Slow computer - low CPU usage

[lbb87]

[Gecko]

Hello lbb87,

My first guess would be a rootkit my second guess would be HDD problems

First the rootkit please download extract it to your root like this:
C:\rkr\RootkitRevealer.exe

Close all other programs, windows and disable your screen saver before you start RootkitRevealer.
While RootkitRevealer is running, you shouldn't do anything at all with the PC.
Put down the mouse, back away slowly, and let the program do its work.

Start RootkitRevealer.exe and press the Scan button.
It will take some time to finish an hour is common so just wait it out.
Once the scanning is finished RootkitRevealer will create a log, please copy the contents of that log into your reply.

HDD problems, first run a dskchk on the drive and then go to the manufacture web site and download their hard drive diagnostic tool and run it on the HDD.

[lbb87]

[lbb87]

[icecube]

I've seen computers enclosed in a confined space and they lock up royally. The overheating issue usually affects the hard drive data.

A system restore could be the best method of recovery. Usually with a heat issue there are other things present. This could be the best way to approach the issue. If it errors out, pick another date.

System restore will not really lose data unless it is stored on the Desktop. Otherwise you are good to go.

[lbb87]

I had read that anything that was in the My Documents folder was protected. Anything else was not safe. I don't know if that's true.

The relative has just informed me that they have some pictures, letters, and emails that they want to get off the computer first. Can these be burned to a CD in Safe Mode? If not, I guess I'll have to upload them to my website in Safe Mode. I don't know how else to get them off. Basically, I can't do anything on that computer unless it's done in Safe Mode. It just takes too long otherwise. I could be sitting there for hours and hours just trying to open one little file.

[Gecko]

lbb87,

OFB1.DLL: Browser Helper Object Trojan.Downloader
Detected by Bitdefender antivirus as Trojan.Clicker.OwlForce.A, bundled with Phone7 VoIP software
This downloader trojan will download more spyware and install it on the system.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please download and save it to your desktop.

Double click combofix.exe and follow the prompts.

When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall

And yes this can all be done in safe mode

[lbb87]

Here are the results of the Rootkit Revealer scan

HKLM\SECURITY\Policy\Secrets\SAC* 1/14/2007 12:17 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 1/14/2007 12:17 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\webcal\URL Protocol 4/22/2007 12:18 AM 13 bytes Data mismatch between Windows API and raw hive data.
C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0196NAV~.TMP 4/27/2007 5:49 PM 0 bytes Hidden from Windows API.



I also found an appcompat.txt that was created a few hours after the problem. Would it help to post that here?

[Gecko]

lbb87,

There is nothing bad in your Rootkit Revealer scan

After you run the combofix from my post above, please post a Hijackthis log

[icecube]

You are talking hours messing with that computer. The fastest way to fix that drive is to pull it and hook it up to your system. Disconnect your CDRom drive and hook it up there. No settings have to be changed on either drive. I hang the drive outside the computer upside on top of an empty cardboard box for support.

Make sure that you have a current updated virus scan program, sypbot installed (make sure the immunize button has been run) and Windows defender is on your hard drive. Boot your system up. Start all three programs running on drive in question and go out and wash your car or go to lunch.

Even if no issues are found, copy the data they need to your hard drive and then shut down and disconnect the HD and re hook up you cdrom drive. Then burn their data to a cd.

There is the possibility that their hard drive could be going bad. Fiddling with it for 4 hours might not be a good thing.

Hope this helps

[lbb87]

I told them to take it to a repair shop. When I find out what was wrong with it I'll post it here.

I did find two somewhat interesting things.

1) Their Norton Antivirus program hadn't updated the virus definitions since the day before the computer slowed down. It kept giving an LU1809 error so I had to remove Luinsdll.dll and reinstall Liveupdate. That worked but it didn't have any affect on the slowness problem.

2) They say that games work fine on the computer, once they get the game open. That's strange because that's the only thing that seems to work ok.


When someone has a problem with their computer being slow (like I described in my original post) shouldn't they not use their computer unless it's in an attempt to fix the problem? It seems like they shouldn't be playing games on it. It also seems like they should've turned it off and not left it on this entire time (a week).