BleepingComputer.com: Very Slow Pc After Virus Removal

I know immediately what comes to mind when someone makes a post like this. And let me assure you that I have done every step covered by the pinned "Slow PC?" post and more.

My issue has been since I removed a few viruses/spyware, my machine worked fine only for a few days and at this point, I can only operate within safe mode without being entirely unresponsive. XP takes 10 minutes to fully load, can't even think about loading firefox, or opening a folder because that can take ages. Maximizing or minimizing alone takes 2 minutes. And on top of all this, when something freezes up (further) task manager refuses to open (not that I get an error, it just doesn't open.)

What else can be done to clean this up? I would like to resolve this without a system restore because with all the files that I have, it would take 10 dual-layer dvds, and no, i dont have a ext. hard drive (I really wish i did)

Hi and welcome<iam moving this to the AM I Infected from the Antivirus forum..

If you cannont download these onto your PC,you will need access to another PC and save these to a CD,USB,Jump drive etc.. and transfer to the infected PC.

Please download and scan with SUPERAntiSpyware Free

• Double-click SUPERAntiSypware.exe and use the default settings for installation.
  
• An icon will be created on your desktop. Double-click that icon to launch the program.
  
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)
  
• In the Main Menu, click the Preferences... button.
  
• Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  
• Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
    
  • Scan for tracking cookies.
    
  • Terminate memory threats before quarantining.
  
  
• Click the "Close" button to leave the control center screen and exit the program.
  
• Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:

• Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  
• On the left, make sure you check C:\Fixed Drive.
  
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  
• Make sure everything has a checkmark next to it and click "Next".
  
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  
• If asked if you want to reboot, click "Yes" and reboot normally.
  
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
    
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    
  • Please copy and paste the Scan Log results in your next reply.
  
  
• Click Close to exit the program.

Although this one is better in Normal mode run it also...

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.
  
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
    
  • Then click on the Scan button.
  
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.
  
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Thank you for moving this to the appropriate thread. I've already used these programs plus more, but I'll run it again under your suggestion. (Maybe 8th time is a charm? i pray it is)

I'll edit this post with logs when it finishes.

Are you finding any suspicious processes in Task Manager? When you experience or encounter strange behavior, always check for new, unknown or suspicious processes that may be running on your system.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/06/2008 at 02:33 AM

Application Version : 4.0.1144

Core Rules Database Version : 3427
Trace Rules Database Version: 1419

Scan type	   : Complete Scan
Total Scan Time : 03:05:27

Memory items scanned	  : 251
Memory threats detected   : 0
Registry items scanned	: 9405
Registry threats detected : 0
File items scanned		: 291441
File threats detected	 : 0

I probably would, but I can't get to task manager. And the PC runs so slow I can't open my flash drive to use DTaskManager

Quote

What do you mean by this? Is TM disabled?

How are you trying to access it?

Well the way I was trying before was ctrl+alt+del and clicking task manager, but my latest attempts worked a little better.

Kaspersky, gmer, Rogue Remover, SuperAntiSpyware (which I love and use everyday), MalwareBytes none of these picked up on it, but when I tried to boot into windows normally, before the major performance hit, I was able to get a command prompt open. With this I was able to open task manager and found a suspicious update.exe running from the "supposed" windows update folder. Well it was something like -

c:\windows\softwaredistribution\4b09sd9f802394234\update\update.exe

Also in the directory were some cabs and infs as if for a driver installation. I killed the program and the file with FileAssassin but the system still wasn't fully up to speed, although it definitely helped. here are some screen shots of what's been going on.



^- Note explorer running very very heavy!



eventually explorer calmed down but....what happened to the users!

I thought I would look into that...




Plus, explorer.exe itself crashes from time to time...

This issue will require further investigation. Before that can be done you will need you to create and post a hijackthis log.

Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". If you cannot complete a step, then skip it and continue with the next. In Step 9 there are instructions for downloading the HijackThis Installer and creating a log. This is an automatic setup version which will install the program in the proper location.

When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the HJT Team.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

If after 5 days you still have received no response, then post a link to your HJT log in the thread titled "Haven't Had A Reply In Five Days?".

I'm not a mod and don't have much experience, but I thought I'd give some advice in hopes it would help as I know how annoying it is to have PC problems.

I've used Bazooka in the past and found it good at removing malware. It even finds stuff that other programs don't find and gives you easy to follow instructions on removing them. I learnt quite a bit from it. Though take my advice with a grain of salt. If you're not sure then check this out with the mods to get the go ahead. There's a lot of dodgy programs out there.

When you talked about a slow computer I also thought about processes running. The removal make have activated a logic bomb, this happened to me when I removed Windows Messenger as someone said it's got a lot of spyware in it. I'm thinking that your CPU and PF guage should be pretty high. Is there any way to find out if that's true? It may be that your PC has become a zombie.

Thanks for the input Chris, I have yet to try Bazooka though I've known of its existence. I posted a HJT log in the other forum to see what comes of that.

Oddly enough I only have an issue with explorer.exe is running. I think the file is corrupt to some degree, otherwise it wouldn't load at all. Probably a virus that appends itself to the process...

Your hijackthis log is posted here.

After posting a log, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the member assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

To avoid confusion, I am closing this topic until you are cleared by the HJT Team. If you still need assistance after your log has been reviewed and you have been cleared, please PM me or another moderator and we will re-open this topic.

Good luck with your log.