Inactive Computer has slowed to the point of not functioning. Logs Attached

Status
Not open for further replies.

JHibb

Posts: 19   +0
I start up my system and it runs normally for 5-10 minutes. After that period of time it then becomes basically unusable and extremely slow.

Strange things I've noticed:
  • Unable to open IE. When I attempt to, it shuts down immediately and a download file prompt shows up. This does not happen with Firefox or Chrome
  • Whenever I create or copy/paste a file, my system tries to get me to install Roxio Media Center
  • Google chat has stopped functioning properly

This problem only began a few days ago.

Unfortunately it can't make it through an Avira Scan - Not sure why. I was able to complete a full mbam, Hijack this, and CCleaner scan.


Thank you for your help.

[Edit:Should say " has slowed" in the title. ]
 

Attachments

  • mbam-log-2010-04-06 (17-41-35).txt
    1 KB · Views: 3
  • hijackthis4-7.txt
    7.8 KB · Views: 2
Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  1. Please, never rename Combofix unless instructed.
  2. Close any open browsers.
  3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  4. Double click on combofix.exe & follow the prompts.
  5. When finished, it will produce a report for you.
  6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 
New Logs

As instructed...

Thank you.
 

Attachments

  • hijackthis4-12.txt
    7.8 KB · Views: 1
  • Combofixlog.txt
    13.3 KB · Views: 1
Combofix log looks good now :)
How is the computer doing at the moment?

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

=======================================================================

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

  • Alternative download: http://majorgeeks.com/Dr.Web_CureIT_d4783.html
  • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
  • This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, select Complete scan.
  • Click the green arrow
    drweb.jpg
    at the right, and the scan will start.
  • Click Yes to all if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click File and choose Save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • [color=5]Important![/color] Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.


Post fresh HijackThis log as well.
 
Update

its still not doing so hot... I started the complete Dr. Web scan yesterday and it was going very slow. I left work to let it run overnight and when I got in this morning it had hardly progressed. Its like my comp is processing thing in little tiny chunks with long breaks in b/w.

I've restarted my computer and it is working fairly well at this point. Hopefully it does not slow up like it did last time

I'm restarting the complete scan now. Unless I hear otherwise :)


Thank you for your help.

EDIT :

My computer made it through today without any problem. DrWeb Log below:

List-C.bat;C:\ComboFix;Probably BATCH.Virus;;
f_000068\gziped.gz;C:\Documents and Settings\jhibbard\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_000068;Probably SCRIPT.Virus;;
f_000068;C:\Documents and Settings\jhibbard\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache;Archive contains infected objects;Moved.;
IV864900.exe;C:\Program Files\Principal\MktgIllus\Symbr;Probably BACKDOOR.Trojan;;
Dc1.exe\32788R22FWJFW\List-C.bat;C:\RECYCLER\S-1-5-21-2326956574-3100943105-2500339100-1128\Dc1.exe;Probably BATCH.Virus;;
Dc1.exe;C:\RECYCLER\S-1-5-21-2326956574-3100943105-2500339100-1128;Archive contains infected objects;Moved.;
A0025027.exe;C:\System Volume Information\_restore{65DD1BB6-9AB6-42BA-9822-B87490F369ED}\RP104;Trojan.KeyLogger.origin;Incurable.Moved.;
A0026064.exe\32788R22FWJFW\List-C.bat;C:\System Volume Information\_restore{65DD1BB6-9AB6-42BA-9822-B87490F369ED}\RP105\A0026064.exe;Probably BATCH.Virus;;
A0026064.exe;C:\System Volume Information\_restore{65DD1BB6-9AB6-42BA-9822-B87490F369ED}\RP105;Archive contains infected objects;Moved.;
 

Attachments

  • hijackthis4-13.txt
    8.6 KB · Views: 0
Very good :)

Will Avira scan now without a problem?

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.


2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

  • Spyware, Adware, Dialers, and other potentially dangerous programs
    [*] Archives
    [*] Mail databases
6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Post fresh HijackThis log as well.
 
Status
Not open for further replies.
Back