Hello everyone,
My computer has been running very slow lately, to the point I can’t even get into email I did the recommended scans and am posting the logs. I’ll delete all my cookies and temp internet files while I’m waiting on a response as well. I also keep getting a norton pop up as well and that was uninstalled long ago. Do you see anything??
Thanks,
Beau
Hi,
Re-run OTL.exe.
[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.
:commands
[CREATERESTOREPOINT]
:OTL
IE - HKU\S-1-5-21-1275210071-1078081533-725345543-500\..\SearchScopes\{007B4EA4-4F8E-42D3-8951-7F69122F9C4A}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=BCPA&o=16145&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=^QK&apn_dtid=^YYYYYY^YY^US&apn_uid=FC8CD5FA-809C-454C-8AD9-94447173F69D&apn_sauid=1109CE52-173F-4607-A12C-0BC206FB7714
IE - HKU\S-1-5-21-1275210071-1078081533-725345543-500\..\SearchScopes\{12EDF768-0263-441C-A010-32E0449C2F11}: "URL" = http://search.conduit.com/Results.aspx?ctid=CT3300024&SearchSource=45&UM=2&q={searchTerms}
O2 - BHO: (DownloadTerms) - {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} - C:\Documents and Settings\Administrator\Local Settings\Application Data\DownloadTerms\temp.dat ()
:files
C:\Documents and Settings\Administrator\Local Settings\Application Data\DownloadTerms\temp.dat
dir /s /a "C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1" /c
ipconfig /flushdns /c
:commands
[purity]
[emptytemp]
[resethosts]
[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.
========= NEXT =========
Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.
Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.
How to disable avast:
[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
[*]Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.
Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.
If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.
When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
Attach log reports ( ComboFix.txt) back to topic.
Okay well I copy and pasted that code and clicked run fix and it has said, “killing processes, DO NOT INTERUPT” for a COUPLE HOURS now! Is that normal?
5 hours later, it still says… “Killing Processes… DO NOT INTERUPT…” Should I interupt now? lol
10 hours…
Well since no one is responding, I’m doing a hard boot and trying again!
You did not have to wait ~ 10 hours, obviously OTL has stopped working ( bag ).
Re-boot your mashine and try OTLScript again. Be waiting for 15 minute.
If you fail again to run OTLScript, then skip OTLFix and move along with running Combofix
I figured, but no biggie, better safe than sorry. Anyway, I did a hard boot and manually shut down avast and malware bytes and redid OTL and it worked this time. Log posted. Unfortunately though after the OTL finished Windows tells my it’s not Genuine… I know that it is. It’s the same OS I bought. Then I did the combofix. I’m still not really sure if it’s fixed, I did a little surfing and it seems to still take a while for pages to load. Do you see anything else in the logs?
Open notepad and copy/paste the text present inside the code box below:
DirLook::
c:\documents and settings\Administrator\IECompatCache
c:\program files\Uninstaller
c:\program files\Tuguu SL
c:\documents and settings\All Users\Application Data\WEBREG
ClearJavaCache::
KillAll::
Folder::
c:\documents and settings\All Users\Application Data\AVG SafeGuard toolbar
c:\program files\AVG SafeGuard toolbar
Save this as CFScript.txt
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:[b]ComboFix.txt[/b] )
Tell me, is your computer running little faster? Did WGA passed validation now?
I’m not really sure yet if it’s faster or not and the WGA thingy is still there. Here’s the log.
I don’t see malware activities here.
It is necessary to uninstall ComboFix :
[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
[*] In the line of text type in (Copy) the following:
ComboFix /Uninstall
Note that there is a space between " ComboFix " and " /Uninstall " .
[*] then click OK (or press Enter ).
Wait for the uninstall process is complete.
Re-run OTL and click on CleanUp! button.
You will be asked to reboot the machine to finish the cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTL. Feel free to manually delete any tools it leaves behind.
btw, about WGA ;
Remove WGA with this tool:
http://www.softpedia.com/get/Tweak/Uninstallers/RemoveWGA.shtml
When you remove WGA, you can use your licens key that you got from Microsoft to validate your system.