This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Running Windows 8.1 and computer very slow

72 min read

This thread's last reply is from August 2, 2014, 4:57 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Nataki
August 1, 2014, 9:36 PM UTC
Hello Gary

Here is the new log :
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-07-2014
Ran by [removed] at 2014-08-01 17:35:40 Run:8
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
DeleteKey: HKEY_USERS\S-1-5-21-1878744788-286734763-1557507328-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1878744788-286734763-1557507328-1001\Software\WhiteSmoke_New
DeleteKey: HKEY_USERS\S-1-5-21-1878744788-286734763-1557507328-1001\Software\Trolltech
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
C:\Users\Nathalie\AppData\Local\Temp\Quarantine.exe
C:\Users\Nathalie\AppData\Local\Temp\SetupUtil.exe
*****************

HKEY_USERS\S-1-5-21-1878744788-286734763-1557507328-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1878744788-286734763-1557507328-1001\Software\WhiteSmoke_New => Key not found.
HKEY_USERS\S-1-5-21-1878744788-286734763-1557507328-1001\Software\Trolltech => Key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B} => Key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC} => Key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B} => Key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC} => Key not found.
C:\Users\Nathalie\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Nathalie\AppData\Local\Temp\SetupUtil.exe => Moved successfully.

==== End of Fixlog ====
Gary R
August 1, 2014, 10:10 PM UTC
Excellent, it looks like the Registry Keys I'd scripted earlier had actually been removed, it just wasn't clear from the log report. Still they're gone and that's all that matters.

How is your computer running now ?

I'd like you to run a "general purpose" scan for me now, to make sure that your computer hasn't got any other infections. The scans we've run so far have been pretty specific and aimed at removing the infection I saw in your original logs. The scan I want you to run now is much more wide ranging and should pick up anything else if it is present.

It does take a long time to run (could be hours), but it is very thorough.

Please run a scan with ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
  • Please go HERE then click on Run ESET Online Scanner

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on:
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked.
  • Now click on Advanced Settings and select the following:

    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology


  • Now click on:
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed click on Start to start the scan.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed you will be presented with a list of found threats ....
    • Click on the List of found threats link
    • Click on Export to text file
    • Save as ESET.txt to your Desktop
  • Exit out of ESET Online Scanner.
  • Post me the contents of ESET.txt please.
Nataki
August 2, 2014, 1:37 AM UTC
Hello Gary

I must be doing something wrongé I've deactivated Norton 360, but ESET is not working. When I press start a popup window appears but it remains blank. Is there something else I need to change before running the scan?
Nataki
August 2, 2014, 3:00 AM UTC
Hello again Gary

I had thought running the scan on Explorer would be simpler (no download) but it didn't work. I did however manage on Firefox. Here are the results :
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir Win32/Toolbar.Conduit.Y potentially unwanted application
C:\Users\Nathalie\Downloads\ccsetup414.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Nathalie\Downloads\codec_pack_898167_ff.exe Win32/Adware.1ClickDownload.AM application
C:\Users\Nathalie\Downloads\FlashPlayer_V.95355505b.exe Win32/DomaIQ.C potentially unwanted application
C:\Windows\Installer\MSI5CA9.tmp a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application
C:\Windows\Installer\MSI6E14.tmp a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application
C:\Windows\Installer\MSIBF8C.tmp a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application

The computer is already working better, but I'm still getting High Disk Usage messages.
Gary R
August 2, 2014, 4:53 AM UTC
  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy/Paste the contents of the code box below into Notepad.

C:\Users\Nathalie\Downloads\ccsetup414.exe 

C:\Users\Nathalie\Downloads\codec_pack_898167_ff.exe

C:\Users\Nathalie\Downloads\FlashPlayer_V.95355505b.exe

C:\Windows\Installer\MSI5CA9.tmp

C:\Windows\Installer\MSI6E14.tmp

C:\Windows\Installer\MSIBF8C.tmp

    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt


NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log


Are you still getting the disk usage messages ?

Only if you are, follow the instructions below.

Next ....

Did you empty your temp files out like I asked you to earlier ? .... viewtopic.php?p=635944#p635944

  • If not, please do so now, and ignore the instructions below.

  • If you did, then we need to see if we can free up some more disk space, so please do the following ....
    • First create a new System Restore Point
      • Click Start, and in the Search programs and files box type Create
      • Click on Create a restore point from the list of items found
      • In the open System Properties window click Create
      • Enter a name for the Restore Point you are creating and click Create
      • Wait while Windows creates a Restore Point, and when it is finished close the System Properties window.
    • Next delete all but your latest System Restore Point
      • Click Start and type clean in the Search programs and files box.
      • Click on Disk Cleanup from the list of items found
      • This will bring up the Disk Cleanup window.
      • Once it's finished scanning your computer, check the following entries.
        • Clean up system files
        • Windows will scan your computer once more.
        • When it is finished please select all the options in the "Files to delete" box.
        • Now click on the More Options tab.
          • Click the Clean Up button in the System Restore and Shadow Copies option.
      • Click OK.
      • When a prompt pops up click Delete files.


Now reboot your computer, and let me know if you're still getting the disk usage messages.
Nataki
August 2, 2014, 3:23 PM UTC
Hello Gary

Here is the new log :
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-07-2014
Ran by [removed] at 2014-08-02 11:22:46 Run:9
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Nathalie\Downloads\ccsetup414.exe
C:\Users\Nathalie\Downloads\codec_pack_898167_ff.exe
C:\Users\Nathalie\Downloads\FlashPlayer_V.95355505b.exe
C:\Windows\Installer\MSI5CA9.tmp
C:\Windows\Installer\MSI6E14.tmp
C:\Windows\Installer\MSIBF8C.tmp
*****************

C:\Users\Nathalie\Downloads\ccsetup414.exe => Moved successfully.
C:\Users\Nathalie\Downloads\codec_pack_898167_ff.exe => Moved successfully.
C:\Users\Nathalie\Downloads\FlashPlayer_V.95355505b.exe => Moved successfully.
C:\Windows\Installer\MSI5CA9.tmp => Moved successfully.
C:\Windows\Installer\MSI6E14.tmp => Moved successfully.
C:\Windows\Installer\MSIBF8C.tmp => Moved successfully.

==== End of Fixlog ====
Nataki
August 2, 2014, 3:30 PM UTC
So far no disk usage messages and I haven't seen this computer respond this fast in a very long time! (I had releted the temp files at the beginning.)
Gary R
August 2, 2014, 4:05 PM UTC
Well your logs look good, and as far as I can see your computer looks free from infection now.

If you're still having any problems, please let me know about them.

If you're not experiencing any problems, then it's time to remove the programs that we've been using to clean your machine.

First ....

  • Double click AdwCleaner.exe to run it.
  • Click Uninstall.
  • Click Yes to the prompt.
  • AdwCleaner will close and uninstall itself


Note: If AdwCleaner prompts you an update is available, click Cancel and continue to uninstall.

Next ....

Plese delete the following files and folders (in bold) ...

C:\Users\Nathalie\Desktop\Frst64.exe
C:\Users\Nathalie\Desktop\fixlog.txt
C:\Users\Nathalie\Desktop\search.txt
C:\FRST


Next ....

Please go to Control Panel > Programs > Uninstall a program and Uninstall the following:

Tweaking.com Registry Backup


Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.
Nataki
August 2, 2014, 4:41 PM UTC
Thank you very much for all your help.
Gary R
August 2, 2014, 4:57 PM UTC
You are very welcome. :)

Keep safe.

Gary

As your problems appear to have been resolved,