Solved Slow Infected PC; ran JRT and ADW from safe mode

[webgal318]

Browser keeps crashing and PC still very slow. I couldn't do anything unless I was in safe mode. Initially, the icons on desktop were almost completely gone. System is 7 Premium, 3 GB RAM, AMD processor. Thanks for getting me started on getting out of this nightmare.

 

[Jacee]

Let's start with a scan using DDS. See if you can get into 'safe mode with networking' :

Download DDS from one of these links:
DDS.com

DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.

The scan will instruct you to post Attach.txt as an attachment.

 

[webgal318]

DDS files attached

Thank you.

 

[Jacee]

You have an awful lot of Toshiba stuff running at start up!! :shock:

Can you post (copy and paste) both logs from JRT and AdwCleaner for me to see, please?

 

[webgal318]

Results of ADW and JRT

Again, thanks for looking at this. I just reran the JRT and ADW and results are below.

# AdwCleaner v4.206 - Logfile created 17/06/2015 at 14:29:32
# Updated 01/06/2015 by Xplode
# Database : 2015-05-31.5 [Local]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Helen - HELEN-PC
# Running from : C:\Users\Helen\Downloads\adwcleaner_4.206.exe
# Option : Cleaning
***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****
-\\ Internet Explorer v11.0.9600.17840

*************************
AdwCleaner[R0].txt - [2477 bytes] - [23/08/2014 11:34:45]
AdwCleaner[R1].txt - [1211 bytes] - [12/06/2015 12:20:12]
AdwCleaner[R2].txt - [952 bytes] - [17/06/2015 14:14:25]
AdwCleaner[R3].txt - [1068 bytes] - [17/06/2015 14:24:27]
AdwCleaner[S0].txt - [2537 bytes] - [23/08/2014 11:36:33]
AdwCleaner[S1].txt - [1287 bytes] - [12/06/2015 12:22:12]
AdwCleaner[S2].txt - [1015 bytes] - [17/06/2015 14:16:05]
AdwCleaner[S3].txt - [995 bytes] - [17/06/2015 14:29:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1053 bytes] ##########

Junkware Removal Tool (JRT) by Thisisu
Version: 7.0.1 (06.17.2015:2)
OS: Windows 7 Home Premium x64
Ran by Helen on Wed 06/17/2015 at 14:06:11.14
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


~~~ Services

~~~ Tasks

~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-582187217-3476062213-3091020903-1000\Software\Microsoft\Internet Explorer\Main\\Start Page

~~~ Registry Keys

~~~ Files

~~~ Folders


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 06/17/2015 at 14:11:50.07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Neither of these files shows anything that I can see.
BTW, when I restarted the PC, I was informed that Microsoft had installed updates.

 

[Jacee]

Did your computer start acting slow after you installed Bitdefender?

 

[webgal318]

Bit Defender?

I don't know. Helen called a tech for some unknown reason when I was out of town and he installed it. Hard to say.

 

[Jacee]

Download Microsoft Security Essentials (it's free) Download Microsoft Security Essentials from Official Microsoft Download Center

When downloading "save" the program to your desktop, or 'downloads' .... don't select to run it yet.

Next, download Bitdefender uninstall tool: BitDefender Uninstall Tool Download
Save it .... now, right click on the uninstall tool and choose to run as Administrator.

When finished uninstalling, right click on Microsoft Security Essentials to run as Administrator. MSE will need to update it's antivirus definitions.

When it's finished installing and you've scanned for viruses, let me know if anything was found and if the computer is running faster now.

 

[webgal318]

MSE installed -- PC still kind of slow

MSE found nothing after a complete scan. Did you see any processes at start up that would improve the performance if I disabled them? The other thing I was wondering about was adding 1GB of memory. Would than make a noticeable difference?

 

[Jacee]

Right click to run an elevated 'command prompt' ... choose to run as Administrator.

Copy/paste sfc /scannow and push the 'enter' key.

Tell me if there are any corrupted files reported.

 

[webgal318]

Corrupted files reported after sfc/scannow

Yes, corrupt files were found but Windows Resource Protection unable to repair.

 

[webgal318]

Corrupted files

I copied and pasted the results of the Sfcdetails.txt file but I have only included the results of damaged files that cannot be repaired.

Part 2 of this message seems to show that the files in question were repaired.

I am looking forward to your response.

2015-06-22 06:57:53, Info CSI 000001bb [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 06:57:54, Info CSI 000001bd [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 06:57:55, Info CSI 000001bf [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 06:57:55, Info CSI 000001c0 [SR] This component was referenced by [l:162{81}]"Package_250_for_KB3068708~31bf3856ad364e35~amd64~~6.1.1.0.3068708-814_neutral_GDR"
2015-06-22 06:57:55, Info CSI 000001c2 [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 06:57:55, Info CSI 000001c3 [SR] This component was referenced by [l:162{81}]"Package_250_for_KB3068708~31bf3856ad364e35~amd64~~6.1.1.0.3068708-814_neutral_GDR"

• Part two: files that were repaired

2015-06-22 07:06:01, Info CSI 00000353 [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 07:06:01, Info CSI 00000355 [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 07:06:01, Info CSI 00000357 [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 07:06:01, Info CSI 00000358 [SR] This component was referenced by [l:162{81}]"Package_250_for_KB3068708~31bf3856ad364e35~amd64~~6.1.1.0.3068708-814_neutral_GDR"
2015-06-22 07:06:01, Info CSI 0000035a [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-06-22 07:06:01, Info CSI 0000035b [SR] This component was referenced by [l:162{81}]"Package_250_for_KB3068708~31bf3856ad364e35~amd64~~6.1.1.0.3068708-814_neutral_GDR"
2015-06-22 07:06:01, Info CSI 0000035e [SR] Repair complete
2015-06-22 07:06:01, Info CSI 0000035f [SR] Committing transaction
2015-06-22 07:06:02, Info CSI 00000363 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired

 

[Jacee]

Let me ask for more help on this (corrupted files)..... stay with us!

 

[Arc]

The PC is infected. And after dealing with the infection, there are a lot of corrupted files.

A clean reinstall will be the right for you.

http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html
​

Backup any necessary data, and do a clean reinstall.

 

[NoelDP]

The 'corrupted' files are to be expected - these are the result of a coding error by MS, and supposedly don't matter.

The errant update is KB3068708 - you can either ignore the 'errors' and MS will eventually get around to fixing them, or you can uninstall th update and hide it to prevent it reinstalling. When MS produce a fixed update it will then install in the normal way.

 

[ICIT2LOL]

Can I respectfully suggest the OP run this? How to record Kaspersky Rescue Disk 10 to a USB device and boot a computer from it have found it good on account of it being bootable and doesn't involve Windows.

From my experience with Toshiba you can get rid of all the bloat of which there is a mile of it but even with a clean install some will return with Windows updates - don't ask me why but it does.

 

[cottonball]

This issue is not new.

If you wish to get rid of it, please do the following:
Open the Control Panel and click on Programs and Features.

When open, click View Installed Updates in the upper left portion of the page.
Click on it and see if you have KB3022345 Windows Update installed.
WUs are listed in numerical order.<<---Looked too fast, they are not! Sorry!

If you find it, right click on it and uninstall it.

Here is more info with a different approach. It also shows some examples:
The Tech Cookbook – Windows 7 update (KB3022345) causing corrupt files

 

[cottonball]

BTW, KB3022345 telemetry.ASM-WindowsDefault.json and utc.app.json also show for KB3068708.
They the same issues!

 

[ICIT2LOL]

Cottonball I was excited to see the instruction you posted because I have always fouind looking for certain updates very tedious and usually end up system restoring to find a culprit.

When open, click View Installed Updates in the upper left portion of the page.
Click on it and see if you have KB3022345 Windows Update installed.
WUs are listed in numerical order.

But I tried this and they are all over the hogshop?? - is there any way of getting them into numerical order then??

Sorry webgal a bit OT

 

[NoelDP]

Simply use the Search box in the top right of the window, and enter the full KB number (KBxxxxxxx) - it finds it for you