Solved laptop slower since MSE found a potential threat (and didn't deal??)

[ajaye]

Last night I ran a Microsoft Security Essentials full scan on my laptop. It found something it called potentially dangerous software. (I didn’t write down what it found, but remember the words Trojan and win.) I pressed the button to clear it and that process started but stalled about three quarters of the way through. I waited for a good hour but it didn’t get past that stalled point so I downloaded and ran the free Malwarebytes Anti-Malware - it didn’t find anything in its scan. I then ran an MSE quick scan and it didn’t find anything then either (I didn’t have enough time to do another full scan, which had taken a few hours).

Since this happened my laptop is markedly slower to start up. It takes a couple of minutes for the desktop items to appear and it never used to. Once everything does actually come up it seems to work the same as usual.

I’m running another MSE full scan this morning but it will take a few hours, so I thought I’d post here now in case there’s some things I should be doing instead/in the meantime.

A couple of times during the MSE second, quick scan last night, and today’s scan, I’ve noticed a little MSE box come up (for only a couple of seconds) with a green tick saying detected threats are being cleaned.

Thanks in anticipation

 

[Layback Bear]

Here is a scanner I use with good results and it's free. It will take some time to do the scan.

Free Virus Scan | ESET Online Scanner | ESET

 

[ajaye]

Thanks L Bear. Should I stop the current MSE full scan or wait for that to finish?

 

[Layback Bear]

Just let MSE complete.

Here is a picture of how I do my settings with Eset online scanner.

I'm no security expert but this has always worked for me.

 

[ajaye]

I stopped the MSE scan yesterday to go to work. Started it again when I got home and it took six hours to do the full scan (is that normal?) It found the same threat again so I took a screen shot. I left the laptop on overnight and the removal process is now about 70% through (computer kept going to sleep, I woke up to wake it up occasionally). I'll let it continue, see what happens and will report back.

 

[ajaye]

MSE finally finished removing the threat. But I don't know that it has removed the threat. It says it was successful but also that an error was encountered ... ??? I've included a screenshot of that.

I restarted the computer and it is still unusually slow to get up. When the empty desktop appears if I click on MSE it says real time protection is not turned on. I've included a screenshot of that.

After four minutes the desktop items came up and the real time protection turned itself on. I've included a screenshot of that too.

As I now have the name and location of the threat (see Post 6) is there a more appropriate way to deal with it or should I try running one of the scans recommended above?

As I'm typing the little window I've never seen before this episode popped up so I've taken a screenshot and included it as well.

 

[Layback Bear]

Their are some reports that (win32/dyanmer!ac) is a false positive and many more say it's a real Rootkit.

From Microsoft.

https://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Dynamer!ac

Did you or did you not run Eset Online Scan? If you did what was the results.

When you ran Malwarebyte Anti Malware did you have rootkit selected.

 

[ajaye]

No I haven't yet run Eset, each step is taking so long. (and I've got super slow internet as well.)

Just checked and no, scan for rootkits was not selected in Malwarebytes. I've now selected it and am running that scan again.

Will try Eset if that doesn't work.

Thanks again

 

[Layback Bear]

Your scans will only run as fast as you hardware will allow.
If you have a slower computer the scans will run slower.

MSE and Eset will always take a long time.

 

[Golden]

What is d:\preload\base.wim?

Looks to he HP-related? I suspect a false positive. Navigate to the folder MSE is having an issue with and determine the legitimacy of the files.

If they are legitimate system files, than the HP OEM software that starts as part of the system may have been buggered by MSE causing your slow performance issues.

 

[ajaye]

Thanks Golden

What is d:\preload\base.wim? I have no idea :shock:

Looks to he HP-related? I suspect a false positive. Navigate to the folder MSE is having an issue with and determine the legitimacy of the files. ok will do that tonight, after work

If they are legitimate system files, than the HP OEM software that starts as part of the system may have been buggered by MSE causing your slow performance issues. oh, you mean when MSE tried to remove the threat?

I'll be back.

 

[ajaye]

Malwarebytes didn't find any threats and I did tick scan for rootkits.

I can't find d:\preload\base.wim, only Recovery D: -

 

[Golden]

Make sure Windows Explorer is configured to enable viewing of Hidden Files - I suspect its not.

http://www.sevenforums.com/tutorials/394-hidden-files-folders-show-hide.html

 

[ajaye]

Yes Golden you're right, viewing of hidden files was not enabled. I changed it via Control Panel but it hasn't made any difference, Recovery D: details are the same as the screenshot in Post 12.

 

[ajaye]

Should I try to run ESET?

 

[Golden]

Leave ESET to run overnight, but I don't think it will find anything.

Browse into D:\Recovery - what is in there?

 

[ajaye]

I've got really really slow (satellite) internet and am thinking an online scan would be problematic??

I'm running MSE again and it's currently running through D: drive and there are oodles of preload\base.wim files. It hasn't yet got to the dodgy one again, if it's still there.

This is all I get when I open the Recovery folder -

 

[Golden]

In all honesty, I'm convinced it's a false positive since the file path that MSE displays clearly points to the HP recovery partition. MSE only scans it because it has a drive letter associated with it...normally these types of partitions do not have a drive letter and normally they don't need one.

A .wim file is a Windows Imaging format file, used to perform system recovery.

 

[ajaye]

That sounds fine to me Golden. Would there be a reason MSE hasn't come up with it before, on previous scans?

Any ideas on how I can get my laptop back to starting as it used to? It's still taking four minutes to get up and going with icons on the desktop etc.

 

[Golden]

Honestly, I can't say why it has only happened now...perhaps new definitions are too agressive.

To attempt to repair the issues, try this :
1. Click Start

2. In the search box, type cmd
3. In the list that appears, right-click on cmd.exe and choose Run as administrator
4. In the command window that opens, type sfc /scannow and hit enter.

Report the output from the command window once it finishes.

More detail: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html