spyware killing internet speed

couple of days ago , formatted my pc , everything was going rainbow style , while optimizing my browser , i installed a couple of " themes" for my mozilla , next day , i got to find that my internet speed is almost dead , stream , download speed so fluctuating near low boundry , and upon visting one of the the sites , the browser task bar has one stuck scentence " watiting for static h-w.xvideos.com , and the site never loads , so i removed all the themes from my adds on , and to solve such issue i had to install "no script" add on , well it worked , i managed to open the site , but most of the videos didnt load ,assuming that it is affecting my java settings ,  yea , everytime i got infected by virus , the same issue happens, last 1 was " vitro 32" , except for the issue being  , i noticed that  i have no extra programs installed in my control panel list after this issue started  , i have no extra tool bars installed in my browser , well no tool bars at all , i havent by any means pc optimizing speed programs installed , no registry enteries or recovery programms , my browser home page never got changed ,i desperatly ran some of the usual tacks " rogue killer, tdds killer , adware clearner " ofc nothing showed off ,  just for the record ,  my windows firewall has been  turned off since i formatted , i turned it on recently after i read ur forum preparation guide , but ever since i installed my windows , i got bitdefender total security 2016 , after the issue started i installed mbam , and as usual , it did nothing and as always briefly after i install mbam , it takes 2 ways of going crappy , either it pops up the lame alert " it cannot run update " and it stays this way no matter how many times i unistall it or use its cleaner tool and reinstall again , but that always happened on my past infections , whereas the new trend is when   i installl the mbam this time professional trial "30 days"  after 1 day i got that error mesage " ur trial ends in 7 days" ! i am starting to believe that this is somehow connected to the virus , i brought up this issue , cause u will do me a huge favor if u got a clue for it , also , i find out no matter how good or bad anti vrirus programms are , they work for me , in a single shot way , everytime i try new anitvirus for the first time it work  perfectly , avast premier got "vitro 32" whereas bitdefender failed , bitdefender got "backdoor variant A " where mbam failed ,etc , but after a while the computer gets infected again ,  i run 1000 of scans and they all become useless , currently i have 3 processes in my task manager with no description " atiedxx.exe , csrss.exe, winlogon.exe " whenever i right click either of them and choose " open file location " , nothing happen , and the most exciting news is when i tried my browser in SAFE MODE , everything was normal !! my surfing , download speed is perfect ! also recently my main Gmail has been hacked ,

Edited by reuch, 02 December 2015 - 08:12 PM.

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download AdwCleaner by Xplode onto your Desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Click the LogFile button and the report will open in Notepad.

IMPORTANT

• If you click the Clean button all items listed in the report will be removed.

If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Check off the element(s) you wish to keep.
• Click on the Clean button follow the prompts.
• A log file will automatically open after the scan has finished.
• Please post the content of that log file with your next answer.
• You can find the log file at C:\AdwCleanerCx.txt (x is a number).

===


Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.


Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.

Click the Add reply button.
===


How is the computer running now?
Wait for further instructions.

.

Nothing suspicious was found on your logs.

Lets check further.

You will need to temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zeok tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(Give it a few seconds to appear.)

Click the Options in bold the following options are available to you.
Select only the check boxes for the options in bold.

Running Processes
Installed Programs
Startup Information
FireFox look
Chrome Look
Do a Quick Scan

Do a Quick Scan
HijackThis log
Uninstall list
Shortcut Fix
Do a Deep Scan
Installer List
IE Default
Silent Runner
System Restore Info
Symlink Check
Reset Chrome
System Specs
Recently created
Empty Temp
Auto Clean

Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.
Do
Please attach the zoek-results.log in your reply. It's probably too long to post.

How to:
In the Reply section in the bottom of the topic Click the "more reply Options" button.


Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.

Click the Add reply button.

Make sure you Enable your AV Program.

Next run this tool and post the log also.

Download Farbar's Service Scanner utility
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/
and Save to your Desktop.
If using Windows 7 or Vista, Right-Click on fss.exe and select Run As Administrator.
If using XP, double-click to start.
Answer Yes to ok when prompted.
If your firewall then puts out a prompt, again, allow it to run.
Once FSS is on-screen, be sure the following items are checkmarked:
Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other services

Click on "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Copy & Paste contents of FSS.txt into your reply.

I do not want a full story, just let me know what issues you are having with this computer.
If many brake each one in there own paragraph.

the issue , i am having on this computer is as follows , my internet speed is dead , i am blocked from visiting certain websites , which is stuck on loading " static " address , and this all disappear when i try browsing in  " safe mode " , good bedtime  story , ha ?

Edited by reuch, 04 December 2015 - 04:31 PM.

Press the windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.

start

CreateRestorePoint:
EmptyTemp:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset
CMD: ipconfig /release
CMD: ipconfig /renew

End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Firefox:
Reset Default Browsing settings:
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-problems?utm_expid=65912487-41.djHNRQY0RhaLvvtvcd0BQA.2&utm_referrer=https%3A%2F%2Fwww.google.ca%2F

Clean the Firefox Cache.
https://kb.wisc.edu/page.php?id=15141

Is the problem persisting?

yea , " 1) my  streaming speed  is still awfully down ", the site blockage is gone , but  that happened before i did the last task u mentioned in ur last reply

 

also " 2) something has been   missing up with my computer clock & date 4 the last days  " , every couple of days my clock AM is changed to PM or vice versa and the date keeps getting changed back 1 day ,

 

" 3) i also get directed to spam ad websites when i visit certain sites  " that never happened before when i used to visit the same websites in the past, knowing that i got adblock plus and ad pop up   adds now & then

 

BUT mostly my main issue is my dead streaming speed , whereas everytime i go check it out in SAFE MODE , i find it perfect , when i watch the SAME video in normal mode , it is dead buffering , and in safe mode it runs like stallion !! that applies to any video !

Edited by reuch, 06 December 2015 - 09:09 AM.

also " 2) something has been missing up with my computer clock & date 4 the last days " , every couple of days my clock AM is changed to PM or vice versa and the date keeps getting changed back 1 day ,

A date or hour change may indicate the the Cadmium battery on your Motherboad is dying.
Leave your computer ON overnight and is there is no change than that's the issue.

===
 

" 3) i also get directed to spam ad websites when i visit certain sites " that never happened before when i used to visit the same websites in the past, knowing that i got adblock plus and ad pop on adds

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).

• Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
• Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
• Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
• Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
• If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
• The scan may take some time to finish,so please be patient.
• If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
• While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
• The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.

POST THE LOG FOR MY REVIEW.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.
===

Restore your Windows 7 to the Last good configuration
Follow the instructions on this page.
http://windows.microsoft.com/en-ca/windows/using-last-known-good-configuration#1TC=windows-7

===

If you still get popups please let me know which browser you use.

WOW , so u just overstep my main problem ,  abrakafartablabra , suddenly it is gone , just like that ! and now it is time to get to the the other 2 issues , alright , so i m gonna  try this , the paralympics way

 

let me start by saying 1 week , before i got infection back in action  , i downloaded some big file , and kept my computer on for whole 3 days , nothing weird got changed about my computer clock , ON the other hand , currently every damn trial program on my computer , got its trial period reduced to 5 days left ! some of those still had 26 days ! do u still think that my motherboard  got cadmuim in her diaper ?

 

second , obviously u seems genuinly too genuis to read my main post , in which i mentioned that mbam , is no use anymore , know why ? cuz 2 years ago when i got this damn infection and  i got blocked from the same site the same way ! when i installed mbam for the first time ever after 3 yrs of being stuck with  cuckold kaspersky , mbam cleaned everyhting after just 4 mins of threat scan , 4 months later after my next drive formatting , it was back , i know then that mbam is dead , the same way any other antivrus do for me , u didnt even care when i mentioned that mbam always got stuck on " mbam cant update error " in the past , just after 1 week from its installation everytime i install after formatting my drive , and it keeps the same way no matter what i do , EVEN mbam support failed to do smth about it and they closed my topic !

 

third , i DIDNT SAY i got pop ups -_- , i said " i get directed to malicous spam websites " whereas just as soon the open i website i am intentionally visiting , i got directed to some other spam site and i NEVER click any pop up before that even  happens , cuz I DONT HAVE POP UPS , my pop up ad blocker leave nothing to show up and i just got direct AUTOMATICALLY

 

yea  i followed ur disney magical recipe and i still get being directed to those sites , here is ur file with santa's lipstick on it  -_-

Edited by reuch, 06 December 2015 - 10:52 AM.

do u still think that my motherboard got cadmuim in her diaper ?

What I'm saying is that if you keep your computer ON and the Date and Time does not change the yes the battery is failing.

If that is the case you can create an AUTOEXEC.BAT with Notepad and type the following 2 line in a blank page.

DATE
TIME

Save the file as AUTOEXCT.BAT to your C:\ drive.

Next time you boot you will be prompted to enter the DATE and TIME.

This will ensure that you have always the correct time until you power off the computer.

If this is not the case then your motherboard may be at risk.

Check with the Internal Hardware experts here. This is not my forte.
http://www.bleepingcomputer.com/forums/f/7/internal-hardware/
===

If still having issues with MBAM

Download and run their uninstaller.
https://support.malwarebytes.org/customer/portal/articles/1835311?b_id=6438

When done, restart the computer normall and see try to reinstall the application.

===

Redirect issue.


Reset the browser(s) that have been compromised.

Reset Chrome...
Open Google Chrome, click on menu icon which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en
Select "From the beginning of time"

Restart Chrome.

====

Firefox:
Reset Default Browsing settings:
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-problems?utm_expid=65912487-41.djHNRQY0RhaLvvtvcd0BQA.2&utm_referrer=https%3A%2F%2Fwww.google.ca%2F

Clean the Firefox Cache.
https://kb.wisc.edu/page.php?id=15141
===

Reset Internet Explorer:
Menu > Tools > Internet Options > Advanced Tab.
Click the Reset button on the bottom of the pane.
Click the Apply button.
Close IE.


Clean the Internet Explorer Cache.
https://kb.wisc.edu/page.php?id=15141

For IE 10, 11 follow the following instructions.
http://refreshyourcache.com/en/internet-explorer-11/
===

If your Router was compromised this could be the cause of your redirects.

How to Reset a Router Back to the Factory Default Settings
http://www.ehow.com/how_2110924_reset-back-factory-default-settings.html

Then, please reconfigure it back to your preferred setting.. Below is the list of default username and password, should you don't know it ;)

http://www.routerpasswords.com/
http://www.phenoelit-us.org/dpl/dpl.html
===

Reset for Linksys, Netgear, D-Link and Belkin Routers
http://www.techsupportforum.com/2763-reset-for-linksys-netgear-d-link-and-belkin-routers/

====

Keep me posted.

i was busy in some issue , sry 4 late reply , but  i gotta say ,  thnx " Mr Muscle " , i never seen such powerful cleaning action

 

also thnx for the mbam link , i dont know wat i would have done without it , seriously , cause it seems that i never contacted the mbam support , i never opened a support thread for whole 3 weeks and the thread never got closed after the issue hit a solid wall !

 

i already contacted my isp , reconfigured my router , reset my internet settings , cleaned all cache ,  reset my browser config " mozilla" and delete its profile , created new one using the profile manager , and for the record i did all that BEFORE I EVEN STARTED THIS THREAD

 

ok i 'll try this 1 last time before u get me to suicide 

 

i know  it is hard , me breaking  this to you  :'(  but i think ,  the tips u mentionted in ur last reply are all worked out ! what was my issue again ? oh yea , MY STREAMING SPEED IS DEAD !!!!! and it is good in the safe mode , so  this indicates an infection !!!! any1 can c it from space !  got any left tricks in ur hat Oz ?

Edited by reuch, 08 December 2015 - 10:09 PM.

Check for the latest version of your drivers.

Navigate to this page.
http://secunia.com/vulnerability_scanning/personal/

Download and install the Secunia PSI.

Run the application and updates all the programs/drivers that needs to be updated.

===
p.s.

Secunia will start looking for new updates every time you boot the system.
This is an overkill. When all is well you can remove it using the Control Panel > Programs and Features applet.

i just contacted some friend , passing by home , found out some fag hacked my access panel , my banking data was gone yesterday and yet u refering to update my damn drivers ! good job man , close the thread -_-