[Grayson24]

I'm travelling over the summer and since my family wants to keep the good laptop at home, I am forced to use my old laptop. It's a Dell Inspiron 500m from 2002ish and on booting it up, I was unsurprised to find it extremely slow. It takes ages to boot up and once booted, everything opens and loads very slowly. For example I couldn't even get firefox to open and was forced to use Internet explorer. I would really appreciate any way to make this computer run faster.

Specs
1.3 Ghz
256mb RAM
Windows XP SP2
================================================
I noticed this was often asked for, so here's the Hijack this log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:17 AM, on 6/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\RoamMgr.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Switching\User\RoamSvc.exe
C:\WINDOWS\TEMP\APBE8C.EXE
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\NCS\Sync\NetSvc.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [Search Defender] "C:\Program Files\Speeditup Free\SearchDefender.exe"
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DFBEECC-FA32-4BD7-9CF7-9A0F2CF77FD3}: NameServer = 163.139.230.168 163.139.21.197
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Adapter Switching (IntelRoam) - Intel Corporation - C:\Program Files\Intel\Switching\User\RoamSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: RoamMgr - Intel Corporation - C:\WINDOWS\System32\RoamMgr.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
--
End of file - 4723 bytes

=======================================================

I just need to use for the next two months, so upgrading isn't really an option.

[flavallee]

Specs
1.3 Ghz
256mb RAM
Windows XP SP2

The main problem for the snail's pace of that laptop is the amount of RAM. You can trim down the startup load to the minimum, turn off as many visual affects as possible, and tweak settings for maximum performance, and it's still going to run slow and have noticable lag time with certain functions.

I just spent $10.00 plus $6.00 shipping for a 256 MB module so I could speed up a Toshiba Satellite A85-S107 laptop for my daughter. The increase from 256 MB to 512 MB of RAM noticably improved overall performance.

---------------------------------------------------------------

Your log shows an infection:

O4 - HKCU\..\Run: [Search Defender] "C:\Program Files\Speeditup Free\SearchDefender.exe"

http://www.sysinfo.org/startuplist.p...earch+Defender

O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

http://www.sysinfo.org/startuplist.php?filter=kamsoft

I've reported your thread to the "Malware Removal & HijackThis Logs" section for assistance.

-----------------------------------------------------------------

[Grayson24]

Since I'm literally only going to use it for two months, I don't see the point of upgrading the ram. Also I'm leaving in two days.

A question that's been bothering me for a while is that I remember using this computer a couple of years ago and it worked fine. Why is it that now 256mb of ram makes it run so slow?

Any other tips?

[flavallee]

I remember using this computer a couple of years ago and it worked fine. Why is it that now 256mb of ram makes it run so slow

It's running slow because it's lacking RAM - and - it's infected.

----------------------------------------------------------------

If you're leaving in 2 days, I'll advise the malware experts to disregard my request.

---------------------------------------------------------------

[Grayson24]

Originally Posted by flavallee

I remember using this computer a couple of years ago and it worked fine. Why is it that now 256mb of ram makes it run so slow

It's running slow because it's lacking RAM - and - it's infected.

----------------------------------------------------------------

If you're leaving in 2 days, I'll advise the malware experts to disregard my request.

---------------------------------------------------------------

Ok, I'll give in to the overwhelming consensus and order some more RAM. I'll install it when I get there but for the moment, how do you get rid of this ckvo infection. And the other one.

[flavallee]

how do you get rid of this ckvo infection. And the other one.

You need to wait for a response from a malware expert and then follow his\her instructions.

I really don't see you getting the infection cleaned out before you leave in 2 days because this can be a time-consuming process.

--------------------------------------------------------------

[Grayson24]

Any programs I could use? Or folders I should empty out?

Sorry if I sound desperate but this computer is REALLY slow.

[Grayson24]

Also, I just realized that it's actually running okayish after the very long bootup. It's really connecting to the internet that makes it so slow. Don't know if that helps.

[flavallee]

You're a person on a mission and in a hurry, so I'll do what little that I can.

Go into MY COMPUTER, click Tools - Folder Options - View(tab), select "Show hidden files and folders", uncheck "Hide protected operating system files", then click Apply - OK. Ignore the warning message.

Open these 2 Temp folders:

C:\WINDOWS\Temp

C:\Documents And Settings\(Username)\Local Settings\Temp

then delete everything from inside both Temp folders.

If a few files resist getting deleted, leave them alone and delete everything else.

Empty the Recycle Bin, then restart.

------------------------------------------------------------------

Go here to download and install Malwarebytes Anti-Malware 1.37.

Run its update function to get it up-to-date with the latest definition files.

Run a scan with it. Leave your computer alone until it finishes.

Allow it to select and fix everything that it finds.

Restart again.

Start Malwarebytes and go into its log section, then copy-and-paste its log here so we can see the results.

---------------------------------------------------------------

It's midnight here, so I'm getting ready to shut down for the night.

I'll check your thread tomorrow morning.

--------------------------------------------------------------

[Grayson24]

I'm not being able to view hidden files/folders. When I click "OK" on the folder options, the window closes but no hidden file/folders appear. Then when I go back to the options window, "Do not show hidden files and folders" is selected. I've tried a million times but it's like that option is locked in. Could this be an affect of the ckvo infection?

===============================================
Malwarebytes' Anti-Malware 1.37
Database version: 2182
Windows 5.1.2600 Service Pack 2

6/10/2009 5:03:37 PM
mbam-log-2009-06-10 (17-03-37).txt

Scan type: Full Scan (C:\|)
Objects scanned: 118883
Time elapsed: 42 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\ckvo0.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kamsoft (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\system volume information\_restore{b7394e41-2bf7-4b55-bd0f-731a9c735cc6}\RP325\A0210287.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ckvo.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ckvo0.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Tasks\ErrorKiller Scheduled Scan.job (Rogue.ErrorKiller) -> Quarantined and deleted successfully.

================================================

It detected the ckvo virus but couldn't remove it for some reason.

[flavallee]

When you click Tools - Folder Options in MY COMPUTER, it should bring up a small window with 3 tabs:

General
View
File Types

When you click on the View tab, you should see the list of settings and be able to select or deselect the ones you want, then click Apply - OK.

---------------------------------------------------------------

You're in the hands of the malware experts now, if you get a reply. It's a pretty busy section and they deal with a lot of requests for help.

--------------------------------------------------------------

[Grayson24]

Yeah I did that, but for some reason it automatically goes back to the "Do not Show option". Thanks for all your help (it's running way better after the malware scan) and hopefully the malware guys will be able to fix it even more.

[Grayson24]

Ok, jI've upgraded the RAM to 512mb. It's running a lot better now, as long as it isn't connected to the internet. The minute i do connect and open firefox, it slows down to a snail's pace. I have RamBooster open and it drops from around 400mbto 30mb. It constantly freezes (just had one while writing this) and I can barely run any other program at the same time. Still can't view hidden files/folders since the option seems to be locked. Hope somebody can help.

[flavallee]

We've had about a 2 week delay.

Post a new HijackThis log here.

--------------------------------------------------------------------

[Grayson24]

Here it is.

==================================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:09:59 PM, on 6/24/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\RoamMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\TEMP\NLB7D4.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Switching\User\RoamSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Speeditup Free\SearchDefender.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\NCS\Sync\NetSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Search Defender] "C:\Program Files\Speeditup Free\SearchDefender.exe"
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Adapter Switching (IntelRoam) - Intel Corporation - C:\Program Files\Intel\Switching\User\RoamSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: RoamMgr - Intel Corporation - C:\WINDOWS\System32\RoamMgr.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

--
End of file - 5866 bytes