PC runs very slow, avast detected and deleted some PUP, with no result

Hello everyone!

I have a problem with my computer - it runs very slow, sometimes it takes few minutes before starting i.e. browser or a folder. I make a format of my hard drive, but it didn’t help. I think this could be some kind of virus. Could you help me?

I’ve made a full scan with Avast (no results of infections), then another scan at booting, which came up with some infections I deleted - they’re in the screen I attach.

I also made scan with MBAM with no results and scan with OTL. Logs from both programs are in attachments.

Please, help!
Mattata

I attach an aswMBR log.

hey and welcome to the avast forum.

thank for attaching the needed logs,
a malware expert will help you from here when on is online later today.

Hey, mikaelrask!

Thank you for your reply, I will wait for the expert then.

Mattata

Hi did you intentionally install screaming bee ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
F3 - HKU\S-1-5-21-839522115-790525478-1606980848-1003 WinNT: Load - (C:\YDPDict\watch.exe) - C:\YDPDICT\WATCH.EXE ()

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Hi, essexboy! Thank you for reply!

Yes, I installed screaming bee and the program “Morphvox” (which changes voice at Skype) out of curiosity - I played with it twice. But I installed it some time after my PC dramatically slowed down.
Can/should I delete it? Because I don’t need it anymore and it’s not necessary, so I could just get rid of it.

I attach two logs:

  • “11152013_152013.txt” which was shown after executing your script and reboot (maybe it’ll be useful),
  • “OTL.txt” which is the log from the Quick Scan that you asked to do.

Mattata

You are tight on memory… http://www.howtogeek.com/howto/windows/quickly-remove-items-from-windows-xp-startup/

Could you go start > run
Type in MSconfig
In the startup tab remove the ticks from all programmes except Avast
OK out
Reboot

Has that improved the loading times ?

I just did what you asked - PC seems to start up faster, and maybe works a little faster, but still it took me 3-4 minutes to open browser and this topic to reply. I can’t really tell if there is an improvement in speed or is it just my placebo effect, but even if it goes faster it does it only a little bit.
What is more, the shortcut buttons on my mouse stopped working and there is a window of msconfig showing up every time I turn on PC. Is it OK?

Mattata

Place a tick in the MSConfig box that says do not show this again :slight_smile:

OK next task thin will be to run a defragment on the hard drive… But, with only 500Mb of RAm you will always have a slow computer

Do you know how to defragment XP ?

Yes, I do defragmentation from time to time (every 2-3 weeks). Last time I did defragmentation few days ago, but I could do it again, so I will today.

The funny thing is that I have been normally using my computer a couple of years, always with the same configuration - Windows XP with simple programs like Opera browser, Office, Adobe Reader, Skype, avast etc. And for this couple of years my PC was working like a flash, everything has been loading with normal speed and I never have problems.
How is that possible that suddenly now it stopped working the normal way it was? Could it be a hardware issue? I don’t know, maybe my RAM is damaged (can it be damaged?)?

Mattata,

Launch the Task Manager (Control+Alt+Del keys) and check if a process take too much CPU usage (almost 100% by example). If it’s one of SVCHOST.exe processes, download Process Explorer here http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx. With Process Explorer, you can view the services launched by SVCHOST just by moving the mouse over it. If you have an excessive CPU usage for a SVCHOST process, then I think you can suspect one of services launched by SVCHOST NETSVCS. In particular, WUAUSERV (corrupted Windows Update service?) or NETMAN (corrupted key value in Windows Register?). If you have encountered this CPU usage problem, it’s easy to check if it’s a fault of a service launched by Windows at booting.

Run the command CMD or open the console and type these commands:
NET STOP wuauserv (to stop the Windows Update Service, to see if CPU came back to normal usage)

If the problem of slow PC still exist, then type the following command:
NET STOP netman (to stop Network Connections Service, to see if CPU came back to normal usage)

Don’t panic, the services will be restarted after reboot or you can use the commands NET START wuauserv or NET START netman.
If stopping one of the two services have solved the problem (until reboot) then there is a solution for your computer.

If it’s not a problem of excessive CPU usage (or Virus/RootKit problem), then you can:

  • Check the file-system with the CHKDSK /F command.
  • Try to boot in SAFE-MODE (F8 key). Is it OK? Then you don’t have really hardware problem (just a software problem?).
  • Check the SMART (Self-Monitoring, Analysis and Reporting Technology) values of your disk. Is it safe?
  • Check the RAM with MEMTEST86? Corrupted ram give BSOD, but you don’t have this problem?
  • Boot with a LiveCD (Linux or WinPE). If system is stable during hours, then your hardware is OK! But 256 or 512 MB is the real minimum to start a LiveCD.

Mattata,

I don’t really think your PC have hardware problem. If it’s the classic “100% CPU usage” problem, then you can try the given advice… And I think you’ll receive good helping support by essexboy. But, I have to shut my mouth now… Because moderator warn me that I don’t be qualified to give malware removal advice, here! My first message posted before mikaelrask was deleted. (EDIT: Warning from moderator removed)

Hello, bernado!

I checked some of things you told me to:

  • I don’t have a problem with CPU usage, I opened system task manager while my PC was slowly working (for example while I was waiting for Opera to start up) and there were not any program that used too much of processor. Only a few percent of CPU were used, so this is probably not the CPU usage problem. The hard drive was working a lot (I could hear it), but the processor wasn’t.
  • I didn’t have BSOD even once since I formatted my disk a few months ago. Should I still check it with MEMTEST86?
  • I did CHKDSK like you said, there was “0 KB in damaged sectors” (log in attachments)
  • I did SMART analyse, although there are some “red” parameters, the SMART status says “GOOD” (log in attachments)
  • I’ll check the liveCD and SAFE-MODE today and tell you what are the results of this test.

Do you have any other ideas what should 'cause the slow working PC? I’ll aprecciate any help!

Mattata

The problem with XP is that over time, as updates are installed along with new programmes the system gets tired (not very technical I know) When I was running XP I used to do a full reinstall every year or so to de-clog it.

As the hard drive is working hard could you check what size swap file you have

- Right Click on My Computer and click on *Properties*
  • Click on the Advanced tab

  • Uner the Performance section, click on Settings

  • Click on the Advanced tab

  • Under the Virtual Memory section, click on Change

  • Select the C: drive (partition)

  • From this point, you can adjust the minimum and maximum size (MBs) to 3069

  • Click OK/Apply until you get out of all those screens

  • You will be prompted to restart your computer. Before you click “OK” at that prompt, make sure you finish any work that you are doing or save anything you are doing so as to not lose anything.

Also bear in mind that most programmes now are designed to work on Vista or better with at least 2Gb of RAM. So over time programmes will increase in size and requirements. So 500Mb of RAM three years ago was good, you are now seeing programmes which require that much just by themselves, without factoring in windows requirements

I can confirm that. Even 2 GB are not much nowerdays. My last laptop had 2 GB RAMand Vista 32 bit, and even the half of Ram
was used by the system itself.

My Chrome is using about 135 Megabytes with 2 open tabs at the moment. Same with Firefox.

I can see your point! You’re right, the programmes are still being updated and upgraded, so they use more and more memory, so it is very possible that my computer is slowing down with time as it can’t “deal” with all those processes.

It leads me to a question: can buying extra memory solve my computer’s problem with speed? I have DDR1 RAM in my PC, and they’re cheap as I looked in shops, so I could easily buy for example 2 GB (4x512 MB). Will it be enough to have normally working PC?

Thank you all for your help,
Mattata

That would be enough. But buy an DDR3 RAM if thats possible for your PC.

I’m afraid it’s not possible, I have a quite old computer and my mainboard (Intel D915PGN) won’t work with DDR3. This is what is written in the instruction in summary:

Memory: • Four DDR SDRAM Dual Inline Memory Module (DIMM) sockets • Support for DDR 400 MHz and DDR 333 MHz DIMMs • Support for up to 4 GB of system memory

I hope I interpreted it in the right way, I mean, DDR means DDR and not DDR2 or DDR3, right?

If you run the Crucial system scanner here http://www.crucial.com/uk/systemscanner/ it will show you what type and how much RAM your system can take

Thank you, this is very useful scanner!

This is what it showed:

Memory Type: DDR PC2700, DDR PC3200, DDR (non-ECC) Maximum Memory: 4GB Currently Installed Memory: 512MB Total Memory Slots: 4 Available Memory Slots: 2

In this situation, will it be good and affect the performance if I buy 4x512 MB of DDR and install them in 4 slots? Of course after getting out the 2x256 I currently have?