PC very slow.... Solved/Closed

Question

Hello, 

              I don't know what happened to my laptop, last time the problem was it cannot connect to the internet, then it was fixed by my roommate who happens to be an IT. unfortunately after that, my PC becomes very slow... i can't even attached a single attachment on the email that im working with. I tried cleaning my pc thru comodo cleaner, i tried open disk clean-up also scanning for viruses and even defragmenting my hard drive. What can I do then??? I can't even load my family feud game in Facebook because of that??? It will just show a blank page unlike before that i used to play it. Also it takes 1-2 minutes just to load a new tab or browser that i am opening... PLS HELP!!!

PLSSSSSSSSSSSSSSSSSSS!!!

Ambucias · Accepted Answer

Hello Baby,

Well, I am afraid that your system is infected and in my opinion there is an malicious process running that should not be running at boot time

Please follow the following procedure carefully and to the letter.  

You must kill the evil processes which the virus is presently running and preventing you from running Hyjackthis. If you don't, it will keep reproducing the files for ever. 

To kill the processes: 

1. Download to your desktop and run Rogue Kill: 

https://download.bleepingcomputer.com/grinler/rkill.com 

2. You should now see a window that shows all of your desktop icons, including the rkill.com program. 

3. Double-click on the rkill.com in order to automatically attempt to stop any processes associated with the virus. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. 

If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by the s when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate the processes . So, please try running Rkill until malware is no longer running. 

As a matter of a fact, if you get messages, it is a sign that the virus is agonizing with excrutiating pain, so you can just grin while it is suffering!:)))

Please, DO NOT REBOOT your computer or the processes will come back to haunt you! 

Download to your desktop Malwarebyte. 

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/ 

Once on your desktop, we must still outwit the virus. 

Right click on the MBAM icon and click on rename. Rename it kioskea.exe. 

Install Malwarebyte and launch it. From the second tab, update it. 

Pretty please, request a FULL system scan which should take more than hour. Once the scan is finish, delete all of item that were found. 

Let me know the result because after this problem is solve, I have another tip to make your system run faster.

Regards

Ambucias · Answer

Hello

To fix the problem, I must have a Hyjacthis log.  You may have nasty processes running.

http://free.antivirus.com/hijackthis/

Please download, install and request a scan and save a log.  Copy the log and post it here.

Regards

baby jane · Answer

Hi,

        I was trying run the hijack this but it says my system is denying this to run, i tried to do the recommended action run it as administrator but i cant find a way to run it like that because whenever im trying to right-click theres no option to run it as administrator...

baby jane · Answer

can u send me another link for rogue kill??? because currently i'm in UAE and the website u gave me is currently blocked in this country...

Ambucias · Answer

Dear Jane,

Why on earth would they block a direct link like this one?  There is nothing there that would compromise UAE's stability and it does not contain porc!  The link I have given you get you directly to the download panel.  RKill is exclusive to Bleeping Computer so I have no other links to it.

See if you can at least run Malwarebyte.

baby jane · Answer

it said that it is infected by 3 objects one is riskware tool, malware trace and trojan fake.... the it gave this log after i deleted it:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4941

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

10/25/2010 5:35:58 PM
mbam-log-2010-10-25 (17-35-58).txt

Scan type: Full scan (C:\|D:\|I:\|)
Objects scanned: 271661
Time elapsed: 1 hour(s), 38 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
I:\program installer\Microsoft office 2007\Keygen\msoe2007kg.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

baby jane · Answer

Hi,
      I've just sent u the copy of the log and found out that there is 3 infections 1) malware trace 2) trojan fake 3) i forgot ... but then after i deleted the said infections it says that i need to restart the computer i dont know why it isnt send to u now i dont know where to find the said log again so i can show it to u....

Ambucias · Answer

Hello Jane,

Okay I got the log

The culprit is here:

I:\program installer\Microsoft office 2007\Keygen\msoe2007kg.exe (RiskWare.Tool.CK) -> 

A key generator

How is your system now?

Gervarod · Answer

Hello, Ambucias hope you don't mind me butting in and giving the person a little tip on the Key Generators thanks.


Hell Baby Jane, as for Key Generators do not download them as they may contain Malware, Worms and viruses in them. People out there say they are safe to use but when you think about it that a key gen is made by a person and wants people out there to download it so he can get control over your computer and still information like passwords accounts and any Credit card numbers you use to buy stuff over the net, so the best way to keep safe too is not to down load the Key Gens just to get the full version of the program. But what Anti-Virus are you using if so it should pick up the key gen as an trojan a worm or an virus then.

So the key Gen you got on it  that malwarebytes found on it that Microsoft office 2007 RiskWare was an Scareware to get you to pay for a product that tells you that you need better protection to remove this virus or trojan but that's what i mean they steal your credit card information on you.

Hope that i told you a little on about the Key Gens that you should never download them at all.


Cheers, Gervarod

Ambucias · Answer

Baby,

Your system is still infected

Please run another Hyjackthis scan but do not request a log because we do not need it.

Once the scan is over, you must check the items listed.  Once all checked, click on fix checked and close Hyjackthis.

You must then run another FULL Malwarebyte scan.  Here are the items you must check:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

O2 - BHO: (no name) - {5b0a01d2-b8a0-4e56-9e6b-cba0ef4b4eb5} - (no file)

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe (file missing)

O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe

Please, never go back to "My Web Search" again who you will be returning to the Virus/Security forum for help.

I would also install a better antivirus programme then the one you have.  You will find them in Kioskea's download section.

Let me know

baby jane · Answer

can someone pls tell me what is the meaning of this??? Whenever I am opening a certain application this error message is continuously popping...
Message was from Adobe Flash Player 10 message was:

Error: Error #2134: Cannot create SharedObject.
	at flash.net::SharedObject$/getLocal()
	at XdComm/get cache()
	at XdComm/get contextCache()
	at XdComm/getCache()
	at Function/http://adobe.com/AS3/2006/builtin::apply(
	at flash.external::ExternalInterface$/_callIn()
	at Function/<anonymous>()

Ambucias · Answer

Greetings to all,

There much too many people intervening on this thread and more than one problem being discussed at the same time.

I did my part with the virus.  

It's all yours Gervarod.

Regards

Ambucias · Answer

I'm back!

Please run another Hyjackthis log no scan and check the following items.  After you have checked them, click on fix checked.  

Close Hyjackthis, reboot your machine and tell me if it is faster.

Here are the items:

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

O2 - BHO: SimpleAdblock Class - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Common Files\Simple Adblock\SimpleAdblock.dll

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O4 - Global Startup: Bluetooth.lnk = ?

O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)

P.S. You know that application you add smileys with?  Well they are often infected.  Also, as I suggested before, stay away from "My Web Search"

Ambucias · Answer

Rarely is Malwarebyte not capable of deleting a My Websearch virus.

I think that I found the source, it is in the processes,

Please run another scan with Hyjackthis and check the following:

C:\Program Files\SweetIM\Messenger\SweetIM.exe 

C:\Program Files\uTorrent\uTorrent.exe 

C:\Windows\system32\wuauclt.exe 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O1 - Hosts: ::1 localhost 

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL 

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll 

O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe

O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing) 

Once you have finished, we should have killed the vicious process which should permit Malwarebyte to send the rest of the virus to the glue factory.  So run another full Malwarebyte scan.

If you do not see an improvement, I will eat my brand new shirt and I will send you a very potent medicinal compound.

PC very slow....

14 responses

Subscribe To Our Newsletter!