|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
09-22-2006, 05:09 AM
|
#1 (permalink) | |
|
Registered User
Join Date: Aug 2006
Posts: 45
OS: Win XP
|
HJT Log help requested
For the last couple of months I have noticed my system becoming slower and slower with no apparent cause. Startup and rightclick operations in particular.
F-Secure virus scan came up negative. The TrendMicro search found JAVA_BYTEVER.R and delt with it. F-Secure did alert me to a vunerability when Trend was scanning however, but I put that down to the Trend search. Was I wrong to do so? Ad-Aware and Spybot found nothing of consequence, only cookies. My log: Quote:
|
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
09-22-2006, 07:42 AM
|
#2 (permalink) |
|
TSF Enthusiast
Join Date: Apr 2005
Location: Ohio
Posts: 1,156
OS: XP
|
Hi and welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p In the meantime, make sure you subscribe to this thread so that you will receive an instant email when I have replied with a fix to your problem. You may do this by clicking the Thread Tools option at the top of your post and then clicking Subscribe to this thread. Then, make sure Instant Notification by email is selected and click Add Subscription Please be patient with me during this time. |
|
|
|
|
09-22-2006, 09:43 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2006
Posts: 45
OS: Win XP
|
Thanks very much. A quick update:
I ran ewido. It found and then quarantined a piece of malware called Backdoor.Genlot.DX, which by the sounds of it was rather nasty. My system is still slow though so I’ll see if any of the other recommended scanners can find anything else. Last edited by anno; 09-22-2006 at 09:44 AM. Reason: clarity |
|
|
|
|
09-22-2006, 10:07 PM
|
#4 (permalink) |
|
TSF Enthusiast
Join Date: Apr 2005
Location: Ohio
Posts: 1,156
OS: XP
|
Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.
==================================================================================================== Downloads Cleanup! Cleanup! and install it. You will use this later. ==================================================================================================== HiJackThis! Fixes Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any) O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/22640b6b...p/RdxIE601.cab Please remember to close all other windows, including browsers then click Fix checked. ==================================================================================================== Tools CleanUp! Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows: Click Options Move the slider button down to Custom CleanUp! Check the following:
Click OK, Press the CleanUp! button to start the program and reboot when prompted. ==================================================================================================== Rebooting in Normal Mode Reboot your system in Normal Mode. ==================================================================================================== Online Virus/Spyware Scan Panda Activescan Perform an online scan with Internet Explorer with Panda ActiveScan ** click on "Free use ActiveScan" located on the top right hand corner
*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. *Turn off the real time scanner of any existing antivirus program while performing the online scan ==================================================================================================== Tools HiJackThis! Please run a new HiJackThis! Scan and post the results with your next reply ==================================================================================================== Summary: Please make sure you have completed all of the steps above and include the following in your next post New HiJackThis! Log Panda ActiveScan Log |
|
|
|
|
09-23-2006, 06:20 AM
|
#5 (permalink) | ||
|
Registered User
Join Date: Aug 2006
Posts: 45
OS: Win XP
|
Thanks for your help! The actions that I have taken so far don't seem to have made that much impact, as it took ~15 seconds to open a 3KB text file...
My ActiveScan log: Quote:
Quote:
|
||
|
|
|
|
09-23-2006, 10:45 AM
|
#6 (permalink) |
|
TSF Enthusiast
Join Date: Apr 2005
Location: Ohio
Posts: 1,156
OS: XP
|
Hm…your log appears to be clean but your system is still running slow huh? Let’s try a few other things here to see if we can find out what the source of your problems might be
Downloads GetSystemInfo Download & run GetSystemInfo.exe It shall produce a log for you to post back here Gmer Download gmer from http://www.gmer.net & extract the contents to desktop Disconnect from internet and close running programs. There is a small chance this application may crash your computer so save any work you have open. Double click gmer.exe. Let the gmer.sys driver load if asked. If it gives you a warning at program start about rootkit activity and asks if you want to run scan...say NO. To the right of the program you will see a bunch of boxes that have been checked... leave everything checked and uncheck the Registry box. Then click the Scan button. Wait for the scan to finish. Once done click the Copy button. Open Notepad and hit ctrl+v to paste the log. Save the log to your desktop please. * * * * * Click Gmer's Autostar tab then the scan button. Once its done click the Copy button and paste it into a new notepad document. Save that document to your desktop please. RootKitRevealer Please download RootKitRevealer.zip Unzip it to the desktop, run it, and click Scan. This will generate a log file. Please post the entire contents of the log file in your next reply ==================================================================================================== Event Viewer Log Let's have a look at Windows Event Viewer. It might give us a clue as to what is causing these issues Go to Start > Run - type in eventvwr <Press Enter>  This is a picture of what the event viewer looks like. You will see Application, Security & System listed in the left pane. 1. In the left pane click on Application. 2. Click the gray title “Type” at the top of the source name column in the right pane to sort by type name Look for “Error” & double-click on the most recent 10, and evaluate the event description for any indication of the cause of the problem. 3. Make note of the Description, EventID and Source of these Event Properties. 4. From the right pane, doubleclick on the line where it says error & you should get a window like the example below  5. In the upper right corner of this picture, you should see 2 arrows. One is pointing up & the other, pointing down. There is another button below the 2 arrows. Click once on it. (this will copy some information to clipboard) 6. Open notepad & paste the info in there. This will copy the event information to the clipboard. Paste the information for each event here Repeat steps 1-6 for System ==================================================================================================== Summary: Please make sure you have completed all of the steps above and include the following in your next post GetSystemInfo Log Gmer Log RootkitRevealer Log Event Viewer Log |
|
|
|
|
09-23-2006, 01:52 PM
|
#7 (permalink) | |||||
|
Registered User
Join Date: Aug 2006
Posts: 45
OS: Win XP
|
Thanks for this Eclipse, you must be very patient!
My GetSystemInfo log is 1.33MB, shall I post all of it? Gmer log: Quote:
Quote:
Quote:
Quote:
Quote:
|
|||||
|
|
|
|
09-25-2006, 05:12 PM
|
#11 (permalink) |
|
TSF Enthusiast
Join Date: Apr 2005
Location: Ohio
Posts: 1,156
OS: XP
|
Sorry about that anno. All of your logs seem to be clean. The only thing that I can tell by looking at some of those new logs that you gave me (sysinfo etc.) is that you have very little hard drive space left. Go through your computer and delete anything that you don't need and try to get it so you have at least 6 GB free. This will help speed things up. After you do that, you can do a disk defrag by following the steps below:
Disk Defragmentation Click Start and then open My Computer From here, right click on your main drive (C:) and click Properties Now Click on the Tools Tab and then click Defragment Now Finally, make sure the C: drive is highlighted and click Defragment Basically what this does is, when you are running low on hard drive space, your computer "fragments" files into several open spaces on your hard drive to make them fit. The problem in this is when you try to access those files, your computer has to go find all the "pieces" of the files and put them together which will drastically slow down your system. This will "rearrange" those files so they aren't fragmented anymore. After you have completed both of these steps, please post back with how your system is behaving now. Any better? Same? Thanks anno and again sorry for the delay in response |
|
|
|
|
09-27-2006, 05:17 PM
|
#12 (permalink) |
|
Registered User
Join Date: Aug 2006
Posts: 45
OS: Win XP
|
There is no need to apologise, you’re doing this for free!
The defrag didn’t make a huge amount of difference to start-up, but slightly improved the general response time while running Windows, enough to allow me to use the system without feeling the need to chuck it out of the window in any case… Thanks for all your help Eclipse, please feel free to move this to your resolved section. |
|
|
|
|
09-27-2006, 06:30 PM
|
#13 (permalink) |
|
TSF Enthusiast
Join Date: Apr 2005
Location: Ohio
Posts: 1,156
OS: XP
|
No problem anno. Glad I could help.
Now please follow the next steps to prevent further infections: Rehide System and hidden files
Setting a clean restore point To turn off System Restoreclick Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK. To turn System Restore back on Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK. Microsoft Updates It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. Spyware Prevention This is a good time to set up protection against further attacks. Read How Did I Get Infected In The First Place?. You need an antivirus that is continually updated, a good firewall, a spyware blocker such as Spyware Blaster, and a real time spyware program such as Spyware Guard, to prevent spyware intrusions. IE-Spyad is another excellent program that places over 4000 websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. All of the above have good free versions available. However, be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. More information and downloads are available at the following links: Spyware Blaster Spyware Guard IE-Spyad Let me know if you have any other problems. If not you should be good to go. |
|
|
|
| Thread Tools | |
|
|
