Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

No Virus but system is very slow, even using over 1GB or RAM


  • Please log in to reply
6 replies to this topic

#1 GSF

GSF

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 22 October 2008 - 12:56 PM

Hello,
I am having slow browsing problem. As mentioned above there is no virus. Even though not very many applications are running, it sometimes uses over 1GB of RAM. But slow even when not using that much memory.
System Config:
Celeron 1.2 Gig, 512 MB RAM
Windows XP Home SP3
AVG 8 (Free version)
use OpenOffice for word processing
Adobe Pro trial version
IE 6.0.29
hope it helps

thanks for help
GSF

BC AdBot (Login to Remove)

 


#2 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 22 October 2008 - 01:09 PM

I notice you posted a HJT log some whie ago with seeming similar problems http://www.bleepingcomputer.com/forums/ind...=145045&hl=

but did not go back to it to get the comp checked out; I note you have installed SP3 since that log was posted

I would ask what scans have you run that have apparently confirmed you to BE infection -free and do you have any of their log reports for the Team to check out for you?

#3 GSF

GSF
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 22 October 2008 - 01:24 PM

Hi,
The reason why I didn't follow up was the delay in reply. By the time I received the reply, I had already formatted my HD and reinstalled everything. It worked fine in the beginning but now I am in the same sictuation again. Not only IE takes longer but also over all surfing is slow. By the way what does BE infection free mean?

Here is the latest log report:
"Scan ""Scan whole computer"" was finished."
"Infections found:";"0"
"Infected objects removed or healed:";"0"
"Not removed or healed:";"0"
"Spyware found:";"0"
"Spyware removed:";"0"
"Not removed:";"0"
"Warnings count:";"0"
"Information count:";"0"
"Scan started:";"Tuesday, October 21, 2008, 9:32:10 AM"
"Scan finished:";"Tuesday, October 21, 2008, 12:31:38 PM (2 hour(s) 59 minute(s) 27 second(s))"
"Total object scanned:";"1038646"
"User who launched the scan:";"Admin"

"Warnings"
"File";"Infection";"Result"
"C:\Documents and Settings\Admin\Cookies\admin@2o7[2].txt";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"C:\Documents and Settings\Admin\Cookies\admin@2o7[2].txt:\2o7.net.1cf21bac";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@2o7[1].txt";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@2o7[1].txt:\2o7.net.b4555a41";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@2o7[1].txt:\2o7.net.c54beffb";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@2o7[1].txt:\2o7.net.d3932de8";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.eec26c3e";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@ad.yieldmanager[1].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@adbrite[2].txt";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@adbrite[2].txt:\adbrite.com.44f92a69";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@adbrite[2].txt:\adbrite.com.71beeff9";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@adbrite[2].txt:\adbrite.com.d5e309c2";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@overture[2].txt";"Found Tracking cookie.Overture";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@overture[2].txt:\overture.com.52ca467a";"Found Tracking cookie.Overture";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@overture[2].txt:\overture.com.e626e6be";"Found Tracking cookie.Overture";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@questionmarket[1].txt";"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@questionmarket[1].txt:\questionmarket.com.3eb5a9f1";"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@questionmarket[1].txt:\questionmarket.com.4dd5e426";"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@revsci[1].txt";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@revsci[1].txt:\revsci.net.122bd7a6";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@revsci[1].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@revsci[1].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt:\tacoda.net.27341d57";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt:\tacoda.net.4366831a";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt:\tacoda.net.5935e89";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt:\tacoda.net.c4fe2ebb";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt:\tacoda.net.e9f57f8";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tacoda[2].txt:\tacoda.net.ed9c50d1";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tribalfusion[2].txt";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@tribalfusion[2].txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@yieldmanager[1].txt";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\Samina\Cookies\samina@yieldmanager[1].txt:\yieldmanager.com.ce59db3e";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt:\ad.yieldmanager.com.87a9ab5d";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"C:\Documents and Settings\ZAID\Cookies\zaid@ad.yieldmanager[1].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"

#4 GSF

GSF
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 30 October 2008 - 08:13 AM

I am disappointed as nobody did a follow up to my reply..
GSF

#5 Maniac

Maniac

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria, EU
  • Local time:06:07 PM

Posted 30 October 2008 - 10:09 AM

Scan with MalwareBytes' Anti-Malware:

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Then, submit log file ESET SysInspector, to see what the situation.

Download ESET SysInspector
http://www.eset.com/download/sysinspector.php

- Start program through the SysInspector.exe
The program will collect information about the situation on your machine.
- When "inspector" is ready and log file - generated, select File> Save Log
- Confirm their wish

Choose to save the file somewhere and then upload on http://4storing.com/ (when you open the page, click on the Great Britain flag to open the page in English), then give me the link.


Posted Image

#6 GSF

GSF
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 30 October 2008 - 01:53 PM

Thank you very much. I am now following the instruction and will post after I am done,
Thanks again
GSF

#7 GSF

GSF
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 31 October 2008 - 08:35 AM

Here is the log:

Malwarebytes' Anti-Malware 1.30
Database version: 1340
Windows 5.1.2600 Service Pack 3

10/30/2008 2:50:28 PM
mbam-log-2008-10-30 (14-50-28).txt

Scan type: Quick Scan
Objects scanned: 88060
Time elapsed: 38 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 7
Files Infected: 25

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\CodecBHO.DLL (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.codecplugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.codecplugin.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11cfa0d1-1625-4a1c-aa90-dcae27334fc5} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{11cfa0d1-1625-4a1c-aa90-dcae27334fc5} (Adware.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Starware408 (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware408\bin (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware408\icons (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\MicroAntivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408 (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\contexts (Adware.Starware) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Starware408\Starware408Config.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware408\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\MicroAntivirus\microAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MicroAntivirus\microAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MicroAntivirus\microAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\1223_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\1223_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\1229_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\1229_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\logo.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\logoxp.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\Weather.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\WeatherHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\weatherhotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\buttons\weatherxp.png (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\contexts\related.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Starware408\contexts\travel.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\RECYCLER\ADAPT_Installer.exe (Heuristics.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\ZAID\Desktop\MicroAntivirus.lnk (Rogue.XPertAntivirus) -> Quarantined and deleted successfully.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users