Stubborn performance impedance, perhaps Virus/Malware/Spyware

Status
Not open for further replies.

0mega

Posts: 8   +0
Ahh the joys of computing. Currently, I work on two main machines- a laptop for "fun" stuff, and a desktop for more serious work (which is still usually only coding)

Wonderfully, both computers have very recently become infected.. My desktop has the ever-present 'Virtumonde' trojan.. which REFUSES to release its hold, while my laptop has something different.. and unknown.

For this topic, I will focus only on my laptop (if it would be preferable for me to post information pertaining to my desktop in this thread, as opposed to a separate one, someone more knowledgeable than I please say so)

A couple days ago, I started to have horrible performance issues... All manors of media files (from AVI's to low-quality MP3's) have terrible lag / stuttering.. I'm getting random freeze-ups, that "cure themselves" after 3-5 seconds.. and no error messages.

As far as diagnosing the cause.. I really don't know. No files were downloaded, nor any new programs installed. No drivers were updated either.. The only updates that I've gotten recently are NAV LiveUpdate.. updates...

In an effort to fix the problem, I have tried restarting, defragmenting, running disk-cleanup, running CCleaner, scanning for viruses.. everything. That is what led me to this site (as none of my efforts helped) I have now followed the '8-step Viruses/Spyware/Malware removal' threads instructions.. and was disappointed to see that that alone did not fix the problem.

Also, on a very intriguing note.. I've watched Task Manager during these times of lag (which is always now.. I can't get smooth playback of ANY media file) and my CPU usage isn't even topping 20%... I don't know if there's anything any of the experts here can do.. but it's worth a shot.

Thanks in advance for any help!

[Incase it is of any assistance... COMPUTER SPECS]
Intel Core 2 Duo T7600 @ 2.33GHz
2.00 GB of RAM
250 GB HD / 110 GB free
running Windows XP- Media Center SP3
 
Here's the best advice
Uninstall Symantec AntiVirus (on both computers ;) )

Then run the Norton Removal tool

Restart

Install the free Avira Antivirus
Update it, and run a full scan
At least that way, you'll be clean (and have a faster response computer ;) )
 
After you handle the AV:
Please re-open HiJackThis and scan.*Check* the boxes next to all the entries listed below.
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\BitComet\BitComet.exe
O2 - BHO: (no name) - {39f57cc9-b2e7-4c9e-86e9-2ed9fa8aafee} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\system32\feresefa.dll ****indicates generic Trojan
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis and reboot into Safe Mode.

Right click on start> Explore> Windows System32> right click> delete on feresefa.dll if found.

Control Panel> Add/Remove Programs>
"Strongly" suggest you uninstall: BitComet
You will continue to get malware as long as it's running.

UNINSTALL Viewpoint- it is foistware and you will get pop-ups from it.
Reboot into Normal Mode

Run ComboFix:
Please download ComboFix.: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.

Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.

• Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
• Wait for the scan to be completed.
• If it requires a reboot, please do it.
• After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)

Do not click on the ComoboFix window, as it may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Rescan with HijackThis when through and attach both logs.
 
Thank you very much for the advice. I had a few things to take care of this morning, but they're done now, and I was able to follow the instructions.

Thanks, too, for the advice about BitComet.. Used it on the recommendation of a friend.. apparently he was ill-advised, himself.

No hitch with the scans, although I was a little disappointed when the Windows-startup audio 'lagged' v.v;;

Here are the logs requested.
 
Okay, ComboFix removed some system32 files. It also removed 2 Symantec 'orphan' files:
Notify-NavLogon - (no file)
SafeBoot-Symantec Antvirus/
Since you have decided to keep this program, make sure it is updated and running properly.

All manors of media files (from AVI's to low-quality MP3's) have terrible lag / stuttering.. I'm getting random freeze-ups, that "cure themselves" after 3-5 seconds.. and no error messages.
You say 'all manor of media files,' but then mention only audio:
It appears to be mechanical rather than malware-caused. Check the Device Manager and see if there are any Errors. It might be that you need a driver update.

Also, if video is also having problem:
Make sure you graphics card has Overlay enabled. Control Panel > Display > Settings> Advanced >... from there it varies by card and driver version. Look for Overlay settings. On the Troubleshoot tab make sure Hardware Acceleration is all the way up.

If the original problem has been resolved, with the exception of the above:

Remove the Cleaning Tools>
OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe
Download OTCleanIt & save it to your desktop.
Double click on OTCleanIt.exe.
Click on CleanUp!.
It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).
You will receive a prompt that it needs to restart the computer to remove the files>
Click Yes.
It will restart your computer automatically. If it doesn't, please restart your computer manually.
Clear your existing System Restore points and establish a new clean restore point:
Go to Start > All Programs > Accessories > System Tools > System Restore> Select Create a restore point> OK.
* Next, go to Start > Run and type in cleanmgr
"Ensure the selection is on C:\ and click on OK"-
* Select the *More options* tab
* Choose the option to clean up System Restore and OK it.
* This will remove all restore points except the new one you just created.

Please let us know if we can be of more help.

kimsland, please add anything you think may be appropriate.
 
Oh, sorry. Didn't mean to just ignore the Antivirus recommendation.. I just had a hard time up-and-deleting something I paid for :S It is, however, fully updated.

I followed the other recommendations in regards to media playback.. Overlays was enabled, as was Full Hardware Acceleration. Oh, and I didn't mean to only list a certain type of file. I have tried .mp3, .mp4, .wma, .wmv, .avi, .mkv, .mpg, .flv... I've tried a great many. (Windows Media Player for some.. VLC Player for whatever WMP can't play... which is a lot of things ^ ^;; )

I don't believe I'm having any Codec conflicts- I only have DivX and Xvid.

If I need other driver updates.. unfortunately, I'm not sure entirely how to pursue them. I mean, GFX card updates I understand; I have a GeForce GO 7700 from NVIDIA.. so no problems there.

Interestingly, and also somewhat disturbingly, startup times have -increased- throughout this process; not only when caused by a cleaning program forcing the restart.. I've restarted a couple times on my own.. and start-up is legitimately slower. I believe my computer is, of course, cleaner now.. which is what has me perplexed.

Nonetheless, thanks to everyone for all the help!
 
I think, Omega, that it's because in the earnest desire to tackle the malware (this is the malware forum, after all), the main issue failed to be addressed.

The main issue is that you have dogged performance. It becomes increasingly evident while playing media.

My bet is that your hard drive is getting corrupted. This is further reinforced by the fact that they're telling you to delete Norton Antivirus entries in the logs that no longer exist. That, in itself, should have sent up a red flag. Also, the deteriorating performance of your Windows startup, which on a healthy drive should be the same or faster.

Rather than addressing the main issue and sending you deleting stuff in this particular instance (certainly unwittingly) they've done more harm than good. The reason is simple. All these read/write operations, deleting, etc are totalling your MFT. Eventually, if I'm right, your laptop won't boot up at all.

I'm almost willing to bet you have that Intel Flash crap.. It's the number one cause of drive corruption on newer laptops. Disable it in the BIOS. I'm wondering if this is a Dell laptop? Dell loves that Intel crud, despite the fact that the Intel software support on it is hopeless at best at the moment.

Do not do ANYTHING else... Do not follow another recommendation, until you've run a repair on that drive. Boot into a recovery console from an XP disk and type "chkdsk c: /r" at the prompt.

After the drive has been repaired, force a defrag.
 
Do not do ANYTHING else... Do not follow another recommendation, until you've run a repair on that drive. Boot into a recovery console from an XP disk and type "chkdsk c: /r" at the prompt.

After the drive has been repaired, force a defrag.
Although I do agree that Checkdisk should be run (by the way, starting it from within Windows is totally acceptable)
I would have to state that Norton is usually the number 1 reason for slowness in users computers. I would highly suggest to start with removing that (regarding slowness issue only)

But not to follow any other recommendation may be bit extreme :D
I'd say Bobbye has put at minimum an hour on the thread, and certainly others may have their own helpful thoughts as well (ie me)
 
Please hold on this:
Do not do ANYTHING else... Do not follow another recommendation, until you've run a repair on that drive. Boot into a recovery console from an XP disk and type "chkdsk c: /r" at the prompt.
For the record, many users throw out 3 sets of logs whenever there is a problem they can't resolve. We can't ignore the logs. If given the chance, many of us will make the suggestions I have below BEFORE sending the user for malware cleaning.

However, when they run the programs, the post the logs, they have to be handled. No one has ignore a possible hardware problem- but sometimes the user makes the first choice.

I don't agree with running the repair. What I do recommend doing first-and this is way down to basics-

Boot into Safe Mode:
1. Stop all unnecessary processes from starting on boot:
Start> Run> msconfig> enter? Selective Startup> Startup tab> UNCHECK everything except the Symantec processes and the Synaptics\SynTP\SynTPEnh.exe for the touchpad> Apply> OK

2. Change all of the following Services to Manual:
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe
Reboot the system into Normal Mode>Ignore and close the nag message that comes up after checking 'don't show this message again.' Stay in Selective Startup.

Now check the Startup time.

Every 04 process loads when you boot. Every Service set to Automatic starts when you boot. The user has complete control over this- sometimes they just don't know it!
 
damn... Sometimes, I feel like I know things about computers.

And then I go a little further down the rabbit hole, and get lost once again.

It doesn't surprise me that you mention a hard drive issue- that very thing FRIED my last hard drive. We (my uncle, who built this laptop, and I) assumed it was just faulty manufacturing. Brand new HD gets put in.. and under 3 months later, its giving me signs too... *sigh*

To answer your wondering- no it isn't a Dell~ It's a custom built ASUS Mobile. Actually a year and a half old, too.

As far as this 'Intel Flash crap'.. that can be turned off in the BIOS... I, unfortunately, am not sure how to do that. Enter BIOS settings by hitting F8 on the startup screen? Really am lost in that case... Is this something I can Google reliably?

In regards to repairing the drive... I don't have XP discs.. Combo-Fix downloaded the XP Recovery Console onto my system though.. Is there anything that can be done from that?

Looks like I'm at the mercy of this forum's members again ^ ^;;

EDIT::

Saw that, while I took -forever- to write my reply, Bobbye and Kimsland returned to save the day some more.. I don't know if my post will change your opinion on anything...
 
F2 should get you into that BIOS.

From the recovery console that Combofix installed, you can run the chkdsk command. Please do that before anything else.
 
Getting into the BIOS is not a big deal- doing the wrong thing while you're in there can be. If you have someone who can help you the first time, it would be to your advantage. Even a power outage while you're in can trash the system.
 
Actually, that would be very rare. You can actually pull the power when you're in the BIOS and not hurt them.. I've personally done it numerous times.. Your mileage may vary.

However, we can deal with the Intel Flash thing afterwards. Just repair your drive for now.
 
I'd say Bobbye's "mileage" would be above just about everyone here (bar possibly Blind Dragon) Actually Bobbye in my view, is presently the best Virus\Malware removalist that TechSpot has. :grinthumb
There is certainly nothing of concern in Bobbye's knowledge, on any thread he has posted on

Possibly the thread starter 0mega, could make comment on how the computer is presently running
 
That comment wasn't in reference to malware removal. I'd very much appreciate it if you didn't take my comments out of context and then try and formulate some type of argument based on it. Thanks.

It's very common for malware removal to total an already damaged MFT. The key symptoms were ignored. Period. These "strategies" just totalled a guy's harddrive in another thread. A repairable problem that everyone, including yourself, is telling him it's done, wipe it out.. start over.

While admittedly it's difficult doing tech support on a message board, experience (and lots of it, not "paper smarts") helps isolate issues without demolishing the customer's computer. A good tech will knock off issues in order of importance.. A fuctional hard drive, in my mind anyways, ranks right up there.

Further, the comment about totalling your computer while you're in the BIOS and you lose power... Not typically true... Spoken from experience. It will total it if you try flashing it, etc, and lose power however.

With that in mind, I'm not exactly sure that some type of endorsement at this point is all that valuable. ;)
 
Wow... I certainly hope I'm not starting a fight amongst members here x.x

I had actually held off on doing anything, hoping you three experts would reach a consensus ^ ^;;;

Since I am definitely not in a position to evaluate which of the purposed fixes is 'best'.. just looking at both of them, though.. they aren't really conflicting, right? I mean, changing the processes that startup isn't deleting anything, so I won't be going against what adweston said.. that way I can follow both ideas.

As far as changing a BIOS setting.. I'm currently on my laptop, which is also plugged into the wall. So even if the power does go out, the battery -should- kick in, right? I mean, the battery is fully charged...

Also, in regards to running check disk.. if I do run it, telling it to 'repair' won't delete any data will it? ^ ^;; I've never tried to repair a hard drive.. soo.. I'm Quite ignorant in that regard.
 
It is unfortunate when members disagree on how to handle a problem "in public". However, please understand that it doesn't mean that any of the suggestions are not valid and while some comments come across as rude, we are not "fighting."

We are giving you the benefit of our varied experiences. Of course, each of us thinks that what we suggest is the best way to go. We will not reach a consensus in this case. That is not always the case, and the person asking the question must then decide which avenue to take.

Personally, I do not advise any inexperienced user to go into the BIOS. That has always been my way and it will remain so. You have clearly not demonstrated a grasp on how the computer works and I would advise you to either get someone more experienced to help you and have a tech do it.
 
With such serious cautions being pressed about entering into and changing things in the BIOS, I did follow Bobbye's suggestions of forcing a more selective startup.

The end result- a -long- bootup time... (according to the timer, 8, 10, and 5 seconds longer then before..)

It would not surprise me if some setting was merc-ing my hard drive.. it may have been the cause for the eventual failing of the previous hard drive. Stopping that from happening would be ideal..

This is, of course, not in any way meant to deface the valued input and TIME that Bobbye invested in cleaning my system; I am very sure that what you have done HAS helped.. I just believe that, at this point, there has to be something other than Malware / Spyware / Viruses that are causing this malfunction.

Now, it was mentioned that I should run Check Disk on the drive.. just wondering if there were any risks involved in this. For instance, if the utility decides to fix bad sectors.. it's not going to delete data, will it?

Thanks for all of your help on this annoyingly-long fix...
 
Boot into Safe Mode:
1. Stop all unnecessary processes from starting on boot:
Start> Run> msconfig> enter? Selective Startup> Startup tab> UNCHECK everything except the Symantec processes and the Synaptics\SynTP\SynTPEnh.exe for the touchpad> Apply> OK
The HijackThis log shows an incredible number of programs and processes loading at startup.
If you did this, there is no way it could increase your startup time.

2. Change all of the following Services to Manual:
And if you followed with taking the Services off of Automatic and putting them on Manual, there is no way it would increase the startup time.

So something else is going on. you began the thread with
Stubborn performance impedance,
You have done the regular maintenance, so go ahead an run the Error Check:
My Computer> right click on the Local Drive- usually C> Properties> Tools> Error Check> Check both boxes on the screen that comes up> Next> Close the message and reboot the system. Error Check will begin in 9 seconds. Let it run to completion. System will reboot when through.

See how much difference-if any-this makes in the system performance. The next step I would recommend is to run the memtest on the memory chips:
https://www.techspot.com/vb/topic62524.html

The problem is mechanical- whether we can fix it remains to be seen.
 
With such serious cautions being pressed about entering into and changing things in the BIOS, I did follow Bobbye's suggestions of forcing a more selective startup.

The end result- a -long- bootup time... (according to the timer, 8, 10, and 5 seconds longer then before..)

It would not surprise me if some setting was merc-ing my hard drive.. it may have been the cause for the eventual failing of the previous hard drive. Stopping that from happening would be ideal..

This is, of course, not in any way meant to deface the valued input and TIME that Bobbye invested in cleaning my system; I am very sure that what you have done HAS helped.. I just believe that, at this point, there has to be something other than Malware / Spyware / Viruses that are causing this malfunction.

Now, it was mentioned that I should run Check Disk on the drive.. just wondering if there were any risks involved in this. For instance, if the utility decides to fix bad sectors.. it's not going to delete data, will it?

Thanks for all of your help on this annoyingly-long fix...


The best, most thorough and accurate way of fixing it is by going to the Recovery Console and typing "chkdsk c: /r" at the prompt.

I've actually seen it where a Windows chkdsk in My Computer was run on a damaged drive and actually did MORE damage...

Just my personal experience. Take it or leave it.
 
You are surely doing a great job of confusing this user! Maybe somewhere, sometime on some system damage was done, but that is NOT how it usually works.

I would appreciate it greatly if you stopped finding a fault with what is suggested. We have someone with a problem who is asking for help- how about let's give it instead of disputing everything the "other" person says!
 
This isn't about "finding fault". This is about sharing an experience with someone to save them headache. We fix dozens of computers every week of all makes and models. We don't sit on a message board, looking to extend our e-peen.

If I share something on this board, it's because I've done this for 24 years, I've run into it and if I can save someone some headache, I will.

In this case, I had a PC come in that I was doing the chkdsk on. Unaware of what would happen, after three scans I went on a service call. When I got back, I found out that one of my techs had restarted it and run a Windows chkdsk on it. It completely demolished everything I had done to that point. Windows refused to boot after that.

Another time previous to that, I'd run a chkdsk on a computer. I got it into Windows and figured I'd do one more through Windows. It demoed the MFT and I had to start all over again.

You've already blown it once in this thread. Do you really want to go for a second? Or would you rather air on the side of caution?

EDIT: I was just grabbing a pop, and I just remembered a third time that this was an issue. In this case it had come in for sluggish performance. It was infected, but it was still running like crap afterwards. Because the tech was already in Windows no problems, we ran the chkdsk from the My Computer. The computer restarted, did it's repair, then restarted again. Unfortunately when it started back up, we got the now infamous message that it couldn't find c:\windows\system32\config.. etc. It completely tanked the drive. We repaired it, but... I always approach problems as "let's make it easier for the client...not harder".
 
This isn't about "finding fault". This is about sharing an experience with someone to save them headache. We fix dozens of computers every week of all makes and models. We don't sit on a message board, looking to extend our e-peen.

If I share something on this board, it's because I've done this for 24 years, I've run into it and if I can save someone some headache, I will.
You are threading a fine line here, accusing someone of "looking to extend our e-peen" whilst at the same time posting advice to the same thread!

In this case, I had a PC come in that I was doing the chkdsk on. Unaware of what would happen, after three scans I went on a service call. When I got back, I found out that one of my techs had restarted it and run a Windows chkdsk on it. It completely demolished everything I had done to that point. Windows refused to boot after that.

Another time previous to that, I'd run a chkdsk on a computer. I got it into Windows and figured I'd do one more through Windows. It demoed the MFT and I had to start all over again.
Running chkdsk inside of Windows is not possible, it will dismount the drive if repair is necessary, and since the System drive can't be dismounted for obvious reasons it is not caused by the fact that you "run chkdsk in Windows"
Code:
C:\Documents and Settings\Administrator>chkdsk c: /f
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process.  Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) n

EDIT: I was just grabbing a pop, and I just remembered a third time that this was an issue. In this case it had come in for sluggish performance. It was infected, but it was still running like crap afterwards. Because the tech was already in Windows no problems, we ran the chkdsk from the My Computer. The computer restarted, did it's repair, then restarted again. Unfortunately when it started back up, we got the now infamous message that it couldn't find c:\windows\system32\config.. etc. It completely tanked the drive. We repaired it, but... I always approach problems as "let's make it easier for the client...not harder".
The reason for this is not in the way how chkdsk was run
Chkdsk simply found a bad sector which happened to coincide with where Windows stores it's registry (which is quite common due to the fact that the registry is read and written to very oftenly thus wearing out these sectors on the harddrive more than the others)
The way for it to "fix" the fault was to remove this sector, thus making the file inaccessible (probably stored under c:\found.000)
Of course the issue was still there before running chkdsk too, if that area of the registry with the bad sector needed to be read the system would either lock up or slow down as the harddrive tried to read the data

Your last advice to only run chkdsk from the recovery CD is very very very dangerous advice!
Pre Windows XP SP1 the OS was not 48-bit LBA aware
So if the harddrive is over 137GB in size and WinXP SP0 is used to run chkdsk the result will be data corruption after 137GB!
 
That's why I said "that the computer rebooted, did it's check, then rebooted again after the check was complete"

The reason I highlighted that is because the chkdsk does not work within Windows with the "automatically fix..." box checked.

The advise is no more dangerous than if that same individual was using a Pre SP1 installation (neither of which has existed since what, 2001? 2002?) which would have the same result running it from "My Computer". Then we'll also just disregard the BIOS support stuff.. And... Size of drive when they installed their prehistoric XP, etc.

But point taken.. I'll mention "as long as you didn't buy your Windows XP disk from Fred Flinstone's Computer Store you'll be fine".

And finally, I know exactly why it did it in that ONE instance. Thank you for only highlighting one out of the three..

Chkdsk /r will do the whole thing, including recovering information from bad sectors, that the one in Windows doesn't seem able to do as effectively.
 
Status
Not open for further replies.
Back