Desktop computer compromised, running slow, not updating. Please can you help?

closed

the instructions are for a manual cleanup

uninstalls and msconfig are very straightforward, and can be done before backup

yes


5 minutes work:

uninstall superantispyware, pctools firewall, windows defender


__________________________________________________


Install and run startuplite, accept suggested changes - http://www.malwarebytes.org/StartUpLite.exe

__________________________________________________

Unless you need them running all the time, use the startup tab in msconfig (start, run, msconfig )to disable these items from running at startup (they can always be run manually if needed). When you reboot after doing this, you will get a prompt about selective startup - tick Don't show this message or launch the system configuration utility when windows starts,and click ok

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task]

forum bug cuts the rest off

redmandarin

Thanks a lot, that's great!

If I uninstall pctools firewall, should I then reinstall it, or is there an alternative firewall I should use?

And is it best to uninstall or just disable windows defender - is it surplus to requirements?

Thanks

closed

uninstalling should enable windows firewall instead.

uninstall defender

redmandarin

Update:

I've uninstalled defender & pctools as advised, and windows firewall is running.

Avast wanted to update, but despite several attempts, it failed to do so. So I did a manual quick scan.

It found 1 threat
File name
C:\1386 XXXXXXXXXXXXX archive\Program Files\sophos\AutoUpdate\Cache\savxp\configure.exe

Status
Win 32 malware-gen


Avast then recommended a pre-windows scan, which I agreed to.

It found 7 corrupted archive files (my partner's old work files, which he no longer needs).

It also stated:

File C:\System Volume Information\-restore [followed by several series of numbers and letters] is infected by Win 32: malware-gen

I am now offered 8 keyboard command options:

1 Delete, 2 Delete All, 3 Move to Chest, 4 Repair, 5 Repair All, 6 Ignore, 7 Ignore All, 8 Exit

Obviously I'm not going to keep them! So please can you advise what to do next?

closed

meandering slightly, no need to scan with avast if it's running.

turn system restore off, then back on in control panel, system

that should empty everything under C:\System Volume Information\-restore

has it had sophos antivirus on at some point, just let avast deal with the sophos file, it's probably a false positive

--

finish as many of the rest of the tweaking steps as you can, and worry about avast update later, if it hasn't fixed itself.

when finished post another hijackthis log and commit charge after a reboot

redmandarin

Thanks,

Sorry, as Avast hadn't updated for a while (owing to the house move) I thought that the lack of updates may have meant that something nasty could have got though when I switched the machine on again, which is why I did a manual scan.

When you say "turn system restore off", is that assuming I have switched on a system restore? I haven't.

Sorry, I can't remember if there's been a sophos virus in the past.

Shall switch off the Avast scan by selecting keyboard option 8 to escape?

closed

its normally on by default, and the reason you have the system vol information directory .. so just turn off, then ok, then turn it back on, and stop worrying about viruses - if anything bad was running, avast would pick it up at the time, so manual scans aren't needed.

suggest you carry on with the cleanup, and then you can scan if you want.

redmandarin

Ahh, I see! I'm not worrying, I know I'm in capable hands here!

redmandarin

Hi, I've got a problem with IE8, please help?

When I click on IE8 or 1E8 updates, I get this message:


This add-on can cause Internet Explorer to stop responding or crash

The 'Drive Letter Access Component' add-on version 1.0.0.1 published by (Not verified) Sonic Solutions is not compatible with Internet Explorer 8

*Check online for update
IE will help you install a newer version if available

*Always open IE without this add-on
IE will disable only this add-on

*Allow Internet Explorer to load this incompatible add-on

closed

disable the addon

it's mentioned in my earlier post


O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -

and is also an addon that prompts the mse posting bug, which is why the end of the previous line is truncated

--

any progress tidying the machine up yet?