[Daisky]

The problem started some time ago when I would be watching some video that was downloaded on my computer & I would connect or disconnect from the internet & the video/audio of what I am watching would stutter heavily(I think they call it lag)for some 10 seconds then it would stop.Now the problem has become worse.The video /audio would still stutter heavily when I connect/disconnect from the internet & also it would weakly stutter if I am connected to the internet.In other words if I want to watch some video (whether with VLC or windows media player)I would have to disconnect from the internet to watch it without stuttering.Also if I am watching something online (youtube or other)it would stutter so to watch it I have to leave it to load then disconnect from the internet & watch it then.also if I am surfing the internet & I move the mouse arrow from one point to the other it would also stop then continue moving several times in other words stutter.

I would like to add that I have 232 GB on my hard disk of which only 7 GB are free.Also yesterday when I turned on my compuer the clock & date were wrong(they were 2005 january 1) so I corrected it.Does somebody know why the clock & date were changed?Does those 2 things have anything to do with the problem?Lastly when I turn on the computer & the desktop screen comes up I have to wait for about 1 minute for the computer to respond.

[Flashorn]

Hey Daisky !

Your first problem could be related to your internet connection being to slow to load the YouTubes or Flash Player videos.

The second problem seems to be a overloaded Hard drive.If you can, move some of those files to an external hdd to
lessen the load on the hard drive when booting.

I would start with a Cleanup with CCleaner (just leave the default settings) . DO NOT use the Registry Cleaner even though
it might be safe enough. You already have enough on your plate without having to deal with a bad registry clean up.

Piriform.com : CCleaner

Next , scan your PC with MalwareBytes' :

Download
Latest Version
10.04MB

A full scan might the ideal scan. Update the definitions before scanning please.

Next , Defrag the HDD. I use Auslogic http://www.auslogics...efrag/download/

but, if you have a preference then use that one.

Once those steps done, please upload or paste the results of the scan on your next reply.

Try to follow those steps in order.


FLASHORN.

This post has been edited by Flashorn: 16 October 2012 - 11:20 AM

[Daisky]

I should add that every once in a while the Norton internet security program says that there is high CPU usage.

I dont think it is the speed of the internet because my internet speed is 4Mbps & the youtube & other clips would have fully loaded & I would watch them & they would still stutter.

This post has been edited by Daisky: 16 October 2012 - 12:08 PM

[rgreen4]

Daisky, on 16 October 2012 - 11:57 AM, said:

I should add that every once in a while the Norton internet security program says that there is high CPU usage.

I dont think it is the speed of the internet because my internet speed is 4Mbps & the youtube & other clips would have fully loaded & I would watch them & they would still stutter.

I would disable Norton's and see if that helps. Norton has always been noted as a resource hog. You have not posted the specs of your computer as to processor/memory etc. When Norton's in the past has reported high CPU usage, most of the usage was Norton's. Many of us quickly disable/dispose of Norton's on a new machine and download some of the better free Anit-Virus/Anti-Spyware. Years ago I fought with a Norton's install that came on a purchased PC. Finally I downloaded their removal tool and ripped it out. Virtually all of my problems went away. There are several free packages, I use Avast Anti-Virus and SuperAnti-Spyware. SAS will periodically offer a special where their Pro version is offered for a single reasonable lifetime subscription payment. The advantage is that it will then automatically scan your PC and update itself.

If you have room on your PC for a second HD, I would recommend a large HD be added as a data drive, for videos certainly eat up disk space.

[Daisky]

Hello Flashorn

I did the CClean & the full scan & here are the results:


Malwarebytes Anti-Malware (Trial) 1.65.0.1400
www.malwarebytes.org

Database version: v2012.10.17.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
User :: USER-PC [administrator]

Protection: Enabled

10/17/2012 9:11:30 PM
mbam-log-2012-10-17 (22-57-19).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 292336
Time elapsed: 1 hour(s), 35 minute(s), 59 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 2
C:\Users\User\Local Settings\Application Data\Bron.tok-9-11 (Worm.Brontok) -> No action taken.
C:\Users\User\Local Settings\Application Data\Bron.tok-9-12 (Worm.Brontok) -> No action taken.

Files Detected: 1
C:\Users\User\Music\Downloads\DFX_Audio_Enhancer_9.203\DFX_Audio_Enhancer_9.203.By.vibration\keygen\keygen.exe (Trojan.Dropper.PGen) -> No action taken.

(end)

I will do the defrag tomorrow.

[Flashorn]

Hey Daisky !

OK, well, you have been infected with a couple of nasty malware.

The first is probably from an email received and the latter one is
from a keygenerator downloaded from the internet to activate
DFX!!

Do not move or attempt to move any files from this HDD just yet. we will have to
eliminate those threats first. Do not defrag either.

First : go to the Control Panel. Open Folder Options. Click on the View tab at the
top.
Scroll down to where "Show Hidden files , folders or drives" is and click on the
radio button.
Scroll a little bit further down where you'll see "Hide protected operating system files (Recommended)
and untick the box.
Now, on the bottom right, click on the Apply button and then the OK button to close
that folder.

Second : Follow the path to where those files are inserted :

C:\Users\User\Local Settings\Application Data\Bron.tok-9-11
C:\Users\User\Local Settings\Application Data\Bron.tok-9-12

and Delete both of them. If you can't, follow the rest of this post.

Third :"Boot in Safe Mode with Internet" and download ,install and run a full scan
with this scanner :

http://www.superanti...cannerhome.html

When finished PLEASE, Delete what it has found. You can also paste the results
in your next reply.

Fourth : Run MalwareBytes' once more in "Regular Mode" and Please Delete what
it finds if any malware is detected.

IF this doesn't get rid of it (as this nasty is self replicating) we will try something a
little more powerful for our next scan.

Do not undo the changes to the Folder Options just yet. We will change those once
we are finished.

As was stated by my colleague RGreen, Norton is not as good as it want's us to believe.



FLASHORN.

[Daisky]

Flashorn
I have many TV series episodes & movies & comics & I have burned most of them on DVDs does that mean that those DVDs are infected by the malware & I can't use them again I can't watch them from the DVDs?If the DVDS are infected isn't there a way to remov the malware from the DVD?

Also I removed those malware by the MalwareBytes program ,doesn't that work?

I went to control panel but I didn't find folder options.I have windows Vista.

This post has been edited by Daisky: 18 October 2012 - 07:56 AM

[Daisky]

I found folder options & did what you said & followed the path to where the files are inserted but couldn't delete them.It said "Access is Denied" to the file user/local settings.So I continued & booted on "Safe mood With Networking"(I have it networking not internet)But couldn't connect to the internet it said"Internet ADSL cannot be found"I tried it several times & I can connect to the internet when running windows normally but not in Safe mood with Networking.The network icon in the lower right corner used to have a check on it when I connected to the internet but some time ago it began to put a cross over it whether I am connected to the internet or not.Can I download the superanti spyware while running in windows normally?

[Flashorn]

Hey Daisky!

Good that you found Folder Options on your own. I was quite busy today so, I couldn't get back here any sooner.

Now, for those files, I would suggest you download and install this little app called LockHunter. This should help
with unlocking whatever processes are holding it back.

Size: ~1.5 MB, OS: Windows 2000, XP, 2003, Vista, 7

• Download LockHunter 32 bit right now!
• Download LockHunter 64 bit right now!

Please choose the Right one for your OS. Either 32 or 64 bit.

After installation, you will have a Right Click Context Menu entry like the one in the screen shot.;




Go back to those files and Right Click on them one at a time. In the Context Menu, choose the entry as in the screen shot.
Click on that entry. you will get a prompt from UAC asking to Allow this .exe. Click on either Continue or Yes.

The app will appear and you will have a few options to play with. I would choose to Unlock then Delete.

OK, After you are done with unlocking those files, download SuperAntiSpyware and install it. It might ask IF you want to
buy the Full version. Please decline the offer as we do not need it.
Next, go to "Preferences"



Make sure to check mark as in this screen shot :




Now, do a full scan of your PC. Be patient, this one will take it's sweet time.

Pleas post or paste the scan for the last scan of MalwareBytes' and the current one from SUPERAntiSpyware
in your next reply.

As for those DVDs, IF you will be playing them on a DVD or BluRay player intended for the TV, there should be no problems.
IF you intend to watch them from your PC's DVD player then I would suggest you scan them by Right Clicking on the DVD
player Before it starts to load and play whatever is on that DVD. You will have the option of choosing from either
Norton or MalwarBytes' . I would choose MalwareBytes'. If nothing is found then, you should be good to go.
You should stop the "Auto Play" option, this way nothing will start by itself when loaded either in a USB stick or from a DVD.

Click on Control Panel. When opened, choose AutoPlay :




Untick the box at the top left :




This is the safest way of playing anything from your USB or DVD player.

You will have to choose what opens what by going to Control Panel and Default Programs.



From there you simply
choose which program opens certain file extensions like an AVI file should open with Windows Media Player or the
one you have installed to replace WMP.

Get back to me with those scan logs please.



FLASHORN.

[Daisky]

I was able to find Folder Options because I typed it in the search in control panel & it appeared.In wikipedia it says that Brontok malware hides the option of folder options to make it hard for the user to delete it.

I freed some 40GB of space on my Hard Disk.

I downloaded LockHunter & installed it & I went to those folders(User/Local settings) & right clicked on them & choose "what is locking this folder" & the prompt told me "No processes locking this file or folder have been found".I tried to axcess it again but it told me "axcess denied".That must be one hell of a malware.

How about I use this program?It is listed in wikipedia for brontok:
http://www.sophos.co...on/brontok.html

What about the maleware in the DFX audio enhancer: C:\Users\User\Music\Downloads\DFX_Audio_Enhancer_9.203\DFX_Audio_Enhancer_9.203.By.vibration\keygen\keygen.exe (Trojan.Dropper.PGen)

If I find a DVD which is infected what can I do?Can MalwareBytes delete it from the DVD?

I accidentally discovered why the screen is stuttering when I watch video while connected to the internet.The utorrent would be on (Although I wouldn't be downloading anything on utorrent)& when I exited utorrent the stuttering stopped.But that didn't happen before (it seems it began when I downloaded the new version of utorrent).The heavy stutterng still occurs when I connect/disconnect from the internet.There is some numbers in the lower registry in utorrent window that keep on counting even when I am not downloading/uploading anything.Here is this registry:
DHT:184 nodes (updating) D:0.8kB/s T:86.7 kB U:0.1kB/s T:74.6kB

This post has been edited by Daisky: 19 October 2012 - 08:03 AM

[Flashorn]

Hey Daisky !

Well, I still am waiting on those scan logs like the one you pasted already. Those logs will tell me if anything was done with those
infected files.So, please paste both logs from both of the antimalware programs I asked you to install.

I am not authorized to discuss any Torrent client on this forum sorry, but having a Torrent client opened and trying to view any Flash
video other than in the lowest resolution will most of the time result in what you are seeing. Your download speed is not fast enough
to provide a better quality of video. I have a 50 MB/s line and even that will still sometimes result in lag time on YouTube.

You could use that Sophos RootKit detector but I rather you use the one I have in mind amongst others that I would like you to try
before any others.

If I could have you paste those logs, It would give me a better idea on which one to use next.

If you Disable the AutoPlay in Control Panel and have MalwareBytes' scan those DVDs by Right clicking on the DVD player in your PC
and choosing the MalwareBytes' entry in the context menu before you play them then, yes it will detect and remove the malware.

You said that you have freed the HDD of some 40GB of files. Where did you store those files and did you scan those files before removing
them from their original place.

IF it comes to it. do you have any way of restoring your PC to it's original condition? Meaning , do you have the Restore Discs?
Sometimes, replicating malware is only deleted by formatting the HDD.

But before we get there, I still need those logs please.



FLASHORN.

[LiveBrianD]

In my experience, torrent clients tend to hog all the bandwidth available unless you force them to limit it.

This post has been edited by LiveBrianD: 19 October 2012 - 08:56 AM

[Daisky]

I will paste the logs as soon as possible.

I had already burned those files on DVDs before I knew that I had malware so now I deleted them because I have them on discs.

As for the restore discs I don't know what they are.can you expalin?

[Flashorn]

Hey Daisky!

Restore Discs are the DVDs that you have to burn to Re-Install your OS
UNLESS the PC came with a set of OEM Discs from the vendor (HP, Sony Toshiba, Asus, Dell...)

Nowadays, there is a partition on the main drive (sometimes a Hidden Partition) from where you can
burn your own set of discs to Re-Install the OS to when you first opened the PC and had to write in your
name and the name of the PC you wanted the PC to have.
This will effectively Wipe or Format the whole Disk and you will have to start from scratch just like
when you first bought the PC and brought it home.

Do you have those??
OR
Did you burn them??


FLASHORN.

[Daisky]

I bought my computer from a shop which they themselves installed Windows Vista & Norton & they gave me those Discs(ofcourse now I ahve the norton disc of this year).also I have a disc for the screen & I think one for the keyboard.

I downloaded the superantispyware(without safe mode with networking since I told you that I couldn't connect to the internet with that mode) & I installed it.It told me to choose between an exprees or custom & I choose the express & it told me if I wanted a free trial & I declined & then it downloaded updates then again it said it had to download updates & I clicked yes but the window showed no updates so I closed it.The choices you posted for me in the screen shot were already ticked & I unticked the choices which weren't ticked in the screen shot & now I am doing the full scan.Is that correct?

To be sure ,if the malware was on the discs I burned would the malwarebytes remove them like you explained(through scaning them & then clicking on remove)

This post has been edited by Daisky: 19 October 2012 - 10:01 AM

[Daisky]

I did a complete scan with SuperAntiSpyware & this is the log(It only took 48 minutes is there something wrong with that?)
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/19/2012 at 09:10 PM

Application Version : 5.5.1016

Core Rules Database Version : 9438
Trace Rules Database Version: 7250

Scan type : Complete Scan
Total Scan Time : 00:48:41

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)

Memory items scanned : 642
Memory threats detected : 0
Registry items scanned : 38172
Registry threats detected : 0
File items scanned : 40108
File threats detected : 1

Adware.Tracking Cookie
ia.media-imdb.com [ C:\USERS\USER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SHGVNS3J ]


The MalwareBytes took an hour & a half & scaned some 200 thousand items.Is there soemthing wrong or I should do a critical point scan instead of a complete scan?

I am now doing the malewareBytes full scan

[Daisky]

This is the log of MalwareBytes.I noticed that it jumped from 150 thousand items to 290 thousand items & it took less this time thatn before.

Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.10.18.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
User :: USER-PC [administrator]

Protection: Enabled

10/19/2012 9:20:01 PM
mbam-log-2012-10-19 (21-20-01).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 298231
Time elapsed: 1 hour(s), 9 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[Flashorn]

Hey Daisky!

Yes, more files because we (you) opened up those Hidden files.
Less time because nothing was detected, But doesn't mean all
are gone.

OK, before we go ahead and scan for that Rootkit that Might
still be lurking around, I would suggest you download and keep
in a safe place (like the Desktop) this .exe file that we will be using
latter on.

TDSSKiller.exe

There is no install for this .exe . Simply Right Click and Run as Administrator.

For now however, I would like you to boot in Safe Mode (only)
and go back to those files that you could not delete in Regular
mode. Try the LockHunter again to delete those files IF they are
still there.

Once you have tried and either succeded or failed to delete those files,
Right click on the TDSSKiller .exe and run it. Here how it works:
(It can be run in either Safe or regular mode)

On the front GUI, you will see in Blue (like a link) Change Parameters.



Click on it and a pop-up will appear. Check mark both of the Bottom boxes
and close the pop-up.

Click on the Scan Now button and wait till it finishes (about 30 to 40 seconds)
When it's done scanning, the front GUI will change (but same size) with a report
of what it has found. Don't be alarmed if it comes back with Lots of entries. It's
normal for the kind of scan I'm having you do.



IF all of the entries have a "Skip" next to them then, do not do anything else. (like the screen shot above)

IF some of them (scroll down) do have a Delete next to them then, change them by clicking on the little Arrow in the White box
to "Skip" and click on the Continue button on the bottom left.



Now, you will see a Report button on the upper right corner. Click on it and a notepad (sorta) will appear.
Please expand to full view by clicking on the little square next to the Red X

Could you please copy and paste that report in your next reply. I know it's long but, I have to ascertain which files
were detected and targeted for removal.

This could take me a while

Quote

The MalwareBytes took an hour & a half & scaned some 200 thousand items.Is there soemthing wrong or I should do a critical point scan instead of a complete scan?

No, it's Ok the way it is thanks.


FLASHORN.

This post has been edited by Flashorn: 19 October 2012 - 12:14 PM

[Daisky]

I tried to enter the User/Local settings in safe mode by the LockHunter but it told me:"Error while scanning for processes:Cannot start service.OsError:1084 - this service cannot be started in Safe Mode."Then I tried the TDSSKiller.exe in safe mode when I right clicked and ran as administrator it told me that"can't initialize log " so I clicked on ok it & it said "can't load driver" so I clicked ok & continued as you said & there was nothing in the report it was a complete blank.I returned to regular windows & when I connected to the internet norton told me that the spyware & antivirus are off so I clicked on norton & it was saying that it is trying to fix the problem but nothing changed so I uninstalled norton & re-installed it again & from what I can tell it is working so I did a full system scan with norton & found nothing.why did norton do that I freaked out.

This post has been edited by Daisky: 19 October 2012 - 03:46 PM

[Flashorn]

Hey Daisky !

OK, well then, scan with TDSSKiller in Normal mode and post that log please.

If it's not too much trouble (just trying to be nice here) before you run TDSSKiller
delete the one you have and download a fresh copy. Please make sure it's downloaded to your Desktop.
Next, Exit the internet by disconnecting the RJ45 wire to the PC from the modem or router
and then, Disable Norton by Right clicking on the Taskbar icon (near the clock) and choose to Disable.

Now, try running TDSSKiller once more in Normal mode. Please post the log or report from TDSSKiller.

Don't forget to Re-Enable Norton after the scan and Before you re-connect to the internet.

I'll have one more scanner to have you download if we can't get TDSSKiller
to work properly.

I have no idea why Norton would behave that way. maybe one of the files in
TDSSKiller was interfering with Norton's. But, the more likely scenario would be
that LockHunter was trying to access some files that are locked by Norton.
Could you verify that Norton's Quarantine Vault doesn't already contain
these files please.

Could you also check the Task Manager by right clicking on the Task bar (any where) and from the menu,choose
Task Manager. When it comes up, check mark the empty box on the bottom left of Task Manager.
On the Top Left of the Task manager, you'll see a Tab named Processes. Click on it. Now, click on the Name
button right below the row of the Processes. This will rearrange the processes by alphabetical order and
much easier to read.

Take a good look at it and try to see if there are any Processes that you do not recognize or that
are taking Way too much CPU usage and memory usage. If you do, please take down the name
of that or those Processes and post it in your next reply along with the log from the scan.



FLASHORN.