Computer Running Extremely Slow

[jmolina]

I have a Laptop DELL D 410 which had the Avtirus 2009 trojan I ran the following programs CC cleaner MAlware Bytes; SPYBOT Spware, Mcafee Vius and Spyware 8.5 Scan and it removed a couple trojans. but it still runs quite slow. I have a attached my High Jack Log. ANy help would be greatly aprreciated.



i

 

[nobardin]

Go here and follow this guide.. https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/ then post the logs as per that guide

 

[mflynn]

Hi jmolina

Welcome aboard!

Run HJT Scan only Select and remove the below!

O9 - Extra button: Attach Web page to ACT! contact - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Attach Web page to ACT! contact... - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)

Then as you do as nobardin advised I will add.

Before you scan with SuperAntiSpyWare do the below:

SuperAntispyware config

After installed double-click the icon on your desktop to run it.

It asks to update the program definitions, click Yes.

Click the Preferences button.

Then Scanning Control.

In Scanner Options make sure the following are checked:
1. Close browsers before scanning
2. Scan for tracking cookies
3. Terminate memory threats before quarantining.
4. Leave the others as they are.


MalwareBytes config

In MalwareBytes after update but before running
Click settings and confirm all are Checked.

I repeat Update these 2 programs.

Run each program and paste the logs, run both again until they come up clean or with something they can not clean. Post logs each time.

Run them and post their logs then a new HJT log last after above..

Do this correctly and we will make a short job of this!

Mike

 

[jmolina]

My logs

I did the 8step removal process and here are my logs.

Thank You in advance

 

[mflynn]

Great job!

Since they both found issues run them again until they come up clean posting logs each step.

But make these config changes to both before scanning

SuperAntispyware config

Click the Preferences button.

Then Scanning Control.

In Scanner Options make sure the following are checked:
1. Close browsers before scanning
2. Scan for tracking cookies
3. Terminate memory threats before quarantining.
4. Leave the others as they are.

In MalwareBytes after update but before running
Click settings and confirm all are Checked.

I repeat Update these 2 programs.

Run them and post their logs then a new HJT log last.

Mike

 

[Bobbye]

I checked all three logs and have these suggestions: The first and most important: I do not see any antivirus program running. You need to put AV on the system ASAP: You mention running a McAfee virus scan but you do not have the program running:

Recommended Free Anti Virus:

Avira Free:http://www.free-av.com/en/products/1/avira_antivir_personal__free_antivirus.html
Avast Free:http://www.avast.com/eng/download-avast-home.html

Recommended Free Firewall:

Comodo:http://www.personalfirewall.comodo.com/
Zonealarm:http://www.zonealarm.com/store/content/catalog/products/zonealarm_free_firewall.jsp

Have SAS remove the Tracking Cookies. See the images here to help with that. CLicking on image will enlarge it:
http://superantispyware.en.softonic.com/images

Reset Cookies:

Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> CHECK 'override automatic Cookie handling'> CHECK 'accept first party Cookies'> CHECK 'Block third party Cookies'> CHECK 'allow per session Cookies'> Apply> OK.

Update Java:

Your version of Java is now outdated. Java vulnerabilities are commonly exploited by viruses so I strongly recommend you update. Click here to download the latest version of java ( Java Runtime Environment (JRE) 6.0 Update 10 ): http://java.com/en/download/manual.jsp
Please install it and then reboot your computer.

Please re-open HiJackThis and scan.*Check* the boxes next to all the entries listed below.

C:\WINDOWS\system32\basfipm.exe>> Broadcom ASF IP monitoring service
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe

I cannot identify this Domain:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ihub.crain.com/ ??
017 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = chi.crainit.com
O17 - HKLM\Software\..\Telephony: DomainName = chi.crainit.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = chi.crainit.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = chi.crainit.com

If this is not your company or your ISP, remove it.

Regarding ACT: If you are not actively using this program, remove the entries:

ACT! by Sage: an enterprise program. Can sync Blackberry Enterprise Server software wirelessly in real time, rather than requiring cradling. The calendar and activities require the use of ACT Scheduler for regular Outlook Activity Synchronization, but the ACT Scheduler must be manually reset each time the computer is restarted - for each person who has a Blackberry. The #1 selling contact and customer manager, ACT! helps individuals and small business owners work more effectively. With ACT!, you can easily access a complete, integrated view of your contact relationships, impress contacts with your follow-up, leave no task undone, and make informed decisions to advance your business.
C:\Program Files\ACT\ACT for Windows\Act.Scheduler.exe
C:\Program Files\ACT\ACT for Windows\Act.Scheduler.UI.exe
O4 - HKLM\..\Run: [ACTSchedulerUI] C:\Program Files\ACT\ACT for Windows\Act.Scheduler.UI.exe -Dfalse
O23 - Service: ACT! Scheduler - Sage Software SB, Inc - C:\Program Files\ACT\ACT for Windows\Act.Scheduler.exe

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis and reboot into Safe Mode:.

Start> Run> type in 'msconfig' without quotes> enter> selective Startup> startup tab> UNCHECK everything EXCEPT Appoint and your AV program> Apply> OK>

Start> Run> services.msc. right click> Properties> Disable on the following:

Broadcom ASF IP monitoring (may show as basfipm.exe
ACT! Scheduler if not using

Reboot into Normal Mode. Close the nag message that comes p after checking 'don't show this message again.' Stay in Selective Startup.

Run HijackThis and post a new log.

 

[mflynn]

I checked all three logs and have these suggestions: The first and most important: I do not see any antivirus program running. You need to put AV on the system ASAP: You mention running a McAfee virus scan but you do not have the program running:

Then what is ....
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

Who don't read logs?

Mike

 

[Bobbye]

Who don't read logs?

McAfee show in the log in Post #1.

I checked all three logs (Post #4) and have these suggestions: The first and most important: I do not see any antivirus program running.

McAfee does NOT show in the second log in Post #4.

We must deal with the most current log.