CPU at 100%, unremovable malware?

Sandraxia · October 3, 2015

Hello everyone,

I have a few computer problems that I hope you can help me with:

- Have a gaming PC (or so I am told) with high-end parts, but can't even watch HD

- Don't do gaming or anything that would take up space, but my C: partition is full (9 GB of 160 GB free)

- CPU usage goes up to 100%, PC lags horribly as soon as I open YouTube or anything like that.

I once downloaded something that came with malware, winSpeed.dll by publisher 24soft. I could not remove it through Uninstall, so I downloaded Malwarebytes Anti-Malware and ran a Scan, which seems to have removed WinSpeed from the list of programs. However, problems persist. I have attached the required log data. I would be so grateful for any hints!

I also have a few questions:

- I made a backup a week ago. That took up 9 DVDs. I guess I can trash that if indeed I have a virus?

- Could they have installed a key logger? Is there any way to find out? Do they have access to my accounts (including bank accounts?)? Is there any way to protect myself?

Thank you very much in advance!

CheckResults.txt

frst scan Addition.txt

FRST Scan results.txt

malware scan results.txt

mbam CheckResults.txt

kevinf80 · October 3, 2015

Hello and welcome,

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Uninstall the following via programs and features:

WinSpeed

Next,

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Let me see those logs, also give an update on any remaining issues or concerns....

Thank you,

Kevin...

Fixlist.txt

Sandraxia · October 3, 2015

Hello Kevin,

thank you so much. I only understood about a third of what you said, but I am doing my best to follow your instructions meticulously.

- WinSpeed is deleted

- fixlog.txt attached

- malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 03.10.2015
Scan Time: 22:16
Logfile: malwarescanlog_for_kevin.txt
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.10.03.06
Rootkit Database: v2015.10.02.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sarah

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 372025
Time Elapsed: 12 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

- AdwCleaner:

# AdwCleaner v5.009 - Logfile created 03/10/2015 at 22:47:00
# Updated 27/09/2015 by Xplode
# Database : 2015-09-30.1 [server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Sarah - HOGWARTS
# Running from : C:\Users\Sarah\Downloads\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\Bench
[-] Folder Deleted : C:\ProgramData\productdata
[-] Folder Deleted : C:\Users\Sarah\AppData\Local\globalUpdate
[-] Folder Deleted : C:\Users\Sarah\AppData\Roaming\RHEng
[-] Folder Deleted : C:\Users\Sarah\AppData\Roaming\productdata

***** [ Files ] *****

[-] File Deleted : C:\END
[-] File Deleted : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\invalidprefs.js
[-] File Deleted : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\user.js
[-] File Deleted : C:\Windows\SysWOW64\RegistryHelperLM.ocx

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

[-] Task Deleted : Adobe Flash Player Updater

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
[-] Key Deleted : HKCU\Software\Mozilla\Extends
[-] Key Deleted : HKLM\System\CurrentControlSet\Services\Eventlog\Application\registry helper service
[-] Key Deleted : HKLM\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Record\{425E7597-03A2-338D-B72A-0E51FFE77A7E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Record\{915BB7D5-082E-3B91-B1E0-45B5FDE01F24}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}
[-] Key Deleted : HKLM\System\CurrentControlSet\Services\Eventlog\Application\Update Krab Web
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8F7D0A5-7074-40B8-9BDC-1174BDD0A132}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59D188FA-757A-424E-8C93-F58FFD896BD7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6B5DFDFC-8AA8-425B-96C0-5426F97862E5}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Key Deleted : HKCU\Software\APN PIP
[-] Key Deleted : HKCU\Software\genesis
[-] Key Deleted : HKCU\Software\OCS
[-] Key Deleted : HKCU\Software\powerpack
[-] Key Deleted : HKCU\Software\Softonic
[-] Key Deleted : HKCU\Software\Cores
[-] Key Deleted : HKCU\Software\SpeedChecker
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{779D1843-0043-65D2-D781-8614F17B6222}
[!] Key Not Deleted : [x64] HKCU\Software\APN PIP
[!] Key Not Deleted : [x64] HKCU\Software\genesis
[!] Key Not Deleted : [x64] HKCU\Software\OCS
[!] Key Not Deleted : [x64] HKCU\Software\powerpack
[!] Key Not Deleted : [x64] HKCU\Software\Softonic
[!] Key Not Deleted : [x64] HKCU\Software\Cores
[!] Key Not Deleted : [x64] HKCU\Software\SpeedChecker
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [search Page]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [start Page]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [start Page]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [search Page]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Search [searchAssistant]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [start Page]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [search Page]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000\Software\Microsoft\Internet Explorer\Main [search Page]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000\Software\Microsoft\Internet Explorer\Main [start Page]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000\Software\Microsoft\Internet Explorer\Search [searchAssistant]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main [search Page]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main [start Page]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
[-] Data Restored : HKU\S-1-5-21-4293625024-568133848-3289987686-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Search [searchAssistant]

***** [ Web browsers ] *****

[-] [C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "Web Search");
[-] [C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "Web Search");
[-] [C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\prefs.js] [Preference] Deleted : user_pref("extensions.a975af9566d8c4897837a25c267d2cec1gmailcom64969.64969.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%[...]
[-] [C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\prefs.js] [Preference] Deleted : user_pref("extensions.a975af9566d8c4897837a25c267d2cec1gmailcom64969.64969.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22deal[...]
[-] [C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\prefs.js] [Preference] Deleted : user_pref("extensions.awrigtdamonyahoocom65055.65055.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%2C%22anthropologie.com[...]
[-] [C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\46onwhm4.default-1414951182278\prefs.js] [Preference] Deleted : user_pref("extensions.awrigtdamonyahoocom65055.65055.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22dealply_p%22%3A%7B%22urls%[...]

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [9357 bytes] ##########

- Jrt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Home Premium x64
Ran by Sarah on 03.10.2015 at 22:54:30,71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] C:\Users\Sarah\Appdata\Local\com
Successfully deleted: [Folder] C:\Windows\SysWOW64\ai_recyclebin
Successfully deleted: [Folder] C:\ProgramData\couponpeuakk
Successfully deleted: [Folder] C:\ProgramData\DealsFinderPuroo

~~~ FireFox

Successfully deleted: [Folder] C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\46onwhm4.default-1414951182278\extensions\staged
Emptied folder: C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\46onwhm4.default-1414951182278\minidumps [18 files]

~~~ Chrome

[C:\Users\Sarah\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Sarah\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Sarah\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Sarah\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2015 at 22:58:12,79
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

- malicious software removal tool

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.7, December 2013 (build 5.7.9701.0)
Started On Sun Jan 05 14:39:03 2014

Engine: 1.1.10100.0
Signatures: 1.163.1013.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Sun Jan 05 14:39:25 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.8, January 2014 (build 5.8.9803.0)
Started On Thu Jan 16 19:52:03 2014

Engine: 1.1.10201.0
Signatures: 1.165.1273.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Jan 16 19:52:22 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.9, February 2014 (build 5.9.9902.0)
Started On Sun Feb 23 16:25:29 2014

Engine: 1.1.10201.0
Signatures: 1.165.3163.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Sun Feb 23 16:25:48 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.10, March 2014 (build 5.10.10001.0)
Started On Wed Mar 19 14:25:57 2014

Engine: 1.1.10302.0
Signatures: 1.167.1001.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 19 14:26:18 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.11, April 2014 (build 5.11.10100.0)
Started On Sun Apr 13 13:10:17 2014

Engine: 1.1.10401.0
Signatures: 1.169.1258.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Sun Apr 13 13:10:37 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.12, May 2014 (build 5.12.10200.0)
Started On Thu May 15 06:30:50 2014

Engine: 1.1.10502.0
Signatures: 1.173.1305.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu May 15 06:31:24 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.13, June 2014 (build 5.13.10300.0)
Started On Thu Jun 12 00:36:35 2014

Engine: 1.1.10600.0
Signatures: 1.175.1113.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Jun 12 00:37:11 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.15, August 2014 (build 5.15.10500.0)
Started On Thu Aug 14 19:38:32 2014

Engine: 1.1.10802.0
Signatures: 1.179.1796.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Aug 14 19:39:16 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.16, September 2014 (build 5.16.10602.0)
Started On Thu Sep 11 20:58:22 2014

Engine: 1.1.10904.0
Signatures: 1.183.882.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Sep 11 20:59:08 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)
Started On Sun Oct 19 22:27:35 2014

Engine: 1.1.11005.0
Signatures: 1.185.2035.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Sun Oct 19 22:28:37 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.18, November 2014 (build 5.18.10802.0)
Started On Wed Nov 12 22:39:55 2014

Engine: 1.1.11104.0
Signatures: 1.187.1116.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 12 22:41:18 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.19, December 2014 (build 5.19.10902.0)
Started On Thu Dec 11 11:45:52 2014

Engine: 1.1.11202.0
Signatures: 1.189.872.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Dec 11 11:47:33 2014

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.20, January 2015 (build 5.20.11000.0)
Started On Tue Jan 13 23:33:50 2015

Engine: 1.1.11302.0
Signatures: 1.191.1276.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 13 23:35:33 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.21, February 2015 (build 5.21.11102.0)
Started On Wed Feb 11 11:04:16 2015

Engine: 1.1.11302.0
Signatures: 1.191.3593.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 11 11:06:03 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.22, March 2015 (build 5.22.11202.0)
Started On Wed Mar 11 15:42:50 2015

Engine: 1.1.11400.0
Signatures: 1.193.1181.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 11 15:44:34 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.23, April 2015 (build 5.23.11300.0)
Started On Thu Apr 16 20:55:11 2015

Engine: 1.1.11502.0
Signatures: 1.195.1215.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Apr 16 20:57:14 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.24, May 2015 (build 5.24.11401.0)
Started On Wed May 13 23:35:25 2015

Engine: 1.1.11602.0
Signatures: 1.197.1100.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 13 23:37:51 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.25, June 2015 (build 5.25.11502.0)
Started On Wed Jun 10 22:10:04 2015

Engine: 1.1.11701.0
Signatures: 1.199.892.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 10 22:11:58 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.26, July 2015 (build 5.26.11604.0)
Started On Thu Jul 16 22:25:55 2015

Engine: 1.1.11804.0
Signatures: 1.201.883.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Jul 16 22:28:06 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.27, August 2015 (build 5.27.11700.0)
Started On Wed Aug 12 10:42:24 2015

Engine: 1.1.11903.0
Signatures: 1.203.693.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Aug 12 10:44:44 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.28, September 2015 (build 5.28.11802.0)
Started On Wed Sep 09 11:36:09 2015

Engine: 1.1.12002.0
Signatures: 1.205.646.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 09 11:38:43 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.28, September 2015 (build 5.28.11802.0)
Started On Sat Oct 03 23:02:32 2015

Engine: 1.1.12002.0
Signatures: 1.205.646.0
Microsoft Windows Malicious Software Removal Tool Finished On Sat Oct 03 23:02:55 2015

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.28, September 2015 (build 5.28.11802.0)
Started On Sat Oct 03 23:03:21 2015

Engine: 1.1.12002.0
Signatures: 1.205.646.0

Results Summary:
----------------
No infection found.

AdwCleanerC1SCAN FOR KEVIN2.txt

malwarescanlog_for_kevin.txt

JRTtokevin3.txt

mrt for kevin 4.txt

Fixlog.txt

Sandraxia · October 3, 2015

The CPU problem persists (still 100% and lagging with HD), while the C: Partition is now 12 GB of 160 free (before I downloaded all those programs and ran the scans, it was 9GB).

Is there any way I can see what makes up thos 148 GB on my C: partition?

Thank you again very much for your reply!

kevinf80 · October 3, 2015

Run the following:

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
Close the program > Don't Fix anything!

Next,

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs....

Let me see those logs...

Sandraxia · October 4, 2015

Thank you very much again for your time Here are those two additional reports.

Rogue report for Kevin.txt

FRST second run to Kevin.txt

kevinf80 · October 4, 2015

Those logs posted are clean, what is the current status of your system, any remaining issues or concerns. Regarding what is on your Hard drive, download and install WinDirStat that will tell exactly what is on your HD:

http://www.fosshub.com/WinDirStat.html

Read the instructions at that link to be aware of its potential and find out exactly what is using the space on your HD

Sandraxia · October 4, 2015

Thanks for this confirmation and for the link! I can only access my PC again on Tuesday, but when I tried this morning, the CPU problem persisted, any video I try to watch is still lagging heavily. It's probably not the internet connection, or could the internet connection be bad enough for the CPU to go up to 100% when I go online? Did you see anything in my file logs that could have been a keylogger?

kevinf80 · October 4, 2015

Your hard drive is almost full, for windows to work correctly and efficiently there must be a minimum of 15% free space.

Run the following online AV scan for thorough check.... it will take several hours to complete:

Scan with ESET Online Scanner

This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
Please visit ESET Online Scanner website.

Click there Run ESET Online Scanner.

If using Internet Explorer:

Accept the Terms of Use and click Start.
Allow the running of add-on.

If using Mozilla Firefox or Google Chrome:

Download esetsmartinstaller_enu.exe that you'll be given link to.
Double click esetsmartinstaller_enu.exe.
Allow the Terms of Use and click Start.

To perform the scan:

Make sure that Remove found threats is unchecked.
Scan archives is checked.
In Advanced Settings: Scan for potentially unwanted applications, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.
Under “Enable Stealth Technology select “Change” select any extra drives in that window.
Click Start
The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
When completed, the program will begin to scan. This may take several hours. Please, be patient.
Do not do anything on your machine as it may interrupt the scan.
When the scan is done, click Finish.
A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.

Please include this logfile in your next reply.

Don't forget to re-enable security software!

Thank you,

Kevin...

Maurice Naggar · October 11, 2015

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Maurice Naggar · October 12, 2015

Per request by Sandraxia, this thread is being re-opened.

kevinf80 · October 12, 2015

Hello again Sandraxia,

Follow the instructions in reply #9, also give an update of any remaining issues or concerns..

Thank you,

Kevin...

Sandraxia · October 14, 2015

Hello everyone,

thank you for re-opening the topic. I was afk for a while due to family issues.

I ran the WinDirStat Scan, not sure how to proceed (see file). I will run the other two programs in an hour, when I'm back. Thanks so far!

Sandraxia · October 14, 2015

I ran the ESET thing according to your orders. It found 8 threats! I didn't remove them. Here is the log file (attached).

Sandraxia · October 14, 2015

sorry forgot the attachment and didn't know how to edit my post.

ESET log.txt

kevinf80 · October 14, 2015

The biggest amount of data to reclaim is via removal of the Windows.old folder 56.4 GB, that folder was created 24/11/2013 when the system was re-installed without formatting the hard drive first. As it has been sitting for almost 2 years I guess its safe to remove.. We can do that with FRST, also remove the entries flagged by ESET..

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Post that log, also let me know if there are any remaining issues or concerns.....

Thank you,

Kevin...

Fixlist.txt

Sandraxia · October 15, 2015

The biggest amount of data to reclaim is via removal of the Windows.old folder 56.4 GB, that folder was created 24/11/2013 when the system was re-installed without formatting the hard drive first. As it has been sitting for almost 2 years I guess its safe to remove.. We can do that with FRST, also remove the entries flagged by ESET..

Thank you! I didn't quite catch how to remove the Windows.old folder 56.4 GB, should I just delete it, should I run the WinDirStat Scan and then delete it, or should I deinstall it, or should I do the FRST thing first and that somehow removes the folder?

Runnning the ESET Scan again to remove the entries it found. Thanks!

kevinf80 · October 15, 2015

There is no need to run ESET again, I have the ESET log entries and Windows.old listed in the FRST fix for deletion. Just follow the instructions in reply #16

Thank you,

Kevin

Sandraxia · October 15, 2015

Ops, I deleted some of the files already. I think the others were deleted by your program, but not the old windows? Here are the text files... but the fix text disappeared, is that right?

Fixlog.txt

Sandraxia · October 15, 2015

The C partition is still full:

kevinf80 · October 15, 2015

Yes windows.old is moved, it now sits in FRST quarantine still on C:\Drive. That will be deleted when we cleanup and remove tools etc... I guess I should have made that point clear...

What is the current status, any remaining issues or concerns.....?

Sandraxia · October 15, 2015

oh, ok! I see. Do we do the cleanup now?

Well the CPU problem is still there, maybe it is not related to the C: partition being full. Or maybe that changes once windows.old is deleted. I literally have no idea what we are talking about, and I am very grateful for your help.

kevinf80 · October 15, 2015

Can you post a screenshot to show what is using CPU.. It may very well be down to C:\ being more or less full, windows needs about 15% of the drive empty to work efficiently...

Sandraxia · October 15, 2015

It is almost exclusively Chrome when I use it to watch videos...

kevinf80 · October 15, 2015

mmm, I guess that is really to be expected. If that problem was down to malware/infection i`d expect the memory reading to be higher too...

Run the following to clean up, see what happens when you are not streaming videos.....

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

Remove disinfection tools
Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Cheers,

Kevin..

CPU at 100%, unremovable malware?

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information