TechSpot

Computer running extremely slow after getting rid of abebot/system alert

By sensible
Apr 23, 2008
Topic Status:
Not open for further replies.
  1. After downloading spy bot search & destroy all my popups disappeared so I thought I had fixed my problems. WRONG.

    Now my computer is running slow beyond belief. As I entered this site it kept doing "Firefox is not responding" ordeal, before I finally was allowed to post a new thread topic.

    Along with downloading spy bot s&d I also took Avast off my computer and elected to go with AVG. I also put on ZoneAlarm to keep me completely safe..

    I'm just wondering if anyone can help me at least speed up my computer & rid me of having to browse the internet with the annoying "not responding" comment coming up and freezing.

    I'm going to attach my hjt log. Thanks ahead of time. :)
     
  2. sensible

    sensible TS Rookie Topic Starter

    Also, another thing...

    Whenever I first log onto my computer this little box pops up that says:

    RunDLL
    Error Loading: C:\Users\DD\AppData\Local\temp\atdupenx.dll
    The specified module could not be found.
     
  3. sensible

    sensible TS Rookie Topic Starter

    Ugh..Now I have encountered an even bigger problem.

    A RunDLL box won't stop popping up constantly and it's saying..

    Error loading.

    Specified module could not be found.

    It never did this before, with the boxes keep popping up..but now it just keeps going to no end..

    Can someone help me please..
     
  4. kritius

    kritius TS Guru Posts: 2,087

    You say that you got rid of abebot, how did you get rid of it?
     
  5. sensible

    sensible TS Rookie Topic Starter

    It just keeps from popping up, so I figured it was gone..

    Perhaps it's not, i don't know. Meh.

    Do you have any idea on how to stop this RunDLL thing from popping up continually? whenever I close it a new one appears, even when i don't close it, it keeps popping up.

    Sorry to bother you, I know you're probably busy with other things.
     
  6. kritius

    kritius TS Guru Posts: 2,087

    : Download and Run DSS

    Download Deckard's System Scanner (DSS) to your Desktop. You must be logged onto an account with administrator privileges.
    • Close all applications and windows.
    • Double-click on dss.exe to run it, and follow the prompts.
    • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<- this one will be minimized.
    • Attach the main.txt and the extra.txt in your reply.
     
  7. sensible

    sensible TS Rookie Topic Starter

    Thank you for taking time to respond. Here goes my logs.
     
  8. kritius

    kritius TS Guru Posts: 2,087

    Disable Teatimer
    Please disable Teatimer as it may interfere with the fix.
    First:
    • Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
    • Choose Exit Spybot S&D Resident
    Second:
    • Open Spybot S&D
    • Click Mode, check Advanced Mode
    • Go To Left Panel, Click Tools, then also in left panel, click Resident
    • If your firewall raises a question, say OK
    • Uncheck the box labeled Resident Tea-Timer and OK any prompts.
    • Use File, Exit to terminate Spybot
    • Reboot your machine for the changes to take effect.
    Once your log is clean you can re-enable those settings in TeaTimer.

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      [kill explorer]
      C:\Users\All Users\nqtsdcbw
      C:\Users\All Users\ydolkpdu
      C:\Program Files\PokerStars.NET
      C:\Users\staples\AppData\Local\Temp\wvUnMfdE.dll
      C:\Users\staples\AppData\Local\Temp\atdupenx.dll
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\5462172c
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds
      purity
      [start explorer]
          
    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Please download ATF Cleaner by Atribune.

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.
    For Technical Support, double-click the e-mail address located at the bottom of each menu.

    Fix entries using HiJackThis
    • Launch HiJackThis
    • Click the Do a system scan only button
    • Put a check next to the entries listed below
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {84938242-5C5B-4A55-B6B9-A1507543B418} - (no file)
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\staples\AppData\Local\Temp\wvUnMfdE.dll,c
    O4 - HKCU\..\Run: [5462172c] rundll32.exe "C:\Users\staples\AppData\Local\Temp\atdupenx.dll",b


    • IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
    • Click the Fix checked button and close HiJackThis
    • Reboot HijackThis if necessary
     
  9. sensible

    sensible TS Rookie Topic Starter

    I did everything you advised kritius, and I'd like to thank you once again for helping me.

    Everything I did went smoothly outside from the last request.

    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\staples\AppData\Local\Temp\wvUnMfdE.dll,c
    O4 - HKCU\..\Run: [5462172c] rundll32.exe "C:\Users\staples\AppData\Local\Temp\atdupenx.dll",b


    Those TWO things weren't found anywhere during the scan. I checked it over about ten times and still they didn't appear. I'm wondering did I do anything wrong?
     
  10. sensible

    sensible TS Rookie Topic Starter

    Here goes the other thing you requested too.

    Explorer killed successfully
    File/Folder C:\Users\All Users\nqtsdcbw not found.
    File/Folder C:\Users\All Users\ydolkpdu not found.
    File/Folder C:\Program Files\PokerStars.NET not found.
    File/Folder C:\Users\staples\AppData\Local\Temp\wvUnMfdE.dll not found.
    File/Folder C:\Users\staples\AppData\Local\Temp\atdupenx.dll not found.
    < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\5462172c >
    Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\5462172c not found.
    < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds >
    Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds not found.
    < purity >
    Explorer started successfully

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04242008_124900
     
  11. kritius

    kritius TS Guru Posts: 2,087

    Post a fresh HijackThis log for me please.
     
     
  12. sensible

    sensible TS Rookie Topic Starter

    Here ya go.
     
  13. kritius

    kritius TS Guru Posts: 2,087

    That looks clean,

    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.