internet slowdown by unknown

[samual]

i don't know which program is causing slowdown of internet... i read http://www.bleepingcomputer.com/forums/t/44694/slow-computer/ 
for knowledge.....my isp don't have any problem because when i disabled chrome extensions i realized increased speeds..i have malwarebytes antimalware free version installed ....both webroot and malwarebyte antiexploit shield installed......

is it any malware ...iam scary about zero day malwares...pls look into matter

[samual]

57 minutes ago, samual said:

i don't know which program is causing slowdown of internet... i read http://www.bleepingcomputer.com/forums/t/44694/slow-computer/ 
for knowledge.....my isp don't have any problem because when i disabled chrome extensions i realized increased speeds..i have malwarebytes antimalware free version installed ....both webroot antivirus own identity shield and malwarebyte antiexploit shield installed......

is it any malware/rootkit ...iam scary about zero day malwares...pls look into matter

 

[kevinf80]

Hello samual and welcome to Malwarebytes, My screen name is kevinf80, i`m here to help clean up your system. Make sure to run all scans from accounts with Administrator status, continue as follows please: Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good... Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop: Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the "Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK. Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu. Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen. NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop. Change default download folder location in Edge -Boot to a user account with admin status, select start > file explorer > right click on "Downloads" folder and select "Properties" In the new window select "Location" tab > clear the text field box and type in or copy/paste %userprofile%\Desktop > select "Apply" then "OK" Be aware you are not changing the Browser download folder location, you are changing the user’s download directory location..... Next, Follow the instructions in the following link to show hidden files: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Next, Download RKill from here: http://www.bleepingcomputer.com/download/rkill/ There are three buttons to choose from with different names on, select the first one and save it to your desktop.   Double-click on the Rkill desktop icon to run the tool. If using Vista or Windows 7/8/10, right-click on it and Run As Administrator. A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully. A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply. If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time. If the tool does not run from any of the links provided, please let me know. Next, Tweaking.com Registry Backup   Download Tweaking.com Registry Backup from here, and save tweaking.com_registry_backup_portable.zip to your desktop. Now we need to create a new folder to extract the zipped contents into. Right click on the zipped folder you just downloaded and select "Extract All". Click the "Browse" button and from the list, expand "Computer", then expand "Windows (C:)", and click the "Make New Folder" button. Call this folder something you will remember...like "RegBackup" then click "Ok", and then click "Extract". From the newly extracted files, right click on and select Run as Administrator (XP users just double click) to start Tweaking.com Registry Backup.(Windows Vista/7/8/10 users: Accept UAC warning if it is enabled.) A screen like this should appear:   Type a custom name in Backup Name if you want, then choose Backup Now. If backup is successful, a message will appear at the lower half of the screen with an option to view logs. The registry backup will be created in %WindowsDrive%\RegBackup by default. You can customize the path in Settings. Close Tweaking.com Registry Backup when done. Next, Please open Malwarebytes Anti-Malware.   On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more. To get the log from Malwarebytes do the following:   Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… If Malwarebytes is not installed follow these instructions first: Download Malwarebytes Anti-Malware to your desktop. Double-click mbam-setup and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-Malware A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program. Click Finish. Follow the instructions above.... Next, Download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your next reply.... Thank you, Kevin...

[samual]

6 hours ago, samual said:

i don't know which program is causing slowdown of internet... i read http://www.bleepingcomputer.com/forums/t/44694/slow-computer/ 
for knowledge.....my isp don't have any problem because when i disabled chrome

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 17-Jul-16
Scan Time: 11:24 PM
Logfile: 
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.07.17.07
Rootkit Database: v2016.05.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: Samadhan

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 323385
Time Elapsed: 19 min, 4 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

Addition.txt

FRST.txt

Rkill.txt

[kevinf80]

Thanks for those logs, run the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download AdwCleaner by Xplode onto your Desktop.   Double click on Adwcleaner.exe to run the tool. Click on the Scan in the Actions box Please wait fot the scan to finish.. When "Waiting for action.Please uncheck elements you want to keep" shows in top line.. Click on the Cleaning box. Next click OK on the "Closing Programs" pop up box. Click OK on the Information box & again OK to allow the necessary reboot After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed... Next, Go here: https://www.zemana.com/Download download and install Zemana Anti-malware. Allow a shortcut to be saved to your Desktop.. The tool will be active with a 15 day trial.... Right click on Zemana Antimalware and select "Run as Administrator" From the GUI select "Settings" In the new window Select 1. Updates, when complete Select 2. Real Time Protection. In the next window make sure 1. all boxes are checkmarked and the action is "Quarantine" and then " 2. Select the home icon. In the new window select "Scan" When the scan completes check each found entry (if any). For "Suspicious Browser Settings" choose REPAIR for all other entries choose QUARANTINE then select the "Next" tab The action complete window will open, from there select the "Back" tab. That will take you back to the home screen... On that screen select the "Reports" tab. (Looks like 3 chimneys) On that screen select and highlite the scan details line, then select "Open Report" Copy and paste that log to your reply... Next, Download and Save McAfee Stinger to your Desktop from here: http://downloadcenter.mcafee.com/products/mcafee-avert/Stinger/stinger32.exe Read the Terms and Conditions, the download tab is at the bottom of the page. Close all browsers before starting. Disable your antivirus program and anti-malware, if any. To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs read here: http://www.bleepingcomputer.com/forums/topic114351.html On Windows 7, 8, 10 & Vista systems, Right Click on Stinger and select Run as Administrator. On XP, double-click to start it. Click on “I Accept” tab at McAfee end user licence agreement. In the new Window select “Advanced” then “Settings” The settings window will open, make sure the settings are exactly as shown in the following image, then select “Save” <<------Very Important In the new window Click the “Customize my Scan” under the “Scan” button. In the new Window select C:\ drive and any other listed Hard Drive, then select “Scan” When the scan completes select the “View log” to do that, select “Notepad” if offered in list of choices. If the log opens in your browser, copy and save to a file.... I will need a copy of that log. Let me see those logs in your reply, also give an update on any remaining issues or concerns... Thank you, Kevin...

 

 

Fixlist.txt

[samual]

# AdwCleaner v5.201 - Logfile created 18/07/2016 at 00:48:23
# Updated 30/06/2016 by ToolsLib
# Database : 2016-07-16.1 [Server]
# Operating system : Windows 10 Pro  (X64)
# Username : Samadhan - DESKTOP-EA9LJ94
# Running from : C:\Users\Samadhan\Desktop\AdwCleaner.exe
# Option : Clean
# Support : https://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLLs ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

[-] [C:\Users\Samadhan\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [1185 bytes] - [07/07/2016 21:30:26]
C:\AdwCleaner\AdwCleaner[C2].txt - [1031 bytes] - [18/07/2016 00:48:23]
C:\AdwCleaner\AdwCleaner[S1].txt - [1010 bytes] - [07/07/2016 21:29:10]
C:\AdwCleaner\AdwCleaner[S2].txt - [1155 bytes] - [18/07/2016 00:46:35]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1250 bytes] ##########
 

 

Zemana AntiMalware 2.21.2.139 (Installed)

-------------------------------------------------------
Scan Result            : Completed
Scan Date              : 2016-7-18
Operating System       : Windows 10 64-bit
Processor              : 4X Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
BIOS Mode              : Legacy
CUID                   : 1243F37E0A166E45065999
Scan Type              : Smart Scan
Duration               : 1m 14s
Scanned Objects        : 13837
Detected Objects       : 0
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Enabled
Detect All Extensions  : Disabled
Scan Documents         : Disabled
Domain Info            : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

There are no detected objects
 

 

McAfee Stinger Scan Results

 

---

McAfee® Labs Stinger™ Version 12.1.0.2057 built on Jul 15 2016 at 12:20:18
Copyright© 2015, McAfee, Inc. All Rights Reserved.

AV Engine version v5800.7501 for Windows.
Virus data file v1000.0 created on Jul 15, 2016
Ready to scan for 9828 viruses, trojans and variants.

Custom scan initiated on Monday, July 18, 2016 01:11:51


Rootkit scan result : Not Scanned.



Summary Report on C:
D:
E:
F:
G:
File(s)
	TotalFiles:............	225836
	Clean:.................	169770
	Not Scanned:........... 56066
	Possibly Infected:.....	0

Time: 01:01:03

Scan completed on Monday, July 18, 2016 02:12:54

[kevinf80]

Can i see the log from FRST fix....

[samual]

I will attach reports aftersometiime probably today,iam at work now....sorry

[kevinf80]

Thanks for the update, post the frst log whenever you`re ready. Also give an update on any remaining issues or concerns...

[samual]

attached

Fixlog.txt

can i know which is causing slowdown of internet

Edited July 18, 2016 by samual

[kevinf80]

Is your internet connection still slow?

 

[samual]

yes

 

[kevinf80]

Your logs are showing clean, that indicates that malware or infection is not at fault... Can you carry out a speed check, see what results are...

http://www.speedtest.net/

 

 

[samual]

i suspect webroot or ublock origin causing slowdown

[kevinf80]

What is uBlock? also why does webroot cause slowdown

[samual]

ublock origin is adblocker....i have both malwarebytes antiexploit and webroot installed....both programs have antiexploit function so i suspect....

[kevinf80]

Can you turn off Malwarebytes AntiExploit, open the program and select "stop protection"

Does that help?

[samual]

yes it helps...but what my logs are showing about my webroot.....i don't want to loose malwarebytes antiexploit

[kevinf80]

Can you turn off antiexploit in webroot, then turn back on in Malwarebytes antiexploit, Is that any better...

[samual]

thank you for help...you can close the thread

[kevinf80]

Yes of course, will close out after we clean up.. One other point that may be of interest to you at the following link:

https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/Malwarebytes-Anti-Exploit-and-WSA-compatibility/td-p/196305

To remove Sophos and Zemana use the following:

Download GeekUninstaller from here: http://www.geekuninstaller.com/download (Choose free version) Save Geek.zip to your Desktop. (Visit the Home page at that link for necessary information) Extract Geek Uninstaller and save to your Desktop. There is no need to install, the executable is portable and can also be run from a USB if required. Run the tool, the main GUI will populate with installed programs list, Left click on Program name to highlight that entry. Select Action from the Menu bar, then Uninstall from there follow the prompts. If Uninstall fails open the "Action" menu one more time and use "Force Removal" option Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!