Author Topic: [InActive - K] Trojan, memory high no programs open and games unplayable  (Read 2954 times)

Offline Beavecoon

  • Bronze Member
  • Posts: 8
So I have had probably some of the most disappointing moments in my life to date, heres the rundown.

1. Norton (first mistake was buying Norton) picks up a trojan file on my laptop, I instantly delete it so I have no idea what kind

2. Steam games such as counter strike freeze up on launch and memory will randomly be between 20-40%

3. I try everything from running anti-malware-bytes to ccleaner, BIOS updates, graphics driver updates, refreshing (removing everything but personal files), Restoring the computer to factory settings, and many other methods.

Note: I was on windows 8.1 when I got the thing but because of the restart I am back to 8.0

here is the DDS, hopefully you guys can help, thanks!

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16482
Run by finelbell at 18:50:52 on 2015-05-20
Microsoft Windows 8  6.2.9200.0.1252.1.1033.18.8104.5016 [GMT -7:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\system32\dwm.exe
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\WLANExt.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\WINDOWS\system32\nvvsvc.exe
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
C:\windows\SysWOW64\NLSSRV32.EXE
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\WINDOWS\system32\dashost.exe
C:\WINDOWS\system32\taskhostex.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\taskhost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe
C:\Windows\RTFTrack.exe
C:\Windows\SysWOW64\UMonit64.exe
C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\System32\Taskmgr.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\WinStore\WSHost.exe
C:\WINDOWS\system32\taskeng.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://lenovo13.msn.com
uDefault_Page_URL = hxxp://lenovo13.msn.com
mWinlogon: Userinit = userinit.exe
mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe" /s
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
mRun: [Intel AppUp(SM) center] "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4
IE: Send to Bluetooth - C:\Program Files (x86)\Intel\Bluetooth\btSendToObject.htm
DPF: {4FF78044-96B4-4312-A5B7-FDA3CB328095} -
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{6456A0B3-3F9F-43C3-B686-49EFE9C01961} : DHCPNameServer = 150.201.1.2
TCP: Interfaces\{A840D705-EF13-4587-9EF8-007CC56B6034} : DHCPNameServer = 192.168.1.254
AppInit_DLLs= C:\windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.65\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
x64-Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
x64-Run: [IAStorIcon] "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4
x64-Run: [BTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
x64-Run: [SynLenovoGestureMgr] "C:\Program Files (x86)\Synaptics\SynTP\SynLenovoGestureMgr.exe" /m
x64-Run: [RtsFT] RTFTrack.exe
x64-Run: [UMonit64] C:\windows\SysWOW64\UMonit64.exe
x64-Run: [OnekeyStudio] C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe -start
x64-Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
x64-Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 excsd;ExpressCache Storage Filter Driver;C:\WINDOWS\System32\Drivers\excsd.sys [2013-7-23 112552]
R0 iaStorA;iaStorA;C:\WINDOWS\System32\Drivers\iaStorA.sys [2013-1-31 652784]
R0 LHDmgr;LHDmgr;C:\WINDOWS\System32\Drivers\LhdX64.sys [2013-7-23 39008]
R0 nvpciflt;nvpciflt;C:\WINDOWS\System32\Drivers\nvpciflt.sys [2013-7-23 30496]
R1 excfs;ExpressCache File System Filter Driver;C:\WINDOWS\System32\Drivers\excfs.sys [2013-7-23 26024]
R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2013-2-13 770528]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2012-9-30 1112000]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2012-9-30 1132480]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2012-9-12 135984]
R2 ExpressCache;ExpressCache;C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [2013-1-8 107944]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-1-31 15344]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-2-13 731648]
R2 Intel(R) ME Service;Intel(R) ME Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-7-23 131544]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2013-7-23 169432]
R2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [2012-12-13 230408]
R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2012-12-13 70152]
R2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2013-2-8 3386608]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\WINDOWS\System32\Drivers\AcpiVpc.sys [2012-5-15 33560]
R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed Virtual Adapter;C:\WINDOWS\System32\Drivers\AmpPal.sys [2013-2-13 164832]
R3 BthLEEnum;Bluetooth Low Energy Driver;C:\WINDOWS\System32\Drivers\BthLEEnum.sys [2012-7-25 202752]
R3 btmaux;Intel Bluetooth Auxiliary Service;C:\WINDOWS\System32\Drivers\btmaux.sys [2012-10-1 132480]
R3 btmhsf;btmhsf;C:\WINDOWS\System32\Drivers\btmhsf.sys [2012-10-1 1337216]
R3 ibtfltcoex;ibtfltcoex;C:\WINDOWS\System32\Drivers\iBtFltCoex.sys [2012-8-6 68136]
R3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;C:\WINDOWS\System32\Drivers\L1C63x64.sys [2013-1-24 118936]
R3 NETwNe64;@oem17.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit;C:\WINDOWS\System32\Drivers\NETwew00.sys [2013-2-21 3311072]
R3 rtsuvc;Lenovo EasyCamera;C:\WINDOWS\System32\Drivers\rtsuvc.sys [2013-7-23 8243272]
R3 SmbDrvI;SmbDrvI;C:\WINDOWS\System32\Drivers\Smb_driver_Intel.sys [2013-3-21 33008]
R3 WSDScan;WSD Scan Support;C:\WINDOWS\System32\Drivers\WSDScan.sys [2013-3-25 23552]
R4 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-5-11 200728]
RUnknown X5XSEx_Pr148;X5XSEx_Pr148;

S2 0258361432172073mcinstcleanup;McAfee Application Installer Cleanup (0258361432172073);C:\WINDOWS\TEMP\025836~1.EXE -cleanup -nolog --> C:\WINDOWS\TEMP\025836~1.EXE -cleanup -nolog [?]
S2 mfevtp;McAfee Validation Trust Protection Service;"C:\WINDOWS\System32\mfevtps.exe" --> C:\WINDOWS\System32\mfevtps.exe [?]
S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® + High Speed Protocol;C:\WINDOWS\System32\Drivers\AmpPal.sys [2013-2-13 164832]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-2-13 820184]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-2-8 273136]
S3 wsvd;wsvd;C:\WINDOWS\System32\Drivers\wsvd.sys [2013-7-23 102376]
S4 McShield;McAfee McShield;"C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" --> C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [?]
S4 mfefire;McAfee Firewall Core Service;"C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" --> C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [?]
.
=============== Created Last 30 ================
.
2015-05-21 02:26:00   --------   d-sh--w-   C:\Recovery
2015-05-21 01:44:16   --------   d--h--w-   C:\ProgramData\CanonIJFAX
2015-05-21 01:44:15   303104   ----a-w-   C:\WINDOWS\System32\CNCALBL.DLL
2015-05-21 01:42:08   --------   d-----w-   C:\Users\finelbell\AppData\Local\Google
2015-05-21 01:41:57   --------   d-----w-   C:\Users\finelbell\AppData\Local\Deployment
2015-05-21 01:41:57   --------   d-----w-   C:\Users\finelbell\AppData\Local\Apps
2015-05-21 01:37:23   --------   d-----w-   C:\Users\finelbell\AppData\Roaming\Intel Corporation
2015-05-21 01:36:28   --------   d-----w-   C:\ProgramData\Energy Management
2015-05-21 01:36:09   --------   d-sh--w-   C:\$RECYCLE.BIN
2015-05-21 01:36:00   --------   d-----r-   C:\Users\finelbell\Searches
2015-05-21 01:36:00   --------   d-----r-   C:\Users\finelbell\Contacts
.
==================== Find3M  ====================
.
.
============= FINISH: 18:51:03.16 ===============





« Last Edit: May 31, 2015, 04:39:16 PM by kevinf80 »

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Hello Beavecoon and welcome to SpywareHammer,

Continue as follows please:

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.
Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Next,

Follow the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Please open Malwarebytes Anti-Malware.

  • On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
  • Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
  • Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • With some infections, you may or may not see this message box.
'Could not load DDA driver'

  • Click 'Yes' to this message, to allow the driver to load after a restart.
  • Allow the computer to restart. Continue with the rest of these instructions.
  • When the scan is complete, click Apply Actions.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have three options:

      Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
      Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
      XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

  • Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…


If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish. Follow the instructions above....
Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either accept the alert or disable your security and allow FRST to run...

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
  • Post back the report which should also be located here:

C:\Programdata\RogueKiller\Logs <-------- W7/8
C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP

Let me see those logs in your next reply....

Thank you,

Kevin...

Offline Beavecoon

  • Bronze Member
  • Posts: 8
In all of these scans I found nothing, I have actually run all of these programs before however
I hope the logs can be of use to you good sir

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/21/2015
Scan Time: 4:40:34 PM
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.05.21.03
Rootkit Database: v2015.05.16.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: finelbell

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 391572
Time Elapsed: 5 min, 18 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)




I had to attach the rest of the logs as files, If you have a problem with this I would happy to post them as text.


Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Thanks for those logs, no obvious malware or infection listed.... go to the following link:

https://support.microsoft.com/en-gb/kb/929135

expand the option for Windows 8, follow those instructions an run your system in a "Clean Boot" mode. Does that make any difference to your system?


Offline Beavecoon

  • Bronze Member
  • Posts: 8
Honestly the memory lowered down a little bit (about 5%) but it is still at around 20%. Have not tested a steam game because I currently have none on my system.

If it helps I can send you screen shots of task manager etc.
« Last Edit: May 21, 2015, 08:05:11 PM by Beavecoon »

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Why do you believe the memory usage at 20% is an issue, I would believe that is more or less normal....

Boot your system back to normal mode, instructions in the link I gave previously....

Select the Windows key and X key together, from the list select "Command prompt (Admin)"

At the prompt type or copy/paste tasklist > 0 & notepad 0  Select Enter

Notepad will open, save the contents and post in your next reply.

Next,

Again from an elevated command promt type or copy/paste tasklist /svc > 0 & notepad 0 Select Enter

Notepad will open, save the contents and post in your next reply.

Let me see those two logs, you can attach them, is ok by me....

Thanks,

Kevin...



« Last Edit: May 22, 2015, 03:43:23 AM by kevinf80 »

Offline Beavecoon

  • Bronze Member
  • Posts: 8
Here they are

BTW the reason that I am freaking out about the 20% memory is because before this thing it would start at 5 or 10%

Thank you!

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Thanks for those logs, do not see anything untoward or to concern us...

Open an elevated command prompt again, at the prompt type or copy paste the following:

wmic startup get caption, location, command /format:list > 0 & notepad 0

Select Enter, the log will open in Notepad, post to your reply...

Thanks,

Kevin...

Offline Beavecoon

  • Bronze Member
  • Posts: 8
here it is

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Again we do not see any issues or concerns in the startup list.. Run a final online AV scan, this is very thorough so will take a few hours to complete....

Scan with ESET Online Scanner

This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
Please visit ESET Online Scanner website.

Click there Run ESET Online Scanner.

If using Internet Explorer:

  • Accept the Terms of Use and click Start.
  • Allow the running of add-on.
If using Mozilla Firefox or Google Chrome:
  • Download esetsmartinstaller_enu.exe that you'll be given link to.
  • Double click esetsmartinstaller_enu.exe.
  • Allow the Terms of Use and click Start.
To perform the scan:
  • Make sure that Remove found threats is unchecked.
  • Scan archives is checked.
  • In Advanced Settings: Scan for potentially unwanted applications, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.
  • Under “Enable Stealth Technology select “Change” select any extra drives in that window.
  • Click Start
  • The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
  • When completed, the program will begin to scan. This may take several hours. Please, be patient.
  • Do not do anything on your machine as it may interrupt the scan.
  • When the scan is done, click Finish.
  • A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.
Please include this logfile in your next reply.

Don't forget to re-enable protection software!

Thanks,

Kevin...

Offline Beavecoon

  • Bronze Member
  • Posts: 8
Nothing appeared on the scan, here is the log though

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Thanks for the update and log, is good news that no malware/infection is found. Run the following to clean up..

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:


  • Remove disinfection tools
  • Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Next,

Back to the memory issue, in your opening statement you mention using Norton, I can see you are now using McAfee. Also you`ve reverted back to Windows 8 from 8.1
Turn off or even better uninstall McAfee, revert back to Windows Defender, see if there is any difference in basic memory usage.
Also update back to Windows 8.1, see what happens after the update.

let me know if that makes any difference..

Thanks,

Kevin


Offline Beavecoon

  • Bronze Member
  • Posts: 8
As in terms of the memory nothing changed with the reset. I am almost positive I uninstalled the trial of Mcafee my pc came with (from control panel). Also reverting back to 8.1 will not make a difference, the refresh sent meback to 8 and I updated that to 8.1 and nothing changed, I can  try again if you think it will help. If you need them I could send you some info of some kind from a program called process explorer. I feel like we could get some better data out of it, I do not understand it but maybe you do.

Thank you!

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7670
Your version of Windows is currently 8 not 8.1, you are correct regarding security, Although DDS does show McAfee as active security system, FRST log shows Windows defender, I assume the uninstall of McAfee happened after you ran DDS but prior to FRST.
We also tried your system in "Clean Boot" mode, that means all 3rd party services were disabled, only Windows System services were active. You reported no change in Memory usage...

All of the scans we`ve ran do not indicate the presence of Malware or Infection. We do not need to run process explorer, In reply #5 I asked you to get all listed services with memory usage, you list the logs in reply #6. There is nothing really outstanding in those logs, probably Chrome is the biggest listed user.

This is the Malware removal forum, as such I cannot really give you any further help. Probably better if you open a thread in Windows 8 section of Operating System Forum... http://spywarehammer.com/index.php?board=122.0

Personally I do not see 20% memory usage as suspicious or unexpected, I know my laptop with Windows 7 runs about 30%, my laptop with Windows 8.1 about 35% both run Kaspersky, Malwarebytes Premium, Malwarebytes Anti-Exploit and MCshield. Memory usage can spike higher depending on what i`m doing....

Thank you for your understanding,

Kevin...







Offline Beavecoon

  • Bronze Member
  • Posts: 8
I understand at this point it may not be considered Malware but it is something Malware left behind that I need fixed. If I do not get this fixed I am gonna need $1400 to replace my laptop which is very hard to pull out of the air when you're under 18. Honestly the forum you directed me to hasn't really had activity in a year. Please if you have any other help at all I could really use it. Is there a place I can take it? is there something I can buy or replace to help? Is there at least somewhere that will accept what I currently have for a decent price?