Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Not sure if computer is infected


  • This topic is locked This topic is locked
9 replies to this topic

#1 runclub

runclub

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:12:13 AM

Posted 22 January 2016 - 02:06 AM

Hello,

 

I am wondering if I can ask for some help.  My computer seems to be acting strangely. Pages are loading slow, I had a random internet explorer window open with a search I had done the night before, and every day around 3pm I seem to have an internet slow down.  I am on adsl and I run a speedtest that shows no problems. 

 

I have done a virus scan, malware scan and both come back clean but I can't help think there may be something wrong.

 

Any help would be appreciated.

 

Sincerely

Jason



BC AdBot (Login to Remove)

 


#2 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:13 AM

Posted 22 January 2016 - 10:57 PM

Hello and welcome.  Please follow these guidelines while we work on your PC:

  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I have given you the ìAll clear.î  Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please note that the forum is very busy and if I don't hear from you within five days this thread will be closed.

icon11.gif   Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#3 runclub

runclub
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:12:13 AM

Posted 23 January 2016 - 01:13 PM

Thanks so much for your help.

 

I have attached them.

 

Did you want me to cut and paste them or just as attachments (for future responses).  Thanks.

 

Jason

Attached Files



#4 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:13 AM

Posted 23 January 2016 - 02:41 PM

It's easier for me if you copy/paste, thanks.  Please do this next:

icon11.gif   Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it in the same location as FRST (usually your desktop) as fixlist.txt

HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-586766140-4074568981-3268110669-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-586766140-4074568981-3268110669-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-586766140-4074568981-3268110669-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
EmptyTemp:

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now run FRST again.


  • When the tool opens click Yes to disclaimer.
  • Press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) please post it to your reply.

icon11.gif  Open Malwarebytes AntiMalware (MBAM)


  • On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
  • Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • With some infections, you may see this message box.
    • 'Could not load DDA driver'
  • Click 'Yes' to this message, to allow the driver to load after a restart.
  • Allow the computer to restart. Continue with the rest of these instructions.
  • When the scan is complete, click Apply Actions.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

Please include the following in your next post:

  • fixlog.txt report
  • MBAM log

 


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#5 runclub

runclub
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:12:13 AM

Posted 24 January 2016 - 12:19 AM

Hello,

 

here is the MBAM log:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 1/23/2016
Scan Time: 8:25 PM
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.01.24.01
Rootkit Database: v2016.01.20.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: User

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 349156
Time Elapsed: 37 min, 59 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

 

Here is the fixlog.txt

 

Fix result of Farbar Recovery Scan Tool (x64) Version:18-01-2016
Ran by User (2016-01-23 20:17:37) Run:1
Running from E:\aaaa\aaa temp\bleeping computer scan
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-586766140-4074568981-3268110669-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-586766140-4074568981-3268110669-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-586766140-4074568981-3268110669-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
EmptyTemp:
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-586766140-4074568981-3268110669-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKU\S-1-5-21-586766140-4074568981-3268110669-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found.
HKU\S-1-5-21-586766140-4074568981-3268110669-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => value removed successfully
HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => key not found.
EmptyTemp: => 166.8 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 20:17:42 ====

 

 



#6 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:13 AM

Posted 24 January 2016 - 08:40 PM

Is it running any better now?  Your logs are not showing anything concerning.


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#7 runclub

runclub
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:12:13 AM

Posted 25 January 2016 - 12:11 AM

I will check over the next day.

 

My wife was just complaining that the wifi was feeling slow.  So maybe my issue is not with this computer.  Could be another on our network (???).

 

Thanks for all of your help.  I will post an update tomorrow.

 

Cheers

Jason



#8 runclub

runclub
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:12:13 AM

Posted 26 January 2016 - 12:09 AM

Well, what can I say.  I didn't notice anything in particular today.

 

I have 7 computers on our network.  It is unusual for them to be all on at the same time but on average 3 would be on as in powered on.  I have 4 phones, 2 tablets.  And a partridge in a pear tree (LOL).

 

Oh...and an Xbox.

 

It is rare that they would all be one at 3pm when I notice a slow down.  The highest use time is obviously after 5 when everyone is home.

 

Is it worth checking all of them computers?  I have scanned them, have ESET running on all of them.  Periodically scan for malware with malwarebytes.  Or do you think we are good and just check them individually if we notice problems?

 

Thanks for your help.

Jason



#9 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:13 AM

Posted 26 January 2016 - 05:16 PM

If your ESET and MBAM scans are coming up clean and your only current issue is general slowness,  I'd recommend that you have a look here: http://www.bleepingcomputer.com/forums/t/87058/slow-computerbrowser-check-here-first;-it-may-not-be-malware/


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#10 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:13 AM

Posted 06 March 2016 - 01:36 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users