Computer runs slower?

[Daner]

Hi can anyone check this log for me?
i scanned my comp with kaspersky, adaware, xoftspy and windows defender

by the way im new here :wave:

thanks

 

[howard_hopkinso]

Hello and welcome to Techspot.

I can find nothing in your HJT log that would account for your problems.

However, that doesn`t necessarily mean your system is clean.

With that in mind, go HERE and follow the instructions exactly.

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard :wave: :wave:

 

[tomrca]

what about this one? C:\Programmer\utorrent.exe
it seems to be access to bad sites, and its a running process.

 

[Daner]

I trust Utorrent... but if there is something bad about it let me know

i did the instructions Howard as you said.. so here is the log

there is one question though.. i dont know if its a spyware or something but sometimes when im on the internet a popup comes saying i have a virus (or something else) it pops up even if im in google!

thanks

 

[tomrca]

this is for information only don't do anything until howard has viewed your new hjt log. it seems that the scan that you have done has most likely removed 'utorrent.exe' as i cant see it in the log

information i have found on this:C:\Programmer\PowerISO\PWRISOVM.EXE is situated here

 

[howard_hopkinso]

I don`t know why, but it appears besides Kaspersky, you have Nod32 antivirus entry in your log. Running more than one antivirus programme is not recommended, as it can cause conflicts and will slow your system down. I suggest you uninstall Nod32.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name. See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there)

Eset

Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [nod32upd] rundll32 "C:\Programmer\Eset\fc_upd.dll",NOD32Ioctl

O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab

O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab

O16 - DPF: {EDAF796E-9210-4417-ADDC-2AB18E4F6C27} (Hjemmeside.KvikFoto) - http://www.123hjemmeside.dk/builder/pages/KvikFoto.CAB

Click on the fix checked button.

Close HJT.

Reboot into normal mode and turn system restore back on.

Let us know how your system is running.

Utorrent and Poweriso are both legit programmes and nothing to worry about.

Regards Howard

 

[Daner]

thank you very much!!

but i still have that annoying pop up thingy

you think any of you know about this problem?

by the way i have a new hijackthis log

just in case

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode, under your normal user name. See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [nod32upd] rundll32 "C:\Programmer\Eset\fc_upd.dll",NOD32Ioctl

O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab

O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab

O16 - DPF: {EDAF796E-9210-4417-ADDC-2AB18E4F6C27} (Hjemmeside.KvikFoto) - http://www.123hjemmeside.dk/builder/pages/KvikFoto.CAB

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Programmer\Eset Make sure you have uninstalled This programme.

Regards Howard

 

[Daner]

ok thats done!

im gonna post a new hijack log.

ive got the link from the pop up site.. im gonna post it here but dont click it yet though... still dont know where its from

 

[howard_hopkinso]

Your HJT log is clean. Are you the system administrator? The reason I ask, is I`d like to make sure, you`re not running a limited account.

However, that link is nasty. It a link to a website that makes a bogus security product.

Check in your add remove programmes for anything related to Winantivirus and uninstall, if found.

Boot into safe mode an turn system restore off.

Run a full system scan with your antivirus programme and delete whatever it finds.

Run spybot and adaware scans and delete whatever they find. Make sure you have all the latest definition files.

Once done, bot into normal mode and turn system restore back on.

Let us know how your system is running.

Regards Howard

 

[Daner]

thats odd.... now when i enter Safe Mod i only get a black screen... i can see the text at each corner but nothing else... all i can do is to press ctrl-alt del :/

 

[howard_hopkinso]

Are you booting into safe mode under your normal user account name? If not, that`s what you need to do.

Regards Howard

 

[Daner]

yes im in my normal account (i am also administrator)

 

[howard_hopkinso]

Wierd. I`m not sure what the problem is with safe mode. Does this happen every time you try and go into safe mode?

Did you find anything in add remove programmes to do with Winantivirus?

Have you ever had Winativirus installed on your system?

Do a search of your system for winantivirus and delete any entries found.

Regards Howard

 

[Daner]

no this is first time it happend..

there was nothing in add/remove.. and i dont think i ever had winantivirus but i had other suspicius popups

im currently searching my whole comp for winantivirus


nothing...

 

[howard_hopkinso]

Download and run these three tools. Follow the instructions for using each tool.

Tool1. Tool2. Tool3.

Let me know if this helps and post a fresh HJT log.

Regards Howard

 

[Daner]

well while i was in safe mode i used the Ctrl alt del window->file-> run

the smithfraud fix went fine .. but the 2 others didnt work... so i ran them in normal mode... the look2me didnt find any but the virtumundo dont work for me... its not responding.....

 

[howard_hopkinso]

Perhaps the VirtumundoBeGone file was corrupt. Try redownloading it and running it again.

If that doesn`t work, try this one HERE.

Regards Howard

 

[Daner]

nope... didnt find any

 

[howard_hopkinso]

This is very strange, I can`t understand why you`re getting popups. There`s nothing in your HJT log.

I can`t see any firewall software in your HJT log. Download the free Zonalarm firewall from HERE and install it.

Then, uninstall Windows defender from add remove programmes.

Go HERE and follow all the instructions exactly. That means running all the tools as directed.

Once you`re done, please let us know how your system is running. I`d also like to see an Ewido log.

Regards Howard

 

[Daner]

i think i found the problem.. while i was running a Spybot searc and destroy scan it found something with "hotbar".. and i also ran a full Kaspersky scan and it found several files like popup.html(1) etc... the popup hasent showed up yet


anyways im going on vacation to Sweden but i will post in this thread if the popup comes again!

thanks for everything!!!

a hijack this log just in case...

 

[howard_hopkinso]

Your HJT log is clean.

Just have HJT fix these inactive entries.

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll (file missing)

Regards Howard

This thread is for the use of Daner only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.