not sure whats going on...just a lot!

bobbysgirlonly · Dec 9, 2013

im not sure my problem is malware, but could be. after not being on my laptop a lot, when getting on it was VERY slow....i deleted a some programs i no longer used, i deleted a bunch of video files, i ran antispyware and CC i believe. i also ran glery? utilities? anyways after i fixed whatever it was i was supposed to "fix". my computer is as slow as ever and now i cannot open a lot of different programs. i cannot run internet explorer, the window pops up for a few seconds and then closes. i cannot run my incredimail. if i try to open windows like control panel, or right clicking on computer to get my system details, nothing.....i even tried to do a restore and kept getting errors.

so should i still go and run all that you have requested in the malware removal first or does this sound like something else.

thanks in advance, you guys/gals here have always been a great help to me!

bobbysgirlonly · Dec 9, 2013

also i totally forgot....back in july i posted about mu usb ports are being goofy....it won't recognize any devices. it shows power being sent from, them, but i can't use them. i have a wireless mouse plugged into another one and it workls fine, but every now and then i get a bubble pops up saying cannot recognize usb device? and nothing is plugged in but that. i didn't do what was requested in my help post from that, cause like i said i have not been on my laptop in quite some time....so i don't know if this has anything to do with all the other issues i am having as well

Kestrel13! · Dec 9, 2013

Yes run the procedures, if no malware is found then you can be referred to the software forum.

READ & RUN ME FIRST - Malware Removal Guide

bobbysgirlonly · Dec 9, 2013

here are the results of my logs

bobbysgirlonly · Dec 9, 2013

mgtools zip logs

bobbysgirlonly · Dec 9, 2013

the tdsskiller came back with no threats detected

Kestrel13! · Dec 10, 2013

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode

Re run Hitman and have it delete Potential Unwanted Programs

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[RUN][SUSP PATH] HKCU\[...]\Run : BackgroundContainer ("C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Jennifer\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun [7][7][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-21-2362949546-4255482857-1149388192-1000\[...]\Run : BackgroundContainer ("C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Jennifer\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun [7][7][x]) -> FOUND

[V2][SUSP PATH] BackgroundContainer Startup Task : "C:\Windows\SysWOW64\Rundll32.exe" - "C:\Users\Jennifer\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun [7][7][x] -> FOUND

[V2][SUSP PATH] {26011A4E-3307-4476-9EB8-2DC5E4B88770} : C:\Users\Jennifer\Desktop\Cash Cow\klAkla.exe [x] -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: InternetHelper3.1 - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files (x86)\InternetHelper3.1\prxtbInte.dll

O2 - BHO: IB Updater Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - (no file)

O2 - BHO: (no name) - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} - (no file)

O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: DVDVideoSoft.WebPageAdjuster - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)

O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - (no file)

O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O3 - Toolbar: InternetHelper3.1 Toolbar - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files (x86)\InternetHelper3.1\prxtbInte.dll

O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

O9 - Extra button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)

O9 - Extra 'Tools' menuitem: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - (no file)

After clicking Fix exit HJT.

Delete these:

C:\ProgramData\Conduit

C:\Program Files (x86)\Application Updater

C:\Program Files (x86)\Conduit

C:\Program Files (x86)\InternetHelper3.1

C:\Program Files (x86)\Common Files\Spigot

C:\Users\Jennifer\AppData\Local\Conduit

C:\Program Files (x86)\Common Files\Spigot

C:\Users\Jennifer\AppData\Roaming\unlimited illegal version 1.5 13 05476 646427-468-552 <<< What is this? Something snide that allows you to play games for free without paying or registering? Let me know.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

bobbysgirlonly · Dec 10, 2013

thanks so much! the only question i have before i start is, the first thing you stated is

"Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode"

do i have to do anything to do that before i begin, or is that what we are working towards by doing all of this?

as for the "unlimited illegal thing" i have no idea what it is, and i don't even care, i know at one time i have had cracks and key gens on here, but even if that is one, i don't care....i want everything gone so my laptop is running right again, i need to use if for my new job. thanks!

bobbysgirlonly · Dec 10, 2013

nm...got the normal startup thing.

i did all that you stated. logs are attached.

the only problem i has was the last things you said to delete:

C:\ProgramData\Conduit
C:\Program Files (x86)\Conduit
C:\Users\Jennifer\AppData\Local\Conduit
i could not find.

and these:

C:\Program Files (x86)\Application Updater
C:\Program Files (x86)\Common Files\Spigot
it said i could not delete cause the were open or in use

bobbysgirlonly · Dec 10, 2013

i am still having problems....internet explorer still doesn't work, nor does my incredimail. i still cannot access my computer properties, by right clicking on computer in start menu or from the windows explorer tab. usb port was still a bit wonky, but may be my cord, didn't try it with a new one yet but it does seem, a bit quicker though.

thanks.

Kestrel13! · Dec 11, 2013

I cannot help with incredimail. That's an issue for the software forum.

Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

Right-click OTM.exe And select " Run as administrator " to run it.

Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.
Code:
:Files
C:\Users\Jennifer\AppData\Roaming\unlimited illegal version 1.5 13 05476 646427-468-552
C:\Program Files (x86)\Common Files\Spigot

:reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E21303F5-25C3-485B-B132-2225C77E2DEB}]

:Commands
[emptytemp]
[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.

OTM may ask to reboot the machine. Please do so if asked.

Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.

Have you tried updating to Internet Explorer 11?

Log in or Sign up

not sure whats going on...just a lot!

bobbysgirlonly Private E-2

bobbysgirlonly Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

bobbysgirlonly Private E-2

Attached Files:

HitmanPro_20131209_1532.log

mbam-log-2013-12-09 (13-34-30).txt

RKreport[0]_S_12092013_132258.txt

bobbysgirlonly Private E-2

Attached Files:

MGlogs.zip

bobbysgirlonly Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

bobbysgirlonly Private E-2

bobbysgirlonly Private E-2

Attached Files:

MGlogs.zip

RKreport[2]_D_12102013_224155.txt

bobbysgirlonly Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member