Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Redirected searches, sluggishness and ridiculous amount of hard drive activity at startup


  • Please log in to reply
3 replies to this topic

#1 MCL69

MCL69

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:33 PM

Posted 21 December 2009 - 11:11 PM

Running Windows XP Home sp3 on a Toshiba laptop.

I was minding my own business the other day and accidentally clicked on some ad somewhere. Now, when using Firefox, my Google searches are re-directed, and over time the computer gradually gets slower and slower until nothing responds and I just have to power it off (usually after it's been on for half an hour or so). At first, I was able to use IE and avoid the slog issue, but now the redirects and sluggishness seem to be creeping in there too.

When the computer first comes up to the desktop, there is a flurry of disk activity that lasts for several minutes after the desktop appears. I have Avast installed, was using AVX before. I have run scans with AVX, Malwarebytes... both found Downloader (on a help dll) and removed it.

I have run GMER and found nothing out of the ordinary.

I installed ProcMon so I could try and figure out what is hitting the hard drive so much. As you might expect, it shows both services.exe and svchost.exe hitting every DLL in the system, doing who knows what? This happens on just about every reboot. Every several reboots the disk activity doesn't happen for some reason.

Anyway, I'm tired of running virus scans and finding nothing now. This sure feels like a rootkit, but GMER doesn't find it.

Thanks for your time. I eagerly await your instructions.

MC

Edited by MCL69, 21 December 2009 - 11:13 PM.


BC AdBot (Login to Remove)

 


#2 swagger

swagger

  • Members
  • 476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina
  • Local time:11:33 PM

Posted 30 December 2009 - 05:47 PM

Hello MCL69 and welcome to Bleeping Computer! :thumbsup:

Sorry for the delay, but as you can see, there are a lot of people with computer problems and a fraction of that amount who can help. Do you still need help? I see you've run MBAM and GMER, can you please post the logs from those 2 programs in your next reply if you would still like some help? Thanks!

Regards,
swagger

#3 MCL69

MCL69
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:33 PM

Posted 30 December 2009 - 06:11 PM

My bad, sir. I finally found an MBR rootkit and cleaned it up and everything has been great since then! I used RootRepeal and it found it at the very beginning of the File scan on C:.

So I used GMER's mbr.exe -f to clean it up. I had to do a FIXMBR and FIXBOOT from the recovery console, too. In the process of dealing with this issue, the machine became unbootable. This is the first time I've had to fix the MBR from the console, and I'm glad it works so well!

Thanks for your response and I apologize for not coming back in here to close this out.

Best regards,
M

#4 swagger

swagger

  • Members
  • 476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina
  • Local time:11:33 PM

Posted 30 December 2009 - 07:15 PM

Hello MCL69,

I'm just glad you got it fixed :thumbsup: Take care and let us know if we can help in the future!

Regards,
swagger




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users