[Bondlover1313]

This is a topic that was started in the malware removal section of this site, I was told it would better serve my interests to post it here. Here is the link to that thread for any further needed info. Here is the 1st Post. http://www.geekstogo...-slow-computer/

Hi, I am new to this forum. I recently noticed my computer is slow, very slow. I have not been on the computer in question for a long time like 6-10 months or more. When ever I launch an application my computer will show the circle that goes around and then it stops like 10 seconds later and nothing happens, so I go to the task manager and see rundll32.exe is using 75-100 cpu and my computer slows, until I end the process. I have looked this up and found some answers, but all of them are outdated by at least a year or more. I didn't install anything yet nor the last time I used it, so if someone can tell me what pre-steps they need me to do, I will gladly. Thanks and sorry for any errors in advance.

Please note: The computer is not connected to the internet, so I have to download stuff via a USB then to the computer and install it. My internet connection on other computers is slow so it may take me a day or two to get back to this topic. Also, my computer is a 64 bit Windows 7 Home premium E-Machines, 500 Gb, I am only using 243 gb of the total hdd. Thanks again, I cannot risk formating this computer, it has a lot of important and unique things on it, pictures,videos,etc. I will try to do anything to make the experts job any easier.

Thanks, Bests
Bondlover1313

[Advertisements]

How does it behave if you boot to Safe Mode with Networking? If better then something is starting at boot that is causing the problem.

Advanced startup options - XP
Advanced startup options - Vista
Advanced startup options - Windows 7

Use msconfig to determine what is causing the problem

These are good tutorials on using msconfig in XP, Vista or Windows 7:
How to use msconfig in Windows XP
How to use msconfig in Windows Vista
How to use msconfig in Windows 7 and Windows 8

Click on Start then Run, type msconfig and press Enter.
Click on the Startup tab (for Windows 8, the Startup tab has a link to open Task Manager/Startup tab. Use that.), record what is currently starting then click the Disable All button.
Reboot and see if it runs better.
If yes then use msconfig to enable several items at a time till you find the culprit.

If no, start msconfig and click on the Services tab.
Check the Hide All Microsoft Services box, record what is currently starting then click the Disable All button.
Again, do a regular boot, see if it runs normal.
If yes then use msconfig to enable services till you find the culprit.

Once you've found the culprit, uninstall it or find out how to eliminate it from your system. Simply disabling it in msconfig is a temporary fix at best.
Enable everything else you disabled.s

[Ztruker]

How does it behave if you boot to Safe Mode with Networking? If better then something is starting at boot that is causing the problem.

Advanced startup options - XP
Advanced startup options - Vista
Advanced startup options - Windows 7

Use msconfig to determine what is causing the problem

These are good tutorials on using msconfig in XP, Vista or Windows 7:
How to use msconfig in Windows XP
How to use msconfig in Windows Vista
How to use msconfig in Windows 7 and Windows 8

Click on Start then Run, type msconfig and press Enter.
Click on the Startup tab (for Windows 8, the Startup tab has a link to open Task Manager/Startup tab. Use that.), record what is currently starting then click the Disable All button.
Reboot and see if it runs better.
If yes then use msconfig to enable several items at a time till you find the culprit.

If no, start msconfig and click on the Services tab.
Check the Hide All Microsoft Services box, record what is currently starting then click the Disable All button.
Again, do a regular boot, see if it runs normal.
If yes then use msconfig to enable services till you find the culprit.

Once you've found the culprit, uninstall it or find out how to eliminate it from your system. Simply disabling it in msconfig is a temporary fix at best.
Enable everything else you disabled.s

[Bondlover1313]

I've tried MSconfig and disabled all then one by one re enabled them and the problem still persists.

[Ztruker]

How did it rtun in Safe Mode with Networking?

[Bondlover1313]

Still the same.

[Macboatmaster]

Bondlover1313



PLEASE IGNORE the advice posted in post 6.

You need to format your system.
Virus has entered in system storage.
Microsoft Security Essentials is nothing.

and continue with my colleague Ztruker

Edited by Macboatmaster, 06 February 2013 - 06:01 PM.

[admin]

@ arthurthomason there is certainly a time and a place to reformat. Most security "experts" say any infected system should be reformattted, and most shops do it for ease of repair. Here we believe in cleaning/fixing systems, and formatting only as a last resort.

[Bondlover1313]

I know LOL, not gonna take advice of a Guy who just joined a few hours ago. I may not be the smartest person here but I'm not dumb LOL. I only follow the pros advice here.

[Ztruker]

Create a new account to test with. Pick a name you can live with in case you need to keep it.

Control Panel / User Accounts / Create new account.

Logon with the new account. How does it run?

Also, download and install CCleaner from the following link: CCleaner - Standard

During installation, uncheck the option to install the Yahoo toolbar.

Start CCleaner. Click on Tools (ICON) and Select the following BUTTONS to create two (2) text files:

* Uninstall > Save to text file (install) – bottom right corner of app window
* Startup > Save to text file (startup)

Locate and open each saved file in the ‘Documents’ FOLDER:

* Copy and paste the contents of each file into your next post (2 files).

I know this is somewhat painful having to use USB to port stuff back and forth but I would like to see the information. A lot of it was available in your malware thread but scattered around.

[Bondlover1313]

OH MY GOD! I created a new account as per instructions I tried running some programs and it worked! I couldn't believe it! It actually worked. I will get you the requested logs in a little while, but I just wanted to let you know that it works on the new account. If I could I would hug the crap out of you for just giving me this ray of hope.

[Bondlover1313]

Here are the logs and it is not a problem to port back and forth.

INSTALL
Acrobat.com Adobe Systems Incorporated 10/29/2009 1.60 MB 1.6.65
Adobe After Effects CS5.5 Adobe Systems Incorporated 4/7/2012 2.77 GB 10.5.1
Adobe AIR Adobe Systems Inc. 10/29/2009 1.5.0.7220
Adobe Flash Player 11 ActiveX 64-bit Adobe Systems Incorporated 4/11/2012 6.00 MB 11.2.202.228
Akamai NetSession Interface 4/8/2012
Akamai NetSession Interface Service 4/8/2012
Apple Application Support Apple Inc. 9/28/2010 42.8 MB 1.3.2
Apple Software Update Apple Inc. 9/28/2010 2.15 MB 2.1.1.116
Autodesk Content Service Autodesk 9/30/2011 95.8 MB 2.0.90
Autodesk Design Review 2012 Autodesk, Inc. 11/6/2011 12.0.0.93
Autodesk Inventor Fusion 2012 Autodesk, Inc. 9/28/2011 1.0.0.79
Autodesk Inventor Fusion plug-in for AutoCAD 2012 Autodesk 9/30/2011 0.0.1.138
Autodesk Material Library 2012 Autodesk 9/30/2011 97.8 MB 2.5.0.8
Autodesk Material Library Base Resolution Image Library 2012 Autodesk 9/30/2011 71.4 MB 2.5.0.8
Beta Modern Mod 10/17/2010
Burn4Free CD & DVD 5.1.0.0 Ikysasoft s.r.l. uninominale 1/23/2013 6.89 MB
CamStudio 9/9/2010
CamStudio Lossless Codec v1.4 © 2003 RenderSoft Software, Modifications Copyright © 2008 Jake P. 9/9/2010
Camtasia Studio 7 TechSmith Corporation 9/18/2010 224 MB 7.0.1
CCleaner Piriform 1/23/2013 3.27
Compatibility Pack for the 2007 Office system Microsoft Corporation 4/11/2012 56.4 MB 12.0.6612.1000
CyberLink PowerDirector CyberLink Corp. 3/6/2011 7.20 MB 9.0.0.2504
DAEMON Tools Lite DT Soft Ltd 1/10/2011 4.40.1.0127
DVD-CLONER V7.60 Build 998 OpenCloner Inc. 10/12/2010 25.3 MB 7.60.0.998
eBay Worldwide OEM 5/26/2010 100 KB 2.1.0901
eMachines Games WildTangent 5/26/2010 1.0.0.71
eMachines Recovery Management Acer Incorporated 10/29/2009 4.05.3005
eMachines Registration Acer Incorporated 5/26/2010 1.02.3006
eMachines ScreenSaver eMachines Incorporated 5/26/2010 1.1.0812
eMachines Updater Acer Incorporated 10/29/2009 1.01.3017
FARO LS 1.1.406.58 FARO Scanner Production 9/28/2011 21.5 MB 4.6.58.2
Fraps (remove only) 9/18/2010
Free DVD Video Burner version 3.1.815 DVDVideoSoft Limited. 9/6/2011 20.8 MB
Free Mp3 Wma Converter V 1.94 Koyote Soft 3/20/2011 16.2 MB 1.94.0.0
Free Screen Video Recorder version 2.5.15.305 DVDVideoSoft Limited. 3/19/2011 22.9 MB
Free Video to DVD Converter version 1.6.22.804 DVDVideoSoft Limited. 9/6/2011 44.0 MB
Free Video to Flash Converter version 4.7.21.305 DVDVideoSoft Limited. 3/19/2011 35.0 MB
Game Booster IObit 1/23/2011 13.4 MB 2.2.0.0
GIMP 2.6.8 9/25/2010
Google SketchUp Pro 7 Google, Inc. 9/28/2010 95.1 MB 2.0.10247
Google SketchUp Pro 8 Google, Inc. 1/13/2011 136 MB 3.0.4811
GTA San Andreas Admin Console open source 9/25/2010 beta 3
Hitman - Codename 47 7/31/2010
Hitman 2 Silent Assassin 9/30/2010
HyperCam 2 9/18/2010
HyperCam 3 Solveig Multimedia 4/5/2012 3.0.912.18
HyperCam Toolbar 9/18/2010
Identity Card Acer Incorporated 5/26/2010 1.00.3002
James Bond 007: Nightfire Electronic Arts 7/31/2010
Knights of the Force 2.0 KotF.com 8/28/2010 2.0
Kotor Tool 8/16/2010
Kotor Tool SCM 8/3/2010 8.98 MB 1.0.1863.39252
Mafia II (With [bleep] Crack) 1/11/2011 31.9 MB
Malwarebytes Anti-Malware version 1.70.0.1100 Malwarebytes Corporation 2/3/2013 18.4 MB 1.70.0.1100
Microsoft .NET Framework 1.1 Microsoft 8/22/2010 34.8 MB 1.1.4322
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 9/28/2011 38.8 MB 4.0.30319
Microsoft .NET Framework 4 Extended Microsoft Corporation 9/28/2011 51.9 MB 4.0.30319
Microsoft .NET Framework SDK (English) 1.1 Microsoft 8/22/2010 111 MB 1.1.4322
Microsoft Office Home and Student 2007 Microsoft Corporation 4/11/2012 12.0.6612.1000
Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Corporation 4/11/2012 13.6 MB 12.0.6612.1000
Microsoft Office Professional 2007 Microsoft Corporation 4/11/2012 12.0.6612.1000
Microsoft Office Suite Activation Assistant Microsoft Corporation 10/29/2009 8.36 MB 2.9
Microsoft Silverlight Microsoft Corporation 4/9/2012 34.6 MB 4.1.10111.0
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 5/26/2010 1.72 MB 3.1.0000
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 10/29/2009 708 KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 3/6/2011 788 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 9/28/2011 782 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 4/11/2012 788 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 9/9/2010 2.06 MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 10/16/2010 594 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 9/28/2011 588 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 4/11/2012 600 KB 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Corporation 10/16/2010 11.0 MB 10.0.30319
Microsoft Works Microsoft Corporation 4/12/2012 894 MB 9.7.0621
MotioninJoy ds3 driver version 0.100 www.motioninjoy.com 8/1/2010
MotioninJoy ds3 vibration driver version 0.100 www.motioninjoy.com 7/31/2010
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 4/11/2012 1.27 MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 4/11/2012 1.33 MB 4.20.9876.0
Nero 7 Ultra Edition Nero AG 10/16/2010 1.41 GB 7.02.9888
Nero 9 Essentials Nero AG 10/29/2009
Notepad++ 8/24/2010 5.7
NVIDIA Display Control Panel NVIDIA Corporation 8/2/2010 6.14.12.5896
NVIDIA Drivers NVIDIA Corporation 8/2/2010 63.0 MB 1.10.62.40
NVIDIA PhysX NVIDIA Corporation 1/11/2011 78.9 MB 9.10.0512
PCSX2 - Playstation 2 Emulator 10/16/2010
Pinnacle Instant DVD Recorder Pinnacle Systems 4/4/2011 264 MB 2.5.0.092
Pinnacle Video Driver Pinnacle Systems 4/5/2012 2.73 MB 12.1.0.029
PowerDirector CyberLink Corp. 3/6/2011 7.20 MB 9.0.0.2504
PowerISO PowerISO Computing, Inc. 1/11/2011 4.7
PS3ThemeCreator A.R.K Soft 9/9/2010 23.5 MB 2.0
QuickTime Apple Inc. 3/6/2011 73.7 MB 7.66.71.0
RAR Password Cracker 4.12 dnSoft Research Group 9/30/2010
RCA Detective™ 3.0.0.101 RCA 3/19/2011 1.67 MB
RCA easyRip 2.4.6.0 RCA 3/19/2011 44.4 MB
RCA Updater 2.0.0.0 RCA 3/19/2011 16.4 MB
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 10/29/2009 6.0.1.5898
RegCure Pro ParetoLogic, Inc. 10/28/2012 3.1.2.0
Revo Uninstaller 1.94 VS Revo Group 11/11/2012 1.94
San Andreas Mod Installer cpmusick 8/22/2010 1.1
SanDiskSecureAccess_Manager.exe DMAILER 7/28/2011 1.0.0
Sanny Builder 3.04 8/26/2010
SmartSound Quicktracks 5 SmartSound Software Inc. 3/6/2011 50.1 MB 5.1.8
Spider-Man 3 ™ Activision 7/31/2010 1.59 GB 1.00.0000
Star Wars Battlefront LucasArts 8/12/2010 1.0
Star Wars Empire at War LucasArts 8/12/2010 1.0
Star Wars Jedi Knight Jedi Academy 8/28/2010
Star Wars JK II Jedi Outcast LucasArts 8/12/2010 1.0
Star Wars Knights of the Old Republic LucasArts 8/12/2010 1.0
Star Wars Republic Commando LucasArts 8/12/2010 1.0
Star Wars® Knights of the Old Republic® II: The Sith Lords™ Obsidian 8/12/2011 1.00.0000
The Sims 2 8/1/2010
Tom Clancy's Splinter Cell 4/18/2012 1.00.000
Uninstall 1.0.0.1 3/19/2011 10.4 MB
Vegas Pro 10.0 (64-bit) Sony 3/1/2011 447 MB 10.0.470
Vegas Pro 11.0 (64-bit) Sony 4/5/2012 507 MB 11.0.595
VLC media player 1.1.11 VideoLAN 10/12/2011 1.1.11
WeGame Client Public Beta 2.0.3 WeGame.com, Inc. 9/9/2010 42.6 MB Public Beta 2.0.3
Welcome Center Acer Incorporated 5/26/2010 1.00.3008
Windows Live Essentials Microsoft Corporation 5/26/2010 14.0.8089.0726
Windows Live Sign-in Assistant Microsoft Corporation 5/26/2010 1.93 MB 5.000.818.5
Windows Live Sync Microsoft Corporation 5/26/2010 2.78 MB 14.0.8089.726
Windows Live Upload Tool Microsoft Corporation 5/26/2010 224 KB 14.0.8014.1029
Windows Password Unlocker Professional Trial 6.0.0.0 Password Unlocker Studio. 9/16/2012 30.1 MB
WinRAR archiver 8/1/2010
µTorrent 8/2/2010 2.0.0

STARTUP

No HKCU:Run BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} Nero AG "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
No HKCU:Run Easy Dock Audiovox Electronics Corp. C:\Users\Matt Micheletti\Documents\RCA easyRip\EZDock.exe
Yes HKCU:Run ISUSPM Macrovision Corporation "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
Yes HKLM:Run AdobeAAMUpdater-1.0 Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
No HKLM:Run AdobeCS5.5ServiceManager Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
No HKLM:Run PWRISOVM.EXE PowerISO Computing, Inc. "C:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
No HKLM:Run QuickTime Task Apple Inc. "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
No HKLM:Run RtHDVCpl Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"
No HKLM:Run SwitchBoard Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe"
No Startup User OneNote 2007 Screen Clipper and Launcher.lnk Microsoft Corporation C:\PROGRA~2\MICROS~1\Office12\ONENOTEM.EXE /tsr
Yes Startup User RCA Detective.lnk Audiovox Electronics Corp. C:\Users\Matt Micheletti\Documents\RCA Detective\RCADetective.exe

[Ztruker]

I don't see anything that is "bad" though there are some you could disable from starting when you boot.

First, read here: Fix a corrupted user profile

Once you copy everything over from the old, corrupted account to the new one, test for awhile. If all is well and nothing is missing then delete the old account and it's files.

All these can be disabled using CCLeaner. Once disabled, reboot and see how the computer runs. If any problems, go back and enable the ones you need, but I don't think there will be any.

No HKCU:Run BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} Nero AG "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
No HKCU:Run Easy Dock Audiovox Electronics Corp. C:\Users\Matt Micheletti\Documents\RCA easyRip\EZDock.exe
No HKLM:Run AdobeCS5.5ServiceManager Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
No HKLM:Run PWRISOVM.EXE PowerISO Computing, Inc. "C:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
No HKLM:Run QuickTime Task Apple Inc. "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
No HKLM:Run RtHDVCpl Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"
No HKLM:Run SwitchBoard Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe"
No Startup User OneNote 2007 Screen Clipper and Launcher.lnk Microsoft Corporation C:\PROGRA~2\MICROS~1\Office12\ONENOTEM.EXE /tsr
Yes Startup User RCA Detective.lnk Audiovox Electronics Corp. C:\Users\Matt Micheletti\Documents\RCA Detective\RCADetective.exe

You could also consider uninstalling these:

RegCure Pro ParetoLogic, Inc. 10/28/2012 3.1.2.0
µTorrent 8/2/2010 2.0.0


You also have quite a few games installed. If you are not using them any longer, uninstall them.