Jump to content
nodsh

[RESOLVED] Slow , dropped connections , cannot connect to server frequently

Recommended Posts

nodsh   

I found the Sophos log , cannot remember the others , have to review back , sorry for the delay .  Monday's sometimes I have

to be retrained <S>

2015-05-15 01:12:46.750    Sophos Virus Removal Tool version 2.5.4
2015-05-15 01:12:46.750    Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-05-15 01:12:46.750    This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-05-15 01:12:46.750    Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x300 PT=0x1 WOW64
2015-05-15 01:12:46.755    Checking for updates...
2015-05-15 01:12:50.937    Update progress: proxy server not available
2015-05-15 01:12:57.236    Option all = no
2015-05-15 01:12:57.236    Option recurse = yes
2015-05-15 01:12:57.236    Option archive = no
2015-05-15 01:12:57.236    Option service = yes
2015-05-15 01:12:57.236    Option confirm = yes
2015-05-15 01:12:57.236    Option sxl = yes
2015-05-15 01:12:57.236    Option max-data-age = 35
2015-05-15 01:12:57.236    Option EnableSafeClean = yes
2015-05-15 01:12:58.893    Option vdl-logging = yes
2015-05-15 01:12:58.898    Customer ID:    094260ca9b3af99f9d4a3909fc47a743
2015-05-15 01:12:58.898    Machine ID:    211fce2f43154eab90ec8374e95d66db
2015-05-15 01:12:58.903    Component SVRTcli.exe version 2.5.4
2015-05-15 01:12:58.903    Component control.dll version 2.5.4
2015-05-15 01:12:58.903    Component SVRTservice.exe version 2.5.4
2015-05-15 01:12:58.903    Component engine\osdp.dll version 1.44.1.2200
2015-05-15 01:12:58.903    Component engine\veex.dll version 3.60.0.2200
2015-05-15 01:12:58.903    Component engine\savi.dll version 8.1.7.2200
2015-05-15 01:12:58.903    Component rkdisk.dll version 1.5.30.0
2015-05-15 01:12:58.903    Version info:    Product version    2.5.4
2015-05-15 01:12:58.903    Version info:    Detection engine    3.60.0
2015-05-15 01:12:58.903    Version info:    Detection data    5.13
2015-05-15 01:12:58.903    Version info:    Build date    3/31/2015
2015-05-15 01:12:58.903    Version info:    Data files added    430
2015-05-15 01:12:58.903    Version info:    Last successful update    (not yet updated)
2015-05-15 01:13:12.510    Downloading updates...
2015-05-15 01:13:12.520    Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-05-15 01:13:12.520    Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-05-15 01:13:12.520    Update progress: [I49502] Found supplement IDE514 LATEST
2015-05-15 01:13:12.520    Update progress: [I49502] Found supplement IDE515 LATEST
2015-05-15 01:13:12.520    Update progress: [I49502] Found supplement IDE516 LATEST
2015-05-15 01:13:12.520    Update progress: [I49502] Found supplement IDE517 LATEST
2015-05-15 01:13:12.520    Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-05-15 01:13:12.520    Update progress: [I19463] Syncing product SAVIW32 53
2015-05-15 01:13:19.375    Update progress: [I19463] Syncing product IDE514 161
2015-05-15 01:13:27.710    Installing updates...
2015-05-15 01:13:28.415    Error level 1
2015-05-15 01:13:28.435    Update progress: [I19463] Syncing product IDE515 171
2015-05-15 01:13:28.435    Update progress: [I19463] Syncing product IDE516 103
2015-05-15 01:13:28.435    Update progress: [I19463] Syncing product IDE517 1
2015-05-15 01:13:49.378    Update successful
2015-05-15 01:14:07.396    Option all = no
2015-05-15 01:14:07.396    Option recurse = yes
2015-05-15 01:14:07.396    Option archive = no
2015-05-15 01:14:07.396    Option service = yes
2015-05-15 01:14:07.396    Option confirm = yes
2015-05-15 01:14:07.396    Option sxl = yes
2015-05-15 01:14:07.396    Option max-data-age = 35
2015-05-15 01:14:07.396    Option EnableSafeClean = yes
2015-05-15 01:14:07.446    Option vdl-logging = yes
2015-05-15 01:14:07.601    Customer ID:    094260ca9b3af99f9d4a3909fc47a743
2015-05-15 01:14:07.601    Machine ID:    211fce2f43154eab90ec8374e95d66db
2015-05-15 01:14:07.606    Component SVRTcli.exe version 2.5.4
2015-05-15 01:14:07.606    Component control.dll version 2.5.4
2015-05-15 01:14:07.606    Component SVRTservice.exe version 2.5.4
2015-05-15 01:14:07.606    Component engine\osdp.dll version 1.44.1.2200
2015-05-15 01:14:07.606    Component engine\veex.dll version 3.60.0.2200
2015-05-15 01:14:07.606    Component engine\savi.dll version 8.1.7.2200
2015-05-15 01:14:07.606    Component rkdisk.dll version 1.5.30.0
2015-05-15 01:14:07.606    Version info:    Product version    2.5.4
2015-05-15 01:14:07.606    Version info:    Detection engine    3.60.0
2015-05-15 01:14:07.606    Version info:    Detection data    5.13G
2015-05-15 01:14:07.606    Version info:    Build date    3/31/2015
2015-05-15 01:14:07.606    Version info:    Data files added    430
2015-05-15 01:14:07.606    Version info:    Last successful update    5/14/2015 9:13:49 PM

2015-05-15 01:29:20.953    Could not open C:\hiberfil.sys
2015-05-15 01:29:20.978    Could not open C:\pagefile.sys
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{03f5d7cf-e9ab-11e4-a3b0-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{2a1ad4e1-f7ff-11e4-a3be-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{5bf387d0-ef31-11e4-92c6-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{5f188943-e690-11e4-a3be-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{67a23490-f4b9-11e4-a67f-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{6e70b7d7-f95e-11e4-9064-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{6f489d00-f18a-11e4-a355-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{a672067e-ecd1-11e4-8274-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:37:59.686    Could not open C:\System Volume Information\{ee565a59-fa0e-11e4-a3f0-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-15 01:46:26.160    Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2015-05-15 01:46:26.160    Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2015-05-15 01:46:29.400    Could not open C:\Windows\System32\config\RegBack\DEFAULT
2015-05-15 01:46:29.405    Could not open C:\Windows\System32\config\RegBack\SAM
2015-05-15 01:46:29.405    Could not open C:\Windows\System32\config\RegBack\SECURITY
2015-05-15 01:46:29.405    Could not open C:\Windows\System32\config\RegBack\SOFTWARE
2015-05-15 01:46:29.410    Could not open C:\Windows\System32\config\RegBack\SYSTEM
2015-05-15 02:07:44.085    SafeClean bin directory is empty.
2015-05-15 02:07:44.930    Error level 0

2015-05-15 03:18:06.513    Scan completed.
2015-05-15 03:18:06.513    

------------------------------------------------------------

2017-04-14 01:29:53.801    Sophos Virus Removal Tool version 2.5.4
2017-04-14 01:29:53.815    Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2017-04-14 01:29:53.815    This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2017-04-14 01:29:53.815    Windows version 6.2 SP 0.0  build 9200 SM=0x300 PT=0x1 WOW64
2017-04-14 01:29:59.854    Removed SafeClean bin directory.


2017-04-14 01:29:59.855    Scan completed.
2017-04-14 01:29:59.855    

------------------------------------------------------------

2017-04-14 01:32:35.548    Sophos Virus Removal Tool version 2.5.4
2017-04-14 01:32:35.548    Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2017-04-14 01:32:35.548    This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2017-04-14 01:32:35.548    Windows version 6.2 SP 0.0  build 9200 SM=0x300 PT=0x1 WOW64
2017-04-14 01:32:35.551    Checking for updates...
2017-04-14 01:32:35.708    Update progress: proxy server not available
2017-04-14 01:32:36.738    Update error: invalid login credentials (error 5)
Couldn't authenticate user for resource with host server. URL was: http://dci.sophosupd.com/update
2017-04-14 01:33:02.395    Option all = no
2017-04-14 01:33:02.395    Option recurse = yes
2017-04-14 01:33:02.395    Option archive = no
2017-04-14 01:33:02.395    Option service = yes
2017-04-14 01:33:02.395    Option confirm = yes
2017-04-14 01:33:02.395    Option sxl = yes
2017-04-14 01:33:02.397    Option max-data-age = 35
2017-04-14 01:33:02.397    Option EnableSafeClean = yes
2017-04-14 01:33:08.552    Option vdl-logging = yes
2017-04-14 01:33:08.602    Customer ID:    094260ca9b3af99f9d4a3909fc47a743
2017-04-14 01:33:08.602    Machine ID:    e2d35d2714f64abfb4ab226a2f89a856
2017-04-14 01:33:09.474    Component SVRTcli.exe version 2.5.4
2017-04-14 01:33:09.474    Component control.dll version 2.5.4
2017-04-14 01:33:09.475    Component SVRTservice.exe version 2.5.4
2017-04-14 01:33:09.475    Component engine\osdp.dll version 1.44.1.2200
2017-04-14 01:33:09.475    Component engine\veex.dll version 3.60.0.2200
2017-04-14 01:33:09.476    Component engine\savi.dll version 8.1.7.2200
2017-04-14 01:33:09.920    Component rkdisk.dll version 1.5.30.0
2017-04-14 01:33:09.980    Version info:    Product version    2.5.4
2017-04-14 01:33:09.980    Version info:    Detection engine    3.60.0
2017-04-14 01:33:09.980    Version info:    Detection data    5.13
2017-04-14 01:33:09.980    Version info:    Build date    3/31/2015
2017-04-14 01:33:09.980    Version info:    Data files added    430
2017-04-14 01:33:09.980    Version info:    Last successful update    (not yet updated)

2017-04-14 02:30:45.665    Could not open C:\hiberfil.sys
2017-04-14 02:30:46.175    Could not open C:\pagefile.sys
2017-04-14 02:40:59.983    Could not open C:\swapfile.sys
2017-04-14 02:41:00.849    Could not open C:\System Volume Information\{3019cf02-0ef5-11e7-9db5-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2017-04-14 02:41:00.850    Could not open C:\System Volume Information\{30d14c14-195a-11e7-9db9-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2017-04-14 02:41:00.851    Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2017-04-14 02:41:00.852    Could not open C:\System Volume Information\{4a9f6256-1557-11e7-9db5-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2017-04-14 02:41:00.852    Could not open C:\System Volume Information\{4eb15a0e-20aa-11e7-9dbc-d4bed9d3b063}{3808876b-c176-4e48-b7ae-04046e6cc752}
2017-04-14 02:58:49.803    Could not open C:\Windows\System32\config\BBI
2017-04-14 02:58:50.015    Could not open C:\Windows\System32\config\RegBack\DEFAULT
2017-04-14 02:58:50.046    Could not open C:\Windows\System32\config\RegBack\SAM
2017-04-14 02:58:50.064    Could not open C:\Windows\System32\config\RegBack\SECURITY
2017-04-14 02:58:50.081    Could not open C:\Windows\System32\config\RegBack\SOFTWARE
2017-04-14 02:58:50.111    Could not open C:\Windows\System32\config\RegBack\SYSTEM
2017-04-14 03:23:58.483    SafeClean bin directory is empty.
2017-04-14 03:23:59.801    Error level 0

2017-04-14 03:43:53.722    Scan completed.
2017-04-14 03:43:53.722    

------------------------------------------------------------

 

Share this post


Link to post
Share on other sites
nodsh   

found the FSS

Farbar Service Scanner Version: 17-01-2015
Ran by jackie (administrator) on 13-04-2017 at 20:21:06
Running from "C:\Users\jackie\Desktop"
Microsoft Windows 10 Home  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

Share this post


Link to post
Share on other sites
nodsh   

I said Monday  and today is Friday , I think you knew what i meant , Things seem to be fine so I think we can finish and I

will monitor her , unless you want more  .

Share this post


Link to post
Share on other sites
nodsh   

will check back with you on that , after getting a hold of her again , probably tomorrow

Share this post


Link to post
Share on other sites
nodsh   

 Results of screen317's Security Check version 1.001  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Flash Player     25.0.0.127  
 Mozilla Firefox (53.0)
 Google Chrome (57.0.2987.133)
 Google Chrome (plugins...)
 Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamtray.exe  
 Windows Defender MSASCuiL.exe   
 Windows Defender MpCmdRun.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````

 

Share this post


Link to post
Share on other sites
Broni   

Your computer is clean p3879546.jpg

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download 51a5ce45263de-delfix.pngDelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

  • Activate UAC (optional; some users prefer to keep it off)
  • Remove disinfection tools
  • Create registry backup
  • Purge System Restore
  • Reset system settings


Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.

Share this post


Link to post
Share on other sites
nodsh   

Broni , What can i say , THANK you ,

Is it alright if i schedule a meeting with the "senior center " who she is a good member , and you have helped me do others

that are also members , but to others , to mention your site , and the availability of not just fixing malware , but having a site where others

help and give you a better experience of just using the computer .

              Remember their fear is I can't do it , I've tried to tell most of them , that the people here are great and will help you .

you may just need to copy and paste , which i will be happy to do the teamviewer with you for nothing , just to show you how .

                  I have mentioned this site on the ones we helped and told them to try it .  

May I mention it at a larger way , esp at the center ,then just the ones i've helped ????

Share this post


Link to post
Share on other sites
Broni   

Of course and I truly applaud  your work there. Good job my friend :)

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.

×