Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bot Running on Win7 PC slowing computer to a crawl


  • This topic is locked This topic is locked
3 replies to this topic

#1 KendallB

KendallB

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 22 February 2014 - 03:56 PM

Running relatively new computer with Win7, all updates installed.  Windows Defender/Firewall running, and Malware Bytes installed and run frequently.

 

Checked Task Manager, CPU usage is about 98%.  Computer almost unusable.

 

Can't seem to find the program/trojan/bot that's causing the issue.

 

Populating the user/appsdata/local/temp/cache folder with 1000's of folders overnight.

 

Each "numerically named" folder contains 100's of .txt files.  Opened some of the text files.  Don't really make any sense, but many contain a .com address (all different) mixed in with other random text (doesn't look like a conventional spam e-mail that would be sent), so assume the bot is sending these out as SPAM e-mails to others and the other characters are some type of "code"???

 

Anyway, in 2 nights the CACHE folder was populated by over 4000 folders generated by this bot.  Took most of the night to delete them from the computer.  Had to go into SAFE MODE to even have enough processing power to delete these.  Soon as you boot normally, the bot starts running again, populates CACHE directory, and slows computer down and hogs bandwidth so nothing else works well.

 

Have run Malware Bytes - Full Scan - nothing found

 

Ran Windows Defender - Full Scan - nothing found

 

Ran Microsoft Safety Safety Scanner - nothing found
 

Ran AVG Free - Full Scan - nothing found

 

Tried installing Avast Free - installation error in Safe Mode, perhaps will install in "normal mode"???

 

Tried installing Comodo Internet Security - would not allow full installation (only Dragon Browser installed - errors on everything else)

 

1.  Any ideas on how to identify what bot/trojan/root-kit this is?

 

2.  What bot removal tool is suggested for ID and removal?

 

3.  Any other thoughts/suggestions?  I'm stuck.  

 

Thanks in advance.

 

 

 

 



BC AdBot (Login to Remove)

 


#2 KendallB

KendallB
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 23 February 2014 - 04:19 PM

Can anyone help, or tell me where to start, so I can try to identify the virus, bot, etc and then remove it?  Can't use computer until this is fixed.  Thank you.



#3 aharonov

aharonov

  • Malware Response Team
  • 2,441 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:22 AM

Posted 24 February 2014 - 06:57 AM

Hi there,

please run a FRST scan:


Please download Farbar Recovery Scan Tool and save it to your Desktop.
(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)
  • Start FRST with administator privileges.
  • Make sure the option Addition.txt is checked and press the Scan button.
  • When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
  • Please copy and paste these logs in your next reply.


#4 aharonov

aharonov

  • Malware Response Team
  • 2,441 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:22 AM

Posted 12 March 2014 - 12:02 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users