system32\browsela.dll). When I hit the red X the program stops responding. The process seems to work fine for the other lines.

I'm attaching a current HJT log.

 

Okay let's start by downloading two tools we will need:

- Process Explorer 9.2

- Pocket KillBox

Extract them to there own folder somewhere that you will be able to locate them later.

Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of browsela.dll & avload32.dll once and then click the kill button. After you have killed all of the browsela.dll & avload32.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of browsela.dll & avload32.dll and kill it.

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O20 - Winlogon Notify: avload32 - C:\WINDOWS\SYSTEM32\avload32.dll
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll


Copy the bold text below to notepad. Save it as fix.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

 

This file is starting to piss me off. Same problem as before, everything works as you describe in your directions until I trill to kill browsela.dll in KillBox. The program stops responding once I hit the red X. I ran through the complete instructions two times and still nothing.

Now what? New HJT log is attached.

 

Scan with HijackThis and Check the Boxes for the following:

O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll (file missing)

After you remove the above with HJT run CCleaner to clean up cookies and temp files.

When you complete this entire post, reboot about 3 times and then attach a fresh HJT log.

 

Ok, here's a fresh HJT log. According to this it looks like it's gone - hooray!

Now what? This originally came up trying to run BitDefender, should I try that again?

 

The HJT log looks good, go ahead and run the scan to be sure.

 

BitDefender looks like it is working. It's running right now, but much faster than before and it didn't hang up on the files that were slowing it down before. I will let this run tonight, and then I'll run Panda Scan as well. I'll attach those logs, as well as a new HJT log once that is done.

Thanks again for all of your help.

 

Okay, I will be waiting on the new logs.

 

After you attach those logs for me, I would like you to run to more scans. Follow the below steps...

Please download win32delfkil.exe

• Save it to the Desktop.
• Double click on win32delfkil and install it (Installeren button)
• A new folder is created on the Desktop: win32delfkil
  
• Close all windows!
• Open the win32delfkil folder
• Double click on the fix MS-DOS Batch File
• The program runs and the computer reboots automatically.
  
• After the reboot, and back in Windows, search for the file: C:\windelf.txt
• Post the contents of the windelf.txt, along with a new HijackThis log.

After you do the above, see the thread below to run the smitRem.exe utility and attach its log.

SpywareStrike, Smitfraud, SpySheriff, SpyAxe & PSGuard Removal

 

Ok, we are making some progress here. I was able to (finally) run BitDefender and Panda Scan. I ran them both in Safe Mode with Networking. I'm attaching the BitDefender log, the Panda Scan log, and a fresh HJT log.

I will now run win32delfkill and smitRem as directed in your post, and I'll attach those logs when it is done.

 

Here is the win32delfkil log and a fresh HJT this log. I'll now run smitRem and attach that in a seperate log.

 

Here is the smitfiles log and the PandaScan log, as well as a fresh HJT log. The computer seems to be running well, nothing obvious is coming up. But the PandaScan did find a few things.

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Next, run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\WINDOWS\inet20001 ← Delete this whole folder if it exist!

C:\!Killbox ← Delete this whole folder if it exist!

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\system32\vx.tll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\mscnf.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, procede with the last few steps below...

Please download HOSTER and then follow the below steps.

• Unzip HOSTER to a convenient folder such as C:\Hoster

• Run Hoster.exe, click Restore Original Hosts and then click OK.

• Click the X to exit the program.

After you have completed this post, reboot and let me know how things are running.

 

Okay, I ran through all of the procedures you outlined. Computer seems to be running just fine, no obvious spyware or virus.

Could this be it or is there more that needs to be done? I can't believe how much of a process this is, I would be lost without you and your help.

 

If thinks are running good you should see this article on How to Protect yourself from malware!

Surf Safely!

 

Thank you again for all of your help.

 

Your Welcome!

 

Well I thought we were done, but there is still something going on with the computer. Last night the desktop got "taken over" and turned into a blank white screen. I got rid of that by going through the desktop control panel and removing it from the "web" settings. The computer is also seems to be running a little slower than normal.

Last night I reinstalled Nortan AntiVirus 2006, that was the first thing I did after turning on the computer when I got home. Norton did a full scan and did not find anything.

I started over with the "Read and Run Me First" thread:
1. No malware found in "Add/Remove Programs" in the control panel
2. Rebooted into safe mode with no network support, unplugged my network cable and ran the scans
3. CCleaner found a couple of things, I didn't write them down but one of them had "tribalfusion" in it, I deleted everything that CCleaner found
4. AdAware did not find anything
5. Spybot found 2 things but I forgot to write them down, I think it was related to Microsoft AntiSpyware, some type of notification thing
6. Microsoft AntiSpyware found one thing "Trojan.Downloader.dls Trojan Downloader". I let it fix it on its own, which it said it did and then restarted the computer. I made sure it restarted in safe mode.
7. Ran CWShredder and Kill2Me, neither found anything
8. Restarted in safe mode with networking and ran Bitdefender, it did not find anything, the scan is attached
9. Ran PandaScan and it found a couple of things, the scan is attached
10. While in safe mode with networking I ran HJT, the log is attached

 

Please see the below thread on how to run WinPfind and attach the log.

• Running WinPfind by OldTimer

 

Here you go, this only took a couple of minutes.

 

Now a fresh HJT log from normal mode.

 

Here you go.

 

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Next, run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

• Temporary Files
• Temporary Internet Files
• Recycle Bin

And Click OK.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above, REBOOT and then scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Okay, I ran through all of these steps with no problems.

Added quote to registry.

CCleaner found nothing out of the ordinary, the only cookies it delted were from known sites that I had visited.

Ad Aware found one negligent issue, mru list. I've seen that one before and I don't think it's a big deal.

SpyBot did not find anything.

Did a disk cleanup.

Flushed and reset system restore.

Ran HJT and I'm attaching a fresh log. The computer seems to be running fine, I have not had any issues and no obvious signs of spyware, viruses, etc.

 

Your HJT log looks good, if your not having any further problems, you should see this article on How to Protect yourself from malware!

Surf Safely!

 

Thank you again for all of your help.

 

Your Welcome!