Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

slow computer

Started by gregahoffman , Jul 22 2016 06:20 AM

Page 4 of 6
2
3
4
5
6

Please log in to reply

#46
gregahoffman

Posted 19 August 2016 - 06:08 AM

Member

Topic Starter
Member
400 posts

speedtest results

just for fun, I ran adwcleaner and got these results

# AdwCleaner v6.000 - Logfile created 19/08/2016 at 07:26:34
# Updated on 12/08/2016 by ToolsLib
# Database : 2016-08-19.1 [Server]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : greg & jacki - HPLAPTOP
# Running from : C:\Users\greg & jacki\Desktop\Tools\adwcleaner_6.000.exe
# Mode: Clean
# Support : https://toolslib.net/forum

***** [ Services ] *****

[!] Service not deleted: {07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}
[!] Service not deleted: {59D6FA87-02F6-4401-9171-D62367DDBC70}
[!] Service not deleted: {A81DB917-D76B-4FFB-8096-8457E2EE1CFE}
[!] Service not deleted: {B8BF088E-2A7C-4322-A476-C5E0F1A62106}
[!] Service not deleted: {F0896213-9B2A-4620-8C3F-EBFB17F111B4}
[!] Service not deleted: {F1B6EB07-5742-48CD-8569-8F9DC1979B1B}

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1343 Bytes] - [15/08/2016 07:39:39]
C:\AdwCleaner\AdwCleaner[C2].txt - [1489 Bytes] - [18/08/2016 07:28:22]
C:\AdwCleaner\AdwCleaner[C3].txt - [1313 Bytes] - [19/08/2016 07:26:34]
C:\AdwCleaner\AdwCleaner[S1].txt - [817 Bytes] - [26/07/2016 12:38:14]
C:\AdwCleaner\AdwCleaner[S2].txt - [889 Bytes] - [08/08/2016 07:54:28]
C:\AdwCleaner\AdwCleaner[S3].txt - [961 Bytes] - [12/08/2016 08:28:13]
C:\AdwCleaner\AdwCleaner[S4].txt - [1468 Bytes] - [15/08/2016 07:37:05]
C:\AdwCleaner\AdwCleaner[S5].txt - [1614 Bytes] - [18/08/2016 07:24:49]
C:\AdwCleaner\AdwCleaner[S6].txt - [1983 Bytes] - [19/08/2016 07:26:04]

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1821 Bytes] ##########

Attached Thumbnails

Attached Files

junk 1.txt 2.64KB 142 downloads

Edited by gregahoffman, 19 August 2016 - 06:43 AM.

#47
RKinner

Posted 19 August 2016 - 07:25 AM

Malware Expert

Expert
24,625 posts

For the junk file you typed netstat -RN instead of netstat -ES. Can you try it again?

Your adwcleaner results are interesting.

We could look at the registry entries in regedit and see if they have a permission problem but if AdwCleaner can't remove them you would have to take ownership to change the permissions. Let's get FRST again and use a fixlist to unlock them so we can see them.

Download the attached Fixlist:

[*]Get FRST from

http://www.bleepingc...very-scan-tool/

You need to download the appropriate tool for your PC. If you don't know if you have a 32 or 64 bit system get them both. Only one will work and that's the right one.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

[/LIST]

Press Fix. You will get just the one log. Please post it. We are just trying to look at the registry entries on this pass. Don't want to remove them until I know what they are.

#48
gregahoffman

Posted 19 August 2016 - 12:51 PM

Member

Topic Starter
Member
400 posts

I copied and pasted the command in the box but it says it can't find the specified path

I attached a screenshot

I can't figure out how to add the fixlist to FRST64

Edited by gregahoffman, 19 August 2016 - 01:02 PM.

#49
RKinner

Posted 19 August 2016 - 02:20 PM

Malware Expert

Expert
24,625 posts

Two problems.

One: you have to use an elevated command Prompt:

Win 10: http://www.howtogeek...-in-windows-10/

Win 8: http://www.eightforu...indows-8-a.html

Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Admin.

By default the elevated command prompt will start in C:\Windows\System32 and not in c:\users\yourlogin\

Two: you have a space after the \ before the junk.txt:

 \junk.txt not \ junk.txt

#50
gregahoffman

Posted 19 August 2016 - 02:27 PM

Member

Topic Starter
Member
400 posts

I hope I did it right this time

Interface Statistics

Received Sent

Bytes                     173188255        29261125
Unicast packets              161590          108655
Non-unicast packets          127405           82075
Discards                          0               0
Errors                            0               0
Unknown protocols                 0

IPv4 Statistics

Packets Received                   = 39899
Received Header Errors             = 0
Received Address Errors            = 0
Datagrams Forwarded                = 0
Unknown Protocols Received         = 0
Received Packets Discarded         = 1329
Received Packets Delivered         = 44881
Output Requests                    = 24937
Routing Discards                   = 0
Discarded Output Packets           = 72
Output Packet No Route             = 0
Reassembly Required                = 76
Reassembly Successful              = 38
Reassembly Failures                = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation    = 0
Fragments Created                  = 0

IPv6 Statistics

Packets Received                   = 14461
Received Header Errors             = 0
Received Address Errors            = 3
Datagrams Forwarded                = 0
Unknown Protocols Received         = 0
Received Packets Discarded         = 38
Received Packets Delivered         = 44371
Output Requests                    = 39972
Routing Discards                   = 0
Discarded Output Packets           = 21
Output Packet No Route             = 2
Reassembly Required                = 0
Reassembly Successful              = 0
Reassembly Failures                = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation    = 0
Fragments Created                  = 0

ICMPv4 Statistics

                            Received    Sent
Messages                  4           14
Errors                    0           0
Destination Unreachable   4           14
Time Exceeded             0           0
Parameter Problems        0           0
Source Quenches           0           0
Redirects                 0           0
Echo Replies              0           0
Echos                     0           0
Timestamps                0           0
Timestamp Replies         0           0
Address Masks             0           0
Address Mask Replies      0           0
Router Solicitations      0           0
Router Advertisements     0           0

ICMPv6 Statistics

                            Received    Sent
Messages                  5951        2318
Errors                    0           0
Destination Unreachable   0           22
Packet Too Big            0           0
Time Exceeded             0           0
Parameter Problems        0           0
Echos                     2           0
Echo Replies              0           2
MLD Queries               0           0
MLD Reports               0           0
MLD Dones                 0           0
Router Solicitations      0           110
Router Advertisements     4621        0
Neighbor Solicitations    1           1808
Neighbor Advertisements   1327        376
Redirects                 0           0
Router Renumberings       0           0

TCP Statistics for IPv4

Active Opens                        = 558
Passive Opens                       = 72
Failed Connection Attempts          = 3
Reset Connections                   = 222
Current Connections                 = 21
Segments Received                   = 17519
Segments Sent                       = 12910
Segments Retransmitted              = 305

TCP Statistics for IPv6

Active Opens                        = 341
Passive Opens                       = 0
Failed Connection Attempts          = 0
Reset Connections                   = 180
Current Connections                 = 30
Segments Received                   = 6560
Segments Sent                       = 5126
Segments Retransmitted              = 72

UDP Statistics for IPv4

Datagrams Received    = 29018
No Ports              = 1329
Receive Errors        = 0
Datagrams Sent        = 12503

UDP Statistics for IPv6

Datagrams Received    = 22862
No Ports              = 38
Receive Errors        = 0
Datagrams Sent        = 31863

#51
gregahoffman

Posted 19 August 2016 - 02:32 PM

Member

Topic Starter
Member
400 posts

frst log

Fix result of Farbar Recovery Scan Tool (x64) Version: 19-08-2016
Ran by greg & jacki (19-08-2016 15:30:09) Run:1
Running from C:\Users\greg & jacki\Desktop
Loaded Profiles: greg & jacki (Available Profiles: greg & jacki)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{59D6FA87-02F6-4401-9171-D62367DDBC70}
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{A81DB917-D76B-4FFB-8096-8457E2EE1CFE}
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{B8BF088E-2A7C-4322-A476-C5E0F1A62106}
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{F0896213-9B2A-4620-8C3F-EBFB17F111B4}
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{F1B6EB07-5742-48CD-8569-8F9DC1979B1B}
REG: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}" /s
REG: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{59D6FA87-02F6-4401-9171-D62367DDBC70}" /s
REG: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{A81DB917-D76B-4FFB-8096-8457E2EE1CFE}" /s
REG: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{B8BF088E-2A7C-4322-A476-C5E0F1A62106}" /s
REG: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{F0896213-9B2A-4620-8C3F-EBFB17F111B4}" /s
REG: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{F1B6EB07-5742-48CD-8569-8F9DC1979B1B}" /s

*****************

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}" => key could not be unlocked
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{59D6FA87-02F6-4401-9171-D62367DDBC70}" => key was unlocked
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{A81DB917-D76B-4FFB-8096-8457E2EE1CFE}" => key was unlocked
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{B8BF088E-2A7C-4322-A476-C5E0F1A62106}" => key was unlocked
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{F0896213-9B2A-4620-8C3F-EBFB17F111B4}" => key was unlocked
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{F1B6EB07-5742-48CD-8569-8F9DC1979B1B}" => key was unlocked

========= reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}" /s =========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}\Parameters