my computer runs like a snail(report attached)

[crystalchou]

hardware:Celeron1.7 ,512MB,40G
system: windows xp sp2

problem:
1. once my msn sent automatic advertisements to others. i scaned my computer online, but no msn worm found.
2. later i had my computer scanned thoroughly,not by kaspersky online(because somehow it didn't work), by Rising and 2 Rookit and 1 trojan found.then i switched to safety mode so as to delete these files,ut i couldn't find them.
then i used kaspersky virus removal tool to scan my computer and found 2 virus and deleted them.

However, my computer still runs like a snail, especially when surfing the internet.

what's the problem?

the report is attached

thanks.

[Rene-gad]

(database released 12/08/2009; 11:22)

- please use always the last version of AVPTool

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- Execute following script in Manual Cure

After copying in the AVPTool-Window replace [dirname] with the names of directories as written at your system.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 StopService('t32brw8g9i');
 QuarantineFile('D:\[dirname]\Thunder\ComDlls\TDAtOnce_Now.dll','');
 QuarantineFile('D:\[dirname]\Thunder\ComDlls\xunleiBHO_Now.dll','');
 QuarantineFile('C:\windows\system32\drivers\bfsdrv.sys','');
 QuarantineFile('C:\windows\System32\Drivers\Efimon.sys','');
 QuarantineFile('C:\windows\system32\Drivers\Hookport.sys','');
 QuarantineFile('ulsata.sys','');
 QuarantineFile('MPSVCService.sys','');
 QuarantineFile('C:\windows\system32\drivers\360SelfProtection.sys','');
 QuarantineFile('C:\windows\system32\drivers\t32brw8g9i.sys','');
 QuarantineFile('D:\[dirname]\Thunder\program\Thunder.exe','');
 QuarantineFile('D:\[dirname]\360safe\safemon\360tray.exe','');
 QuarantineFile('C:\windows\system32\drivers\mp110009.sys','');
 QuarantineFile('C:\windows\system32\drivers\mp110011.sys','');
 DeleteFile('C:\windows\system32\drivers\t32brw8g9i.sys');
 DeleteService('t32brw8g9i');
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(13);
BC_DeleteSvc('t32brw8g9i');
BC_Activate;
RebootWindows(true);
end.

After reboot execute following script in Manual Cure

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool cleanmgr or CCleaner or ClearProg
- Close all the programs and start only Internet Explorer!!!
- Repeat a log file.
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip over the link Upload quarantined files on the top of this page.
- Attach a log to your new post..

[crystalchou]

thank you for your time and consideration.
attached is the log collected after i excuted the script and 'clean'ed my computer

[Rene-gad]

- Uninstall or remove Bonjour
- Execute following script in Manual Cure

begin
ExecuteRepair(13);
RebootWindows(true);
end.

After reboot pls. make 3 logs in accordance with the rules: http://virusinfo.info/showthread.php?t=9184 Don't forget to update AVZ Database. I'd like to see you PC really clean

[crystalchou]

there's no "Healing/Quarantine and Advanced System Analysis" in file->standard scripts in the avz antiviral toolkit.
so i only execute "advanced system analysis"

is my computer clean?

[Rene-gad]

Pls. open new text file in Editor
Copy follow text into it

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Switch a File type from TEXT to ALL FILES
Save the file as

C:\windows\system32\drivers\etc\hosts

ATT: this file has not any extension!

- Install Service Pack 3 for Windows XP and all the later important updates
- Install Internet Explorer 8
- Update Java Runtime Environment

Any question or requests?

[crystalchou]

nop. thank you~(i was just waiting for windows 7 and too lazy to install xp sp3 ^_^maybe you're right)

[Rene-gad]

nop. thank you~(i was just waiting for windows 7 and too lazy to install xp sp3 ^_^maybe you're right)

1. Win 7 will come in 2 months, during which you could be daily compromised.
2. Don't buy Win 7 immediately, wait at least a half of a year - it's my experience