computer slows down, as hidden (background) internet traffic continues

Viruses and worms
1

Hi,

I realised my computer slowing down, maybe after some hour or so. Even with only one program (e.g. internet) running, the CPU usage rises, up to 100%. When I checked the Windows Task Manger, I found several PROCESSES running in the background, namely Iexplore.exe, with higher (over 100k) memory usage. When closing them manually, they start to recover (but nothing to see on screen, just the message “Tab recovered”, and process appears again in the Task Manager).

After closing them all, and re-boot, and watching the Task Manager, I found that also here the iexplore.exe processes come up after some time by themselves.

I made a total scan (8 h) with my antivir software, but after that (and cleaning some viruses), it’s still the same situation.

Computer is rather old, but it’s in my Office, and very well adjusted to the work to be done, so I’d like to keep with it, and especially with that old IE 8:

Windows XP Professional, Version 5.1 (Build 2600.xpsp_sp3_qfe.130704-0421 : Service Pack 3)
IE 8

Could any one help me, please?
I downloaded the suggested files (MBAM etc.) already.

Thanks a lot. 8)
Lillebror

2

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

3

MBAM: “The application failed to initialize properly (0x000001.d) Click OK to terminate the application.” message appears.

the rest is attached.

4

OK, now you’ve to wait a bit…

5

Hi,

just a recent finding: When accessing e.g. a PDF document through a link, a new (empty) web page opens shortly, then the PDF is open. This is normal. But now, today (and I remember also in the last few days), this web page has some advertising for Windows 10 on it - which is not my home page, nor did I ever surfed there.

Maybe it helps?

Many thanks,
Lillebror. 8)

6

Let me know if this stops it :slight_smile:

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-1004336348-343818398-515967899-1003\...\Run: [omsfno] => C:\Documents and Settings\user\omsfno.exe [135168 2015-10-29] () FF user.js: detected! => C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3yswod84.default\user.js [2012-01-05] 2015-10-29 09:56 - 2015-10-29 09:56 - 00135168 _____ C:\Documents and Settings\user\omsfno.exe Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

7

Hi,

& thanks a lot!

Attached 3 files
(…and there’s also a Quarantine.txt?)

8

How is the computer now?

9

…appears to be faster now. There’s not that advertising page inbetween now, anymore. :slight_smile:

10

Hi,

will the changes also affect the other issue (hidden background programs)?
Currently, there are two iexplore.exe running with only one open website…

Many thanks,
Lillebror.

11

Hi,

After one hour working now, there were 4x iexplore.exe running, 2 of them remain if program is closed. (Maybe it has to be this way?)

It seems to be faster, though.

I have to leave now, could continue tomorrow.

Really thanks again for the help here - very much appreciated!!

Lillebror. 8)

12

Aye could you run a fresh FRST scan tomorrow so that I can ensure it has not returned

13

Hi,

here’s the FRST scan result…

…and my virus scanner made alert, see other txt.

14

That does not appear to be running but we will remove it anyway

How is the computer now ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: C:\Documents and Settings\user\tfokad.exe Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

15

…it’s attached.

16

Hi,

that fixlog.txt is in my last post…

…and I was running again that FRST, and this time, it went thru, with frst.txt and addition.txt. Below are both log files.

…and I found this page newly in the HISTORY section of my browser (but wasn’t there):
“Windows and Windows 10 - Microsoft” !!!

17

Are you using a USB as you are infected again

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

18

Hi again,

many thanks for the help.

The ComboFix log file is attached.

What caused the issues? Solved/cleared? Shall I ran anything for checking?

19

This appeared after the last clean which is why I asked about USB c:\documents and settings\user\kkbe1k.exe

20

Hi again,

(I was away for a week):

no, I don’t boot from USB, but do transfer data. Will check my USB sticks with MBAM (but from another computer, as it does not work here).

Computer seems to work very well now - no background things any more.

Thank you very much to all who helped me with it!!! Really good to know you’re here.
8)
Best wishes.