I'll tell you what I did if you can tell me why this thing is so slow!

[yy4me]

It's granny again with another "slow computer question. If anyone has a minute.

I keep everything up to date with Windows, AVG 8.5, SpywareBlaster and Spybot.

Two weeks ago, Spybot found some goodies that might(?) be causing me a problem. Don't know why but my machine has a bad case of the slows. I have unplugged my modem and waited for 30 seconds before attaching it again. No improvement. Them:

I have IE6
SP2
HP Pavilion 526X
Microsoft firewall.
Broadband
512 mb Ram (plenty available)

AVG found a couple of trojans(hp\bin\terminator.exe) which it removed.

Then I did a scan with Spybot and it found:

BurstMedia
CasaleMedia (Removed= green check)
HitsLink
Webtrends and

Virtumonde.prx.(2 trojans)said to be removed= green check

I understand Virtumonde is nasty and can hide in places where it can't be found. At least that is what is says on my research. Well, Spybot says it removed it or put it in the vault.

I have cleaned disk, defragged, deleted temp files & cookies, emptied trash, removed some stored junk and whatever else I can find and this thing is still slow.

I know nothing about this machine and had to pay to have the last trojans removed, I cannot do so now. I wish there was some way to block these stupid things from attaching themselves to my computer.

Anyone have a suggestion, in layman's terms, what I might check to see if something lurks?

I am always afraid to do anything other than basic removal since I don't know that to leave checked or unchecked in things like CCleaner.

Any help would be appreciated.

[Why Syzygy]

1. I would suggest

running Malwarebytes. When I started using it, it found lots of stuff Spybot had not.
After install, be sure to check for updates before you do a complete scan (could take up to two hours).

http://www.malwarebytes.org/

[yy4me]

4. Hi, If I install and run malwarebytes, should I disable AVG first?

I know many people use and like malwarebytes, I'd do the free version. Will I have too many
"anti-everything"?

For someone who uses a computer is such a limited way, I sure get into trouble. I have responded to canetoad too. Still trying to do the most simple thing to bail me out of the latest.

A little knowledge is a dangerous thing.....

Thanks

[Why Syzygy]

5. It would be a good idea

to download it, close your Internet connection, shut off AVG, then install. But, to run it, you can leave AVG on. Be sure you can allow two hours, although it does offer a 'pause' feature, unlike Spybot.

I read your other reply. I'll not butt in, but while you're waiting for Canetoad, you can click 'Start' > 'Programs' and see if CCleaner is in your program list. (If you right click on the program list, you can choose 'sort by name')

[yy4me]

6. Hi, I did sort by name, that was easy. No CCleaner on the list.

[canetoad]

8. Hehe

I think we have a collaborative 'fixit' going.

:)

[Why Syzygy]

9. Good enough

because your reply gave me incentive to clean out my start up list in CCleaner! Jolly good :D

[canetoad]

2. Hi yy4me

For virtumonde, try this free tool: http://www.softpedia.com/get/Antivirus/F-Vmonde.shtml

For the sloooow computer, I'd bet my socks there is stuff going on in the background of which you may not be aware. The first clue is the number of icons in the sysem tray. That is the little box in the right hand side of your task bar. Is it chock-full of icons?

Two simple ways to tell what is running in the background:

1. Fire up CCleaner. Click on Tools then Startup. You will see all the programs that boot with the computer. I only have one entry - antivirus. If you have stuff like jushed.exe, anything Adobe, anything Yahoo or MSN you can get rid of them.

2. Right click taskbar, open the task manager and look at the Processes. There may be a lot of dead wood in there too. IMO, with internet connected and no other programs running, you should have around 28 - 30 processes. More than that, it is time to investigate.

If you could report back on this stuff, we might find a clue.

Cheers
canetoad

[yy4me]

3. Hi canetoad, I did some checking around and have this info:

Went to Task manager=30 processes running.
Went to control panel:
Have adobe Acrobat 5.0
Adobe flash player
Adobe reader 8.1.0

I also have there:
CCleaner with remove option. I have no Icons anywhere that I can find in order to run this program. If I click on remove, up pops the uninstall box and in "next" box, I see that CC is in a file on the C drive. If I go to C drive to take a look, there are many icons showing with much that I don't even know about. I did note that there is a folder identified as being added by my computer guy when he last fixed this thing. In that folder there are a lot of CC Icons and if I click on CCleaner, up comes a bunch of icons including a note added by my computer guy when he fixed this thing. Contents are below. All the other icons are dated 2005, his note is 2008.

It reads:
v1.19.105
- Added automatic update checking.
- New redesigned Options section.
- Issues are now selected by default.
- Added Cancel button to Analyze feature.
- Tools section now opens much faster.
- Added setting to hide the backup issues prompt.
- Fixed IE Cache cleaning on Non-English systems.
- Fixed website links, so they work on all machines.
- Fixed some window resizing errors.
- Fixed bug in applications tree when switching languages.
- Fixed applications section order with winapp2.ini.
- Fixed bug in shutdown process.
- Fixed bug when invalid cookie is found.
- Fixed 'subscript out of range' error on issue fixing.
- Minor restyling to Tools.
- Adding cleaning for MS Snapshot Viewer.
- Updated eMule cleaning.
- Updated Media Player Classic cleaning.
- Updated MS Office 2003 cleaning.
- Fixed MS Office cleaning to stop settings being deleted.
- Minor tweaks and fixes.

v1.18.101
- Entries in winapp2.ini have priority over winapp.ini.
- Updated to support Windows 2003 Server SP1.
- Minor update to Uninstall Programs tool.
- Fixed Options -> Cookies runtime error.
- Fixed part of the Recent Documents cleaning.
- Fixed MS Photo Editor cleaning.
- Minor tweaks and fixes.

Of course, I don't know what all that is about, just his notes to himself.

As to the system tray,

I have Update icon(MS wants me to go to IE7 or 8, I want to stay where I am so I do custom updates)
Magnifier( Search now) don't use it and I it just showed up one day.
Volume
AVG
Quicktime. Why do I need that anyway, Does it do the same thing as Media Player?

If I remove CCleaner, won't it take all those folders with it, including his notes?

My first thought was to remove and reinstall it.

My best thought is to ask first.
Thanks

[canetoad]

7. OK. Now that is not a note from computer guy

it looks like a Change Log from CCleaner - software writers often add them when they update a version of a program to let you know what changes have been made since the last version.

In your C drive\Program Files is there a folder called CCleaner? If so, inside it there should be ccleaner.exe. That is the CCleaner program proper.

You can make it accessible by right clicking and selecting send to desktop (create shortcut), although it shouldn't be necessary as there should be an entry in Start Menu\programs.

The number of running processes is about right. The reason I asked about this is I often see (laptops especially) with over 60 running processes, most of them utterly uneccessary. Quicktime is a pain in the neck, but on its own, should not be slowing you down this much.

The more I think about it, given what you have said about the number of running applications and processes, I start to wonder if you have picked up some nasty malware. WhySzygy's advice was good about antimalwarebytes. It's a great program.

Since I'm flicking back and forth between windows, I've seen you reply to WhySzygy and not wishing to jump on anyone's bandwagon, will give a suggestion that I was thinking about.

I think you should get F-Vmonde, AntiMalwarebytes and sort out your CCleaner. Then shut your computer down and re-boot into safe mode. This means that only essentials needed to run the computer are loaded. To do this:
Hit the power button
As the computer starts to boot, keep tapping the F8 key. You will see a quite different boot process, with a long list of files and it takes a little longer than normal boot. Select Safe Mode and hit return.

When booted, don't worry if it looks different - probably no desktop wallpaper, fonts and icons may be really big. It's all OK.

Then in safe mode, run F-vmonde and AntiMalware bytes and any other clean up programs you have.
Let us know how you go.

[Why Syzygy]

10. I've been hysterical

since late last week when my pc came to almost a stand still. Someone else was using my wireless channel. You may have seen the post. It was creeping along at sometimes as low as 2-5 Mbps! I've got 36 Mbps right now, which is average. I had never seen it go below 12-18. Yesterday I ran Malwarebytes, and it found some OLD stuff from 'Ascentive'. I don't know why it suddenly started causing an issue. I assume the new catch was due to the new update file. So, of course that would be my first answer ;)

[canetoad]

11. Yeah, I did see that post

and it brings up another point for YY4me.

Is the computer itself slow or is your internet connection slow? The issues could, of course, be intertwined, but it would help to know if the problem is essentially hard/software related or internet connection related.

[Why Syzygy]

12. Yes. That's a good question.

It seemed to affect my entire system. Can't say for sure. Firefox, certainly.
Yesterday I DID install a stupid LOTTO program from CNET. I don't think they have the same standards as previous. It was a POS. No uninstall program. That's actually what prompted the malware scan. I also continue to find (rather Avira does) *****.GEN Trojans. I ALSO discovered that when I reinstalled Adobe Reader, after not being satisfied with the alternates, it installed Adobe Air! No telling what that was up to. :grr: It's a constant battle.

[canetoad]

13. Tell me about it

I feel like such a fucking control freak when it comes to my computer! I don't like anything running that does stuff without my being aware of it, anything that updates automatically and especially anything being installed that I did not expect and did not have an option to opt out of.

[yy4me]

14. Hi everyone, I'm back. The last 2 hours have been...........well....

Here's what I did:

Ran CCleaner, it gave me the option to analise so I did. Didn't look bad so I did the scan. Updated too. It removed stuff that showed up in "analise. I did what it suggested.

Next I downloaded Malwarebytes and F_V.
Saved both to desktop.
Turned computer off and opened in SafeMode.
Ran F-V: nothing found for Virtumonde.
Ran Malwarebytes. Took 52 minutes

It found 2 infections:
1) Backdoor.Bot (file)
2) Disabled.Security (Registry Data)

Both were quarantined and deleted

I hope I have done this right, posting is the first thing I have done since I finished all the scans. I now have more security stuff available on this thing. Made a special folder for the desktop Icons for CCleaner, M/B and F-V. Getting too crowded on desktop for things I won't use often.

Now as I use the computer, we'll see what I might have messed up or if things are faster. Did I forget anything? Thanks everyone for helping, it is always appreciated.

[canetoad]

15. You may have nailed it

with the backdoor.bot.

The disabled security thing is not necessarily anything to worry about if....you have purposely disabled the bloody MS security centre as I have.

Congrats!

[Why Syzygy]

16. Let us know.

The next time the program finds anything, write down the entire string ..
ex: C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msconfig.exe (Backdoor.Bot)

If you can find the MB log file, it will show the string.

For now, please test to see if msconfig still works. Start > Run > (type) msconfig > OK . if it opens, you can just click cancel.

The log file should be in the MB folder. If you need more specific, I'll hunt it up.

When you ran CCleaner, did you just clean the files or did you select "Registry" and scan it?
If you have not, go ahead and do that. Don't clear anything. Just take a look to see what's there.

ETA: Also, did you run the update for Malwarebytes before the scan?

[yy4me]

17. Here we go

C:\windows\system.32\finstall.sys Backdoor.bot I wrote that down, I don't think there was anything for the other Disabled.security. Don't remember. Funny thing just came back to me. Last week AVG told me that my antivirus was disabled butI never did that. Of course, I went in and fixed it.

msconfig works' as to logfiles
the following: mb-log-2009-03-05(16-34-37).txt; 03-05(18-14-12).txt; 03-06(11-19-35).txt and
05-04(15-50-24).txt

As to the CCleaner, When the option box popped up, I clicked on analise and proceeded from there. Guess I just cleaned the files. I did not see the words registry as an option. Before I go do it again, when you say scan the registry but don't do anything, you mean just take a look see? Isn't there an option at the end of the scan? What do you mean by don't do anything?

[Why Syzygy]

18. What I mean ..

is in the far left column, you see a broom for "Cleaner" (for files) and under that a stack of blocks labeled "Registry". Click that and then just click "scan for issues" on that window. You will probably want to fix those at some point. It cleans up old intstall/uninstall entries from the Registry. When you run the "Fix Selected Issues", you always want to click "Yes" when you get the pop-up asking if you want to back-up the Registry.

I'm not sure what those log files are? Is that from msconfig? It should open the "System Configuration Utility" task.

Due to a thread in the MB forum, it suggested a possible connection to msconfig.
So, you DID update Malwarebytes before you scanned, correct?

[yy4me]

19. OOps, I think I updated only CCleaner. As to log files, they

are from malwarebytes. msconfig opens to System Config utility. I'm off now to check out CCleaner again.

Will report back.

Just took a look, there is a long list of stuff in there, most labeled issue: reference, activeX issue, uninstaller reference issue(lots of these), Obsolete software key, missing MUI reference(whatever that is)unused file extensions, old start menu key, invalid default icon,

I have the window open to this list but have done nothing yet. What do you think, obvious to fix and leave everything checked? I wish you could copy and paste this stuff.

[Why Syzygy]

20. Yes.

It will ask you if you want to make a back-up, and click "yes", then "fix selected issues".

You should be okay with the scan you did. Is it running better now? Just be sure to update Malwarebytes before you run it again.

[yy4me]

21. Well, I just did the CCleaner, fix selected issues. Did it 3 times

because there was always something there if I went back to look. Yes to back-up each time.

When I opened Internet Explorer again, it was fast and opening DU very fast. I hope this is all I need because you have all worked hard to help me.

The past few days have been awful, I'd just sit and wait for the little green boxes to make their way across or the flag to stop waving. It is a scary process if you don't know what you are looking at, I am the most computer un-savvy Granny ever.

As to what I installed today, how often do I run them, just when I think there is a problem?

Geeze, its 6:30, where did our day go? Thanks a million to all.

[Why Syzygy]

22. Personally,

I usually run CCleaner for the files every time I shut down my browser, which might not be for days at a time. The Registry cleaner should certainly be done any time you install or uninstall anything. Other than that, I allow performance to dictate.

Glad you got some speed going, "Granny". (I've been a "Grandma'ma" for a little more than a week :D )
.. and wow. Even though I've shared that, typing it here made it "real" for the first time :crazy:

[yy4me]

23. Congratulations on being a new Gramma.. I hope Mom and the

baby are doing fine. Again, thanks for your help.

[RC]

24. The secret to spyware/virus removal is to use Safe Mode with Network.

If you are reasonable sure you have something, don't even bother scanning in normal mode. Too many bad things can disable or otherwise hide from anti-virus programs.
The reason for the network is in case you need to download something.

[Why Syzygy]

25. I've used that method

a couple of times. Usually I don't bother unless there is a known issue. Biased, I've never been as wild about Safe Mode as the more technical geeks are :P

In the Backdoor.Bot case, according to the MB forum, with a prior definition users were finding the error in safe mode but not normal boot. Clearing the bug disabled msconfig. It turned out to be a false positive, which is why I kept asking her if she updated.