[tuufulhundin]

ok my hubby needs to do some homework online so that will be a good test drive tomorrow.................and I will let you know how it goes, i have turned bull guard back on for now, have a good nights sleep.

[Advertisements]

so this morning it took for ever to load, then malware bytes produced this log.......................bullguard saw nothing................

[tuufulhundin]

so this morning it took for ever to load, then malware bytes produced this log.......................bullguard saw nothing................

[tuufulhundin]

Finally got the log attached, got that sound like things running and running in the background again, but no I havent loaded the u promise tool bar............

Attached Files

•  malware bytes log 22-11-14.txt   2.78KB   125 downloads

[Essexboy]

That is just a report that it has started and then run a scan with no detections. Could I have a fresh FRST scan please to confirm all the bad stuff has gone, then we will look at the system

[tuufulhundin]

did the frst.exe here are the logs...........

Attached Files

•  FRST.txt23-11-2014.txt   61.22KB   141 downloads
•  Addition.txt 23-11-2014.txt   44.73KB   208 downloads

[Essexboy]

A few orphans to kill so I will get rid of those, they are of no real import but I do like tidy

Then we will run a clean boot to determine which programme/service is causing the activity

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

GroupPolicyUsers\S-1-5-21-1737900368-1643728146-1281706836-1005\User: Group Policy restriction detected <======= ATTENTION
URLSearchHook: HKU\S-1-5-21-1737900368-1643728146-1281706836-1005 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-1737900368-1643728146-1281706836-1005 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-1737900368-1643728146-1281706836-1005 -> {b167b83b-348e-4f8a-a00d-693f28ede787} URL = http://search.expats...q={searchTerms}
SearchScopes: HKU\TS_KeyLodaded -> {0DA2AED0-C057-4FAD-8E6F-7CA1C6F8657B} URL = http://websearch.ask...15-3B7F99CF15F8
SearchScopes: HKU\TS_KeyLodaded -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPDTDF
SearchScopes: HKU\TS_KeyLodaded -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia....h={searchTerms}
Toolbar: HKU\S-1-5-21-1737900368-1643728146-1281706836-1005 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

OK clean boot, what this will do is set the computer to boot with only MS services and your AV running. When it is set try it out for a little while and see if the loading comes on

In the search box type Msconfig and select the programme that appears at the top

1.In the System Configuration Utility dialog box, click Selective Startup on the General tab.

2.Click to clear the Load Startup Items check box.
NoteThe Use Original Boot.ini check box is unavailable.
3.Click the Services tab.
4.Click to select the Hide All Microsoft Services check box.

5.Click Disable All and then replace the tick alongside your antivirus
6.click OK.
7.When you are prompted, click Restart.

You will now reboot in a clean state, do you still experience the loading

[tuufulhundin]

here is the fixlog

Attached Files

•  Fixlog.txt   3.86KB   213 downloads

[Essexboy]

OK now the time to see if a clean boot solves the gremlin

[tuufulhundin]

just did all that so far no gremlin.......................

[Essexboy]

Do you want to run it for a bit to be sure ? Or do you wish to proceed to the boring bit ?

Are all your normal programmes functioning in clean boot mode ?

[tuufulhundin]

yes, but again after load up for a while it sounds like something is running in the background, and seems to be slowing down the whole system................loading pages, turning pages etc etc

[Essexboy]

Could you run the following programme when you hear it winding up

Download Speedfan and install it. Once it's installed, run the program and post here the information it shows. The information I want you to post is the stuff that is circled in the example picture I have attached.
If you are running on a vista machine, please go to where you installed the program and run the program as administrator.


(this is a screenshot from a vista machine)

[tuufulhundin]

Im off to work in a mo, but I will do it this evening for sure. Thanks. Have a great afternoon your end of the world.

[Essexboy]

Time is not a problem to me, don't work too hard

[tuufulhundin]

I cannot get that speedfan thing to install correctly?