Connection slow as short bus. pls. help

Something is eating up my bandwidth. I had a major infection, which I thought I had finally managed to recover from when inetdata stopped trying to run at startup.

I've followed all the steps recommended on the READMEFIRST spyware page. I was not able to run scans in safe mode b/c I could not establish an internet connection in safe mode.

Also, I've deleted microsoft java, but not the registry keys b/c, frankly, I don't know how.

I have hijack this and can run it and post the results.

I am running Sygate Personal Firewall, Avast! Antivirus and Spybot Search and Destroy.

 

If you didnt run the scans in safe mode, did you run them in normal mode? If not please do so before running HJT. After you run the scans then procede.

Make sure you have HijackThis 1.99.1 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser and e-mail. Please close these before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT


We are very busy here at MajorGeeks.Com PhilliePhan, Chaslang or myself with check back when time permits.!

 

Hijack this log is attached. I did run the scans, just couldn't run them in safe mode.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

SearchAssistant

MyWay


Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.



Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.


O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)

O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)


Again, make sure All Browser Windows are Closed when you Click FIX.



NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:


C:\Program Files\MyWay <--- Delete whole folder!

C:\Program Files\SearchAssistant <--- Delete whole folder!


NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"


Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and how your computer is running now.

Good Luck!

 

Have done as instructed. Search Assistant and MyWay did not appear in Add/Remove.

deleted MyWay folder in safe mode. Did not see Search Assistant.

Spybot: no threats found

cleanmgr: nothing to clean.

Speed still terrible. Maybe marginally better than before.

Probably stupid questions, but: when my firewall asks me whether to allow NDIS User Mode I/O Driver (ndisuio.sys) to access the network, should I let it? Same for Windows Explorer.

 

Yes, Those 2 are ok!

Have HJT this fix these entries. Close all browsers before clicking fix.


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1


After you fix these entries,

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After you do this post a new log. How are things running now?

 

Still not good.

Reset Explorer settings. I usually use Firefox, by the way. I cleared its cache, etc.

 

These entries below are new, they just appeared in the latest log you posted?

Did you do this? Are these part of your ISP?

 

I have no idea. I was not running my isp for the log I posted before this one.

 

My connection speed has not improved. I did a test, and I'm downloading at 26kbps, and uploading at 120 kbps. I feel trapped in a terrible alternate universe. My download speed used to be so fast.

 

Got your PM, Your Welcome for the help on the cleanup. Now that your clean I would recommend you see this article on
How to Protect yourself from malware!