computer acting slow

Discussion in 'Malware Help (A Specialist Will Reply)' started by igetgreens, Mar 11, 2006.

  1. igetgreens

    igetgreens Private E-2

    Don't know if its my computer or internet. I did everything and it still is acting funky...here's the bitdefener and hijackthis log. Thank you very much
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please attach the PandaActiveScan log.

    Also finish all the other steps from the READ ME. I see no signs of Microsoft Windows Defender and Spybot. Did you skip anything else? What about Malicious Software Removal Tool?

    Also please describe what your problems are. What you stated thus far does not translate into anything useful to us. Also describe when it is slow. Is it only when surfing or is when running anything even when not connected to the net. Does it behave the same way in safe mode? What does "funky" mean?
     
  3. igetgreens

    igetgreens Private E-2

    i did do everything on the read me, i did spybot and had it fix everything that it found which was only 1 and Malicious Software Removal Tool found nothing and I have Microsoft Anti-Spyware which scans my computer everyday and it never finds anything and I can't use Micrsoft Windows Defender b/c of some invalid key or something. I also scanned with spyware doctor and it didn't find anything and I also scanned for viruses at trendmicro.com and it barely found anything which was fixed. Here is the Panda log. My computer seems to take longer to start up and it takes longer to load internet pages and I get pop ups which never used to happen

    thank you
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What do you mean invalid key? Is your Windows license valid and registered to you? Is it activated.

    MS Antispyware & Spybot do not show in your HJT log.
    MS AS would definitely show if installed. Spybot would only show if installed with defaults as per the READ & RUN ME instructions.

    I do see SpywareDoctor but it is not going to help you unless you purchased it. I would uninstall it unless your bought it.

    We always recommend uninstall junk like below, but they are your choice. We don't trust them.
    C:\Program Files\PartyPoker\PartyPoker.exe
    C:\Program Files\Bodog Poker\GameClient.exe

    Make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    F3 - REG:win.ini: load=???
    ?
    F3 - REG:win.ini: run=???
    ?
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} (CyImage2Ctl Class) - http://cyimg5.cyworld.nate.com/ImageUpload/CyImageUpload2.cab
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.jetsetpoker.com/setup.exe
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
    O16 - DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} (skcbgmset Class) - http://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\Download\Ares\setup_ares.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).

    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  5. igetgreens

    igetgreens Private E-2

    i am sorry but I did run spybot and the windows spyware thing but that was about a day before I posted it up. I ran spybot again and it found nothing. But everything seems fine now. My computer will not let me start up in safe mode so I did everything in normal mode but everything else seems to be back to normal.

    Thank you very much
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You may want to post a message in the Software Forum about your problems booting in safe mode. Perhaps it is just a problem with hitting the F8 key at the right time. You may want to give the msconfig method a try. This covered in step 5 of the read me in this link: Starting your computer in Safe mode

    If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds