[Solved]Virus infection.

MarkJohnson · 2015-04-30T17:52:14.000Z

I am working on a friends desktop and he says he got some virus notifications a while back. Had some reg cleaner pt on his computer that he removed, and removed his legit A/V program as well.

It is still laging badly and sometimes refuses to boot or takes forever to boot.

MBAM didn’t report anything.

Here are the logs.

Thanks for any help.
-=Mark=-

essexboy · 2015-04-30T18:36:32.000Z

Let me know if this makes a difference

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: AppInit_DLLs: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs => HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs File Not Found SearchScopes: HKLM-x32 -> DefaultScope value is missing. Toolbar: HKU\S-1-5-21-1594460089-1084525592-3987088789-1000 -> No Name - {0123B506-0AD9-43AA-B0CF-916C122AD4C5} - No File Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: ipconfig /flushdns CMD: netsh winsock reset catalog CMD: netsh int ip reset c:\resetlog.txt CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

MarkJohnson · 2015-04-30T19:03:38.000Z

Okay, it ran fine. seems a little better. reboot was alittle slow still, but maybe doing cleaning still?

It still beeps at desktop startup like something isn’t working right.

Here’s my Los you requested.

essexboy · 2015-04-30T19:17:31.000Z

It might be worth running chkdsk /r to clear any HDD errors

MarkJohnson · 2015-04-30T20:07:41.000Z

I tried running chkdsk on my hdd, but no success. I did find it seems to be hanging on internet drivers. It hangs for like a full minute before it finally gets online connection.

I updated drives from Gigabyte’s website for this motherboard, but it still has issues.

My other PC connects immediately without issue.

Any clues what to try next?
-=Mark=-

essexboy · 2015-04-30T20:24:27.000Z

Have you run SFC ? https://support.microsoft.com/en-gb/kb/929833/en-gb

MarkJohnson · 2015-04-30T20:46:28.000Z

yes, I ran sfc /scannow. It reports everything is fine.

This is weird. I just can figure out what is going on. I was hoping new NIC drivers would do the trick.

Thanks for your help
-=Mark=-

essexboy · 2015-05-01T12:28:44.000Z

Have you tried a clean boot to see if there is a driver conflict

Step 1: Start MSConfig

Click Start, type msconfig in the Start Search box, and then press ENTER.
If you are prompted for an administrator password or for a confirmation, type the password, or provide confirmation.

Step 2: Configure Selective Startup options

1.In the System Configuration Utility dialog box, click Selective Startup on the General tab.

https://dl.dropbox.com/u/73555776/Cleanboot1.JPG

2.Click to clear the Load Startup Items check box.
Note The Use Original Boot.ini check box is unavailable.

3.Click the Services tab.

https://dl.dropbox.com/u/73555776/cleanboot2.JPG

4.Click to select the Hide All Microsoft Services check box.
5.Click Disable All, and then click OK.
6. When you are prompted, click Restart.

MarkJohnson · 2015-05-01T17:39:02.000Z

That seems to have done the trick!

Thanks a ton for your help
-=Mark=-

essexboy · 2015-05-01T17:39:58.000Z

All you need do now is determine which driver/service is the culprit

MarkJohnson · 2015-05-01T20:51:21.000Z

I found it. It was teamviewer 9.

I reenabled the other items and it is booting right up. and have it on normal startup.

Thanks again for the help
-=Mark=-

essexboy · 2015-05-01T21:02:59.000Z

My pleasure, you can use delfix to remove any tools that were used

Download and run Delfix
Select the options as shown

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

MarkJohnson · 2015-05-01T23:06:40.000Z

Thanks again.

I’ll try to close the thread. Marked solved.

-=Mark=-

Announcements