DDS/HijackThis logs are not
permitted in this forum. The Malware Response Team members are all volunteers who contribute to helping members as time permits but currently there is a backup and you may have to wait for assistance. Referrals are made to the Virus, Trojan, Spyware, and Malware Removal Logs forum
if we cannot assist you here and we need to use more powerful tools or you don't mind waiting. However, in your case, you posted in that forum and did not include a log so your topic was moved here
The issues you describe may or may not be malware related. When you experience or encounter strange behavior, always check for new, unknown or suspicious processes in Task Manager
Most of the processes in Task Manager will be legitimate as shown in these links.
Anytime you come across a suspicious file or one that you do not recognize, search the name using Google <- click here for an example
Or search the following databases:
Determining whether a file is malware or a legitimate process usually depends on the location
(path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file like svchost.exe. However, it then places itself in a different location (folder) than where the legitimate file resides and runs from there. Another techinique is for the process to alter the registry and add itself as a Startup program
so that it can run automatically each time the computer is booted. Keep in mind that a legitmate file can also be infected by some types of malware such as Virut
which is a dangerous polymorphic file infector
. A file's properties may give a clue to identifying it. Right-click
on the file, choose Properties
and examine the General and Version tabs.
Tools to investigate running processes and gather additional information to identify them and resolve problems:These tools will provide information about each process, CPU usage, file description and its path location.
If you cannot find any information, the file has a legitimate name but is not located where it is supposed to be, or you want a second opinion, submit it to Jotti's virusscan
. In the "File to upload & scan
" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis.
-- Then post back with the results of the file analysis.
Bleeping Computer DOES NOT recommend the use of registry cleaners/optimizers for several reasons: Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable
...even though running a "Registry Fix" program.
The Windows registry
is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component
because it is where Windows "remembers
" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry
. Not all registry cleaners are created equal
. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry
". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work. Not all registry cleaners create a backup of the registry before making changes
. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE
making any changes to the registry. Improperly removing registry entries can hamper malware disinfection
and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable
to removal tools. The usefulness of cleaning the registry is highly overrated and can be dangerous
. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results
Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily
could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great
If you have been using a registry fix program for a long time, it could be responsible for some of the performance issues you are experiencing.
...even though running Spybot and Adaware regularly...
is no longer recommending
Spybot S&D or Ad-Aware due to poor testing results. See here
- (scroll down and read under Freeware Antispyware Products)
Further, most people don't understand Spybot's TeaTimer
or how to use it and that feature can cause more problems than it's worth. TeaTimer monitors changes to certain critical keys in Windows registry
but does not indicate if the change is normal or a modification made by a malware infection. The user must have an understanding of the registry and how TeaTimer works in order to make informed decisions to allow or deny the detected changes. Additionally, TeaTimer may conflict with other security tools which do a much better job of protecting your computer and even prevent disinfection of malware by those tools.
More effective alternatives are Malwarebytes Anti-Malware
and SUPERAntiSpyware Free
If you don't want to follow these instructions and do not mind waiting, then please follow the directions in the the pinned topic titled Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help
. If you cannot complete a step, then skip it and continue with the next. In Step 7
there are instructions for downloading and running DDS
which will create a Pseudo HJT Report
as part of its log. Start a new topic, give it a relevant title and post your log in the Virus, Trojan, Spyware, and Malware Removal Logs forum
, NOT here
, for assistance by the Malware Response Team Experts.