Laptop running really slow....please help
Hi all, I got the little lad a laptop for christmas, which has probably only been used a dozen times yet it is now painfully slow, takes an age to start up, to the point where using it is a wind up!
I've run Adaware, Spybot & AVG and there doesn't seem to be any bad content, so I'm a bit puzzled, any help would be appreciated
I've run Adaware, Spybot & AVG and there doesn't seem to be any bad content, so I'm a bit puzzled, any help would be appreciated
0
This discussion has been closed.
Comments
Please download Malwarebytes' Anti-Malware by clicking the link below:
http://www.besttechie.net/tools/mbam-setup.exe
Double Click mbam-setup.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* You'll be required to post the contents of this log later.
Please Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
==============================================
Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:
Go here ======> A guide and tutorial on using ComboFix <====== Go here
Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use SP2
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should get a prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
(1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
(2) Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review (copy and paste them, not attach), so that we may continue cleansing the system:
MBAM log
C:\ComboFix.txt
Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
Malwarebytes' Anti-Malware 1.38
Database version: 2356
Windows 6.0.6001 Service Pack 1
30/06/2009 19:38:41
mbam-log-2009-06-30 (19-38-41).txt
Scan type: Quick Scan
Objects scanned: 82908
Time elapsed: 10 minute(s), 27 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
ComboFix 09-06-29.07 - JPH 30/06/2009 19:52.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.444.68 [GMT 1:00]
Running from: c:\users\JPH\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-30 )))))))))))))))))))))))))))))))
.
2009-06-30 19:00 . 2009-06-30 19:00
d
w- c:\users\Jack\AppData\Local\temp
2009-06-30 18:25 . 2009-06-30 18:25
d
w- c:\users\JPH\AppData\Roaming\Malwarebytes
2009-06-30 18:24 . 2009-06-17 10:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-30 18:24 . 2009-06-30 18:24
d
w- c:\programdata\Malwarebytes
2009-06-30 18:24 . 2009-06-17 10:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-30 18:24 . 2009-06-30 18:25
d
w- c:\program files\Malwarebytes' Anti-Malware
2009-06-27 12:58 . 2009-06-27 12:58
d
w- c:\program files\CCleaner
2009-06-27 12:23 . 2004-08-04 06:00 506368 ----a-w- c:\windows\system32\msxml.dll
2009-06-26 19:37 . 2009-06-26 19:37
d
w- c:\windows\Sun
2009-06-26 19:28 . 2009-06-26 19:26 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-26 19:26 . 2009-06-26 19:26
d
w- c:\program files\Java
2009-06-25 17:55 . 2006-12-21 09:55 24363 ----a-w- c:\windows\system32\drivers\Camd913d.sys
2009-06-25 17:55 . 2006-12-21 09:52 29522 ----a-w- c:\windows\system32\drivers\Capt913d.sys
2009-06-25 17:49 . 2009-06-20 18:01 2052888 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-06-24 20:17 . 2009-06-24 20:17
d
w- c:\programdata\WindowsSearch
2009-06-24 20:09 . 2009-06-27 13:00
d
w- c:\programdata\Spybot - Search & Destroy
2009-06-24 20:09 . 2009-06-25 17:36
d
w- c:\program files\Spybot - Search & Destroy
2009-06-24 16:29 . 2009-06-24 16:28 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbB6FB.tmp.exe
2009-06-20 19:30 . 2009-06-28 19:34
d--h--w- C:\$AVG8.VAULT$
2009-06-20 18:02 . 2009-06-20 18:02 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-20 18:02 . 2009-06-20 18:02 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-06-20 18:01 . 2009-06-20 18:01 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-20 18:01 . 2009-06-20 18:01 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-20 18:01 . 2009-06-30 18:07
d
w- c:\windows\system32\drivers\Avg
2009-06-20 18:00 . 2009-06-20 18:00
d
w- c:\program files\AVG
2009-06-20 18:00 . 2009-06-20 18:00
d
w- c:\programdata\avg8
2009-06-20 17:45 . 2009-06-20 17:45
dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-20 17:45 . 2009-03-12 08:17 2902048 -c--a-w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-20 17:45 . 2009-06-20 17:47
d
w- c:\programdata\Lavasoft
2009-06-20 17:45 . 2009-06-20 17:45
d
w- c:\program files\Lavasoft
2009-06-20 16:55 . 2009-06-20 16:55 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbEFB7.tmp.exe
2009-06-19 09:37 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-19 09:37 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-19 09:37 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-19 09:20 . 2009-06-19 09:20 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb179D.tmp.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 17:55 . 2008-09-02 10:03
d--h--w- c:\program files\InstallShield Installation Information
2009-06-20 18:34 . 2009-05-17 19:43
d
w- c:\users\JPH\AppData\Roaming\Nokia Multimedia Player
2009-05-26 22:02 . 2009-05-26 21:56
d
w- c:\programdata\Google Updater
2009-05-26 22:01 . 2008-09-02 11:07
d
w- c:\program files\Google
2009-05-18 17:28 . 2009-05-18 17:27
d
w- c:\users\Jack\AppData\Roaming\PC Suite
2009-05-17 19:43 . 2009-05-17 19:40
d
w- c:\users\JPH\AppData\Roaming\Nokia
2009-05-17 19:43 . 2009-05-17 19:43 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2009-05-17 19:42 . 2009-05-17 19:40
d
w- c:\programdata\PC Suite
2009-05-17 19:41 . 2009-05-17 19:41 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 19:40 . 2009-05-17 19:37
d
w- c:\users\JPH\AppData\Roaming\PC Suite
2009-05-17 19:40 . 2009-05-17 19:40
d
w- c:\program files\DIFX
2009-05-17 19:39 . 2009-05-17 19:38
d
w- c:\program files\Common Files\PCSuite
2009-05-17 19:38 . 2009-05-17 19:38
d
w- c:\program files\Common Files\Nokia
2009-05-17 19:38 . 2009-05-17 19:35
d
w- c:\program files\Nokia
2009-05-17 19:37 . 2009-05-17 19:37
d
w- c:\program files\PC Connectivity Solution
2009-05-17 19:34 . 2009-05-17 19:34 9728 ----a-w- c:\programdata\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\CommonCustomActions\UninstPCS.exe
2009-05-17 19:34 . 2009-05-17 19:34 8192 ----a-w- c:\programdata\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\CommonCustomActions\UninstCCD.exe
2009-05-17 19:34 . 2009-05-17 19:34 15360 ----a-w- c:\programdata\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\CommonCustomActions\UninstPCSFEMsi.exe
2009-05-17 19:33 . 2009-05-17 19:33
d
w- c:\programdata\Installations
2009-05-14 21:09 . 2006-11-02 11:18
d
w- c:\program files\Windows Mail
2009-04-24 16:05 . 2009-06-19 09:36 827904 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-06-19 09:36 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-06-19 09:36 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-04-21 07:21 . 2009-04-21 07:21 70176 ----a-w- c:\users\Jack\AppData\Local\GDIPFONTCACHEV1.DAT
2008-04-21 14:39 . 2008-04-21 14:39 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Reminder_MUI"="c:\applications\oem\Reminder\Reminder_MUI.exe" [2008-04-16 1081344]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-02 68856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2008-07-03 812952]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2008-05-23 552960]
"SpareMessaging"="c:\program files\Spare Messaging\MessagingApp.exe" [2007-11-28 42824]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-08-06 20480]
"UpdateP2GShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-20 518488]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-20 1948440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-26 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-05-28 6144000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Launch.lnk - c:\windows\Installer\{4A65DAD2-E914-4923-9C2A-81B968A68CE2}\_A685CC3126A7CC37D335DE.exe [2008-9-2 17542]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6DC3B181-B81D-46B0-856C-3D1BC0D1D06E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B869A05B-6596-4AD5-92AA-CC1EA1F24F98}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5F564E86-AF66-4777-8680-FF07509852C5}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{35097156-7527-41BB-8DE0-BC4F5DF8FAEB}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{9BDBCB32-EC6C-48BE-831E-23C6B9BFE8F6}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R2 gupdate1c9de4d4501981e;Google Update Service (gupdate1c9de4d4501981e);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-26 133104]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-06-20 1003344]
R3 CEBFilter;CEBFilter;c:\program files\C&E\OSD\OsdService\cebuffer.sys [x]
R3 CEIO;CEIO;c:\program files\C&E\OSD\OsdService\ceio.sys [x]
R3 cKBFilter;cKBFilter;c:\program files\C&E\OSD\OsdService\kbfiltr.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-06-20 64160]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-06-20 327688]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-06-20 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-06-20 906520]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-06-20 298776]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-08-07 283136]
S3 SiS6350;SiS6350;c:\windows\system32\DRIVERS\SISGRKMD.sys [2008-05-23 458752]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSGB6.sys [2007-11-15 48128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder
2009-06-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 17:47]
2009-06-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-02 21:56]
2009-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-26 21:59]
2009-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-26 21:59]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=DSGI&bmod=DSGI
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-30 20:01
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
LOCKED REGISTRY KEYS
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-06-30 20:08
ComboFix-quarantined-files.txt 2009-06-30 19:08
Pre-Run: 37,461,737,472 bytes free
Post-Run: 37,378,097,152 bytes free
175 --- E O F --- 2009-06-30 18:25
Hi, sorry for the delay, been away for a few days, it's still running really slow to be honest, neither of the programs found anything either.... it's a bit confusing
Go to to Start > Run
Type in box
combofix /u
Note: the space between the X and the /u
Press Enter.
This command will:
Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.
======================================================
Now download CCleaner (freeware) from here.
Run the installer, and uncheck the option to install Yahoo toolbar (unless you want Yahoo toolbar).
Once installed, run CCleaner.
The following should be selected by default, if not, please select:
Then please click
Please uncheck
Then go back to
Restart your PC.
============================================================
Next register (it's free, don't worry) with PCPitStop and run the full tests here. When the tests are complete, a results page will pop up. Copy and paste the URL of the Results screen and post it here for me.