Considerable slow pc after malware removal

[Sandyy23]

my pc has become slow considerably after removing malwares recently

there was rogue av called net protector total security in pc,in presence of that my pc was still infected

i installed malwarebytes ,removed bunch of malwares still pc remains slow like browser responds slowly ,when opened new tab crashes immediately

win 10 system sometimes open slowly...any malware remaining in my pc ,help us

[Sandyy23]

logs attached below

Addition.txt FRST.txt

[Maurice Naggar]

Hi @sandyy23  

I will guide you.  I would suggest that you do this next scan. This is a known respected tool. It will scan for viruses as well as for potentially unwanted applications. ( P U A or P U P ).

I would suggest a free scan with the ESET Online Scanner. This will be another check for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"

Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.

 

When presented with the initial ESET options, click on "Computer Scan".

 

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

 

Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.

 

You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else.

 

When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.

 

Click The blue “Save scan log” to save the log.

 

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom).

 

Press Continue when all done.

You should decline the offer for “periodic scanning”. ( if offered

 

Please make sure you attach the log report.   

[Sandyy23]

its taking forever to scan more than ~2hours now

[Sandyy23]

scan result

 

scanlog_073933.txt

[Maurice Naggar]

Thank you. This Windows pc has Webroot SecureAnywhere as the resident security application. Have you run a scan with it in the past 1 or 2 days ? If so, what has it reported ?

[Sandyy23]

no threats were detected, but pc has slown down

 

[Maurice Naggar]

Hello. This next part needs to be done when you can stop what you are doing on computer & allow it to run this custom script. It hopefully should be under one hour.  

Next, a custom script to do  checks & some  cleanups. 

We will use FRST64.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Sandyy23  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.   It will run the Windows DISM tool to check the system.  It will rebuild the Winsock.   

NOTE-2: As part of this fix it will remove two "debugger set points". It will remove 1 auto-start silent startup of Microsoft Edge.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   user Downloads  folder         

Fixlist.txt                         <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  This here is not a one-shot-cure-all.  There will be more to do later.  Stick with me.

[Sandyy23]

would you please recover vatech related file as my xray software is not working (i know it's not signed but this is how company person installed)

[Sandyy23]

fixlog

Fixlog_012302.txt

[Sandyy23]

tool doesn't restart my pc, i have to restart on my own,guess if this is normal

but please recover vatech xray software,it's essential

[Sandyy23]

ok i followed https://www.vatecheurope.com/faq/ezdent-i/file-server-does-not-work-please-check-file-server & it seems software again started

what i need to follow now(thanks for your great help)

[Maurice Naggar]

Hi. Are you indicating that now that VTFileManager32 by VATECH  is ok ?
The reason there had been no "reboot / restart" is that the run took more than 1 hour & so was timed-out. It exceeded the 1 hour limit & so was ended. How is the situation at this point ?

[Sandyy23]

pc running considerably faster ...

 

regarding VTFileManager32 from vatech

before fixlist you provided, there was `VTFileManager32` which is starting as soon as windows starts but now after applying fixlist, `VTFileManager32` doesn't start with windows startup, i have to manually start this....would you please recover previous behaviour?

[Maurice Naggar]

Yes, I will need to first get a folder from your system & send it to me as a ZIP 'ped file.Can you please zip the whole folder & its contents C:\FRST\Quarantine folder and attach for me so that I can then make a plan to get that back. Right-click the folder & select Send to Compressed. it will make a zip file in that samne folder. That is what I need. Thise will require a 2nd follow-up step later.

[Sandyy23]

This is all you need

Quarantine.rar

[Maurice Naggar]

Hello. Thank you for the quarantine file. This next part will restote the VTFileManager32 to the Windows tasks. This should be run when you are not using the computer foir other applications. That is to say, save any open work & exit your apps. This run needs to run solo. It will do the one thing & then Restart Windows.

First, delete the old file "Fixlist.txt"  that is now on Downloads folder.

We will use FRST64.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Sandyy23  only / for this machine only.

This is a one time run to restote to tasks the task for VTFilemanager32 from quarantine.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   user Downloads  folder         

  Fixlist.txt                     <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

You will see a green progress bar start.   When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity. 

[Sandyy23]

i ran fix ,restared the computer but i don't see fixlog created in directory where frst is located😑

is there any virus left in my pc?

if not ,i will mark your help as satisfactory ,thanks

[Maurice Naggar]

Hello.  So the last script ran and finished. To answer your question, we should run a couple of different scans. First, start wuth a quick scan with Webroot SecureAnywhere & let me know the result.
Second, run a scan with Malwarebytes for Windows. Let me know the results.

[Sandyy23]

its's all clean, i will mark this as fixed, satisfactory,thanks

[Maurice Naggar]

Hello.  That is very good to know.

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• You may attach that file to your next reply. (not compulsory)

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you