Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account

Windows explorer now very sluggish

  • Please log in to reply




  • Member
  • PipPip
  • 35 posts
I need help with cleaning up after a major Trojan attack!

OS: XP Pro, SP3
HW: Toshiba Satelite A55, 1GB memory (maxed).

History: Latest run of Malwarebytes cleaned up 16 instances of Trojans.

Current Symptoms: Computer is sluggish to respond. Left clicking on a desktop icon to select it can take 10 seconds to respond. Right clicking can take twice as long. Systemidle process running 99%. I ran RootRepeal and obtained the following results:

ROOTREPEAL © AD, 2007-2009
Scan Start Time: 2009/10/27 07:56
Program Version: Version
Windows Version: Windows XP SP3

#: 041 Function Name: NtCreateKey
Status: Hooked by "<unknown>" at address 0xf7ea8376

#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0xf7ea836c

#: 063 Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0xf7ea837b

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0xf7ea8385

#: 098 Function Name: NtLoadKey
Status: Hooked by "<unknown>" at address 0xf7ea838a

#: 122 Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0xf7ea8358

#: 128 Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0xf7ea835d

#: 193 Function Name: NtReplaceKey
Status: Hooked by "<unknown>" at address 0xf7ea8394

#: 204 Function Name: NtRestoreKey
Status: Hooked by "<unknown>" at address 0xf7ea838f

#: 247 Function Name: NtSetValueKey
Status: Hooked by "<unknown>" at address 0xf7ea8380

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0xf7ea8367


Can someone please take my case and guide me as to what to do next? PLEASE!


  • 0


Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP