View original (French)

Very slow PC and Java exploits

Solved
kirabelle -  
Hello,
I am contacting you because for a few days my PC has been very very slow. It takes hours to open a page and even when I type, only a few letters appear here and there. I’m really struggling!!

Obviously, I came to read the forum advice and I did a cleanup with CCleaner and I ran a scan with my antivirus “Avira”. I’m posting the report hoping to find a solution. Thanks in advance.

REPORT

Avira Free Antivirus
Report file creation date: Saturday, March 16, 2013 08:59

The scan covers 5,206,996 virus strains.

The program is running in unlimited full version.
Online services are available.

License holder: Avira Free Antivirus
Serial number: 0000149996-ADJIE-0000001
Platform: Windows Vista (TM) Home Premium
Windows version: (Service Pack 2) [6.0.6002]
Boot mode: Normal startup
Identifier: SYSTEM
Computer name: PC-DE-NICO

Version information:
BUILD.DAT: 12.1.9.402 40870 Bytes 17/10/2012 16:29:00
AVSCAN.EXE: 12.3.0.48 468256 Bytes 15/11/2012 14:15:01
AVSCAN.DLL: 12.3.0.15 65488 Bytes 13/08/2012 20:27:50
LUKE.DLL: 12.3.0.15 68304 Bytes 13/08/2012 20:27:50
AVSCPLR.DLL: 12.3.0.14 97032 Bytes 09/05/2012 06:59:26
AVREG.DLL: 12.3.0.17 232200 Bytes 11/05/2012 07:10:53
VBASE000.VDF: 7.10.0.0 19875328 Bytes 06/11/2009 18:18:34
VBASE001.VDF: 7.11.0.0 13342208 Bytes 14/12/2010 09:07:39
VBASE002.VDF: 7.11.19.170 14374912 Bytes 20/12/2011 17:37:34
VBASE003.VDF: 7.11.21.238 4472832 Bytes 01/02/2012 19:34:22
VBASE004.VDF: 7.11.26.44 4329472 Bytes 28/03/2012 18:54:57
VBASE005.VDF: 7.11.34.116 4034048 Bytes 29/06/2012 10:37:04
VBASE006.VDF: 7.11.41.250 4902400 Bytes 06/09/2012 17:54:11
VBASE007.VDF: 7.11.50.230 3904512 Bytes 22/11/2012 20:32:25
VBASE008.VDF: 7.11.60.10 6627328 Bytes 07/02/2013 20:55:25
VBASE009.VDF: 7.11.60.11 2048 Bytes 07/02/2013 20:55:25
VBASE010.VDF: 7.11.60.12 2048 Bytes 07/02/2013 20:55:25
VBASE011.VDF: 7.11.60.13 2048 Bytes 07/02/2013 20:55:25
VBASE012.VDF: 7.11.60.14 2048 Bytes 07/02/2013 20:55:25
VBASE013.VDF: 7.11.60.62 351232 Bytes 08/02/2013 20:54:54
VBASE014.VDF: 7.11.60.115 190976 Bytes 09/02/2013 22:46:42
VBASE015.VDF: 7.11.60.177 282624 Bytes 11/02/2013 22:46:46
VBASE016.VDF: 7.11.60.249 215552 Bytes 13/02/2013 14:25:20
VBASE017.VDF: 7.11.61.65 151040 Bytes 15/02/2013 17:47:36
VBASE018.VDF: 7.11.61.135 159232 Bytes 18/02/2013 18:31:33
VBASE019.VDF: 7.11.61.163 152064 Bytes 18/02/2013 18:31:33
VBASE020.VDF: 7.11.61.207 164352 Bytes 19/02/2013 18:31:34
VBASE021.VDF: 7.11.62.43 206336 Bytes 21/02/2013 18:31:22
VBASE022.VDF: 7.11.64.106 1510912 Bytes 11/03/2013 18:46:50
VBASE023.VDF: 7.11.64.157 137216 Bytes 12/03/2013 20:59:31
VBASE024.VDF: 7.11.64.233 159744 Bytes 14/03/2013 20:59:34
VBASE025.VDF: 7.11.65.19 143360 Bytes 15/03/2013 20:59:35
VBASE026.VDF: 7.11.65.20 2048 Bytes 15/03/2013 20:59:35
VBASE027.VDF: 7.11.65.21 2048 Bytes 15/03/2013 20:59:35
VBASE028.VDF: 7.11.65.22 2048 Bytes 15/03/2013 20:59:35
VBASE029.VDF: 7.11.65.23 2048 Bytes 15/03/2013 20:59:35
VBASE030.VDF: 7.11.65.24 2048 Bytes 15/03/2013 20:59:35
VBASE031.VDF: 7.11.65.38 6144 Bytes 15/03/2013 20:59:35
Engine version: 8.2.12.16
AElD.DLL: 8.1.2.10 102772 Bytes 10/07/2012 20:14:23
AESCRIPT.DLL: 8.1.4.98 475516 Bytes 14/03/2013 20:59:41
AESCN.DLL: 8.1.10.0 131445 Bytes 14/12/2012 18:43:08
AESBX.DLL: 8.2.5.12 606578 Bytes 15/06/2012 18:07:50
AERDL.DLL: 8.2.0.88 643444 Bytes 10/01/2013 20:31:59
AEPACK.DLL: 8.3.2.2 827767 Bytes 14/03/2013 20:59:41
AEOFFICE.DLL: 8.1.2.56 205180 Bytes 08/03/2013 18:46:48
AEHEUR.DLL: 8.1.4.248 5804409 Bytes 14/03/2013 20:59:40
AEHELP.DLL: 8.1.25.2 258423 Bytes 11/10/2012 18:07:55
AEGEN.DLL: 8.1.6.16 434549 Bytes 24/01/2013 20:31:18
AEEXP.DLL: 8.4.0.12 192886 Bytes 14/03/2013 20:59:42
AEEMU.DLL: 8.1.3.2 393587 Bytes 10/07/2012 20:14:22
AECORE.DLL: 8.1.31.2 201080 Bytes 19/02/2013 18:31:35
AEBB.DLL: 8.1.1.4 53619 Bytes 05/11/2012 23:38:11
AVWINLL.DLL: 12.3.0.15 27344 Bytes 13/08/2012 20:27:50
AVPREF.DLL: 12.3.0.32 50720 Bytes 15/11/2012 14:15:01
AVREP.DLL: 12.3.0.15 179208 Bytes 09/05/2012 06:59:26
AVARKT.DLL: 12.3.0.33 209696 Bytes 15/11/2012 14:15:00
AVEVTLOG.DLL: 12.3.0.15 169168 Bytes 13/08/2012 20:27:50
SQLITE3.DLL: 3.7.0.1 398288 Bytes 13/08/2012 20:27:50
AVSMTP.DLL: 12.3.0.32 63992 Bytes 13/08/2012 20:27:50
NETNT.DLL: 12.3.0.15 17104 Bytes 13/08/2012 20:27:50
RCIMAGE.DLL: 12.1.0.13 4449488 Bytes 20/09/2011 00:36:03
RCTEXT.DLL: 12.3.0.32 100640 Bytes 15/11/2012 14:14:41

Current scan configuration:
Task name: System Integrity Check
Configuration file: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Documentation: default
Main action: interactive
Secondary action: ignore
Boot sector search: on
Boot sector search: on
Boot sectors: C:,
Scan active programs: on
Extended task programs: on
Search in registry: on
Rootkit search: on
System file integrity check: off
Scan mode: All files
Search in archives: on
Recursion depth limit: 20
Archive Smart Extensions: on
Macrovirus heuristic: on
File heuristic: advanced

Start time: Saturday, March 16, 2013 08:59

Boot record search begins:
Master boot record HD0
[INFO] No virus found!
Master boot record HD1
[INFO] No virus found!
Master boot record HD2
[INFO] No virus found!
Master boot record HD3
[INFO] No virus found!
Master boot record HD4
[INFO] No virus found!

Boot search begins:
Boot sector 'C:\'
[INFO] No virus found!

Hidden objects search begins.

Process search begins:
Search process 'SearchFilterHost.exe' - '32' module(s) are checked
Search process 'SearchProtocolHost.exe' - '52' module(s) are checked
Search process 'taskeng.exe' - '24' module(s) are checked
Search process 'consent.exe' - '50' module(s) are checked
Search process 'PresentationFontCache.exe' - '31' module(s) are checked
Search process 'ipmGui.exe' - '96' module(s) are checked
Search process 'svchost.exe' - '30' module(s) are checked
Search process 'vssvc.exe' - '49' module(s) are checked
Search process 'conime.exe' - '16' module(s) are checked
Search process 'CCC.exe' - '201' module(s) are checked
Search process 'avscan.exe' - '87' module(s) are checked
Search process 'avscan.exe' - '29' module(s) are checked
Search process 'netsession_win.exe' - '59' module(s) are checked
Search process 'avcenter.exe' - '72' module(s) are checked
Search process 'svchost.exe' - '21' module(s) are checked
Search process 'soffice.bin' - '85' module(s) are checked
Search process 'ehmsas.exe' - '19' module(s) are checked
Search process 'soffice.exe' - '17' module(s) are checked
Search process 'AutoStartupService.exe' - '75' module(s) are checked
Search process 'QuickShare.exe' - '125' module(s) are checked
Search process 'ehtray.exe' - '26' module(s) are checked
Search process 'netsession_win.exe' - '37' module(s) are checked
Search process 'sidebar.exe' - '55' module(s) are checked
Search process '64brmon.exe' - '18' module(s) are checked
Search process 'DivXUpdate.exe' - '67' module(s) are checked
Search process 'avgnt.exe' - '72' module(s) are checked
Search process 'jusched.exe' - '29' module(s) are checked
Search process 'MOM.exe' - '55' module(s) are checked
Search process 'MSASCui.exe' - '41' module(s) are checked
Search process 'GFFUpdater.exe' - '59' module(s) are checked
Search process 'taskeng.exe' - '80' module(s) are checked
Search process 'Explorer.EXE' - '135' module(s) are checked
Search process 'Dwm.exe' - '33' module(s) are checked
Search process 'taskeng.exe' - '25' module(s) are checked
Search process 'avshadow.exe' - '33' module(s) are checked
Search process 'taskeng.exe' - '49' module(s) are checked
Search process 'WUDFHost.exe' - '32' module(s) are checked
Search process 'SearchIndexer.exe' - '61' module(s) are checked
Search process 'svchost.exe' - '9' module(s) are checked
Search process 'ExtensionUpdaterService.exe' - '21' module(s) are checked
Search process '64barsvc.exe' - '14' module(s) are checked
Search process 'svchost.exe' - '64' module(s) are checked
Search process 'svchost.exe' - '42' module(s) are checked
Search process 'lxbccoms.exe' - '36' module(s) are checked
Search process 'ibsvc.exe' - '38' module(s) are checked
Search process 'avguard.exe' - '59' module(s) are checked
Search process 'svchost.exe' - '58' module(s) are checked
Search process 'armsvc.exe' - '25' module(s) are checked
Search process 'svchost.exe' - '59' module(s) are checked
Search process 'sched.exe' - '52' module(s) are checked
Search process 'spoolsv.exe' - '88' module(s) are checked
Search process 'svchost.exe' - '93' module(s) are checked
Search process 'atieclxx.exe' - '32' module(s) are checked
Search process 'svchost.exe' - '81' module(s) are checked
Search process 'SLsvc.exe' - '26' module(s) are checked
Search process 'svchost.exe' - '37' module(s) are checked
Search process 'svchost.exe' - '151' module(s) are checked
Search process 'svchost.exe' - '80' module(s) are checked
Search process 'svchost.exe' - '64' module(s) are checked
Search process 'atiesrxx.exe' - '25' module(s) are checked
Search process 'svchost.exe' - '49' module(s) are checked
Search process 'svchost.exe' - '35' module(s) are checked
Search process 'svchost.exe' - '40' module(s) are checked
Search process 'winlogon.exe' - '31' module(s) are checked
Search process 'lsm.exe' - '22' module(s) are checked
Search process 'lsass.exe' - '59' module(s) are checked
Search process 'services.exe' - '33' module(s) are checked
Search process 'csrss.exe' - '14' module(s) are checked
Search process 'wininit.exe' - '26' module(s) are checked
Search process 'csrss.exe' - '14' module(s) are checked
Search process 'smss.exe' - '2' module(s) are checked

Registry reflection search begins:
The registry has been scanned ('1212' files).

Search in selected files begins:

Starting search in 'C:\'
C:\Users\nico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\741f078f-3210318d
[0] Archive type: ZIP
--> vqd.class
[RESULT] Contains the EXP/CVE-2013-0422.A exploit detection pattern
C:\Users\nico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\1a46d6e7-387f45c0
[0] Archive type: ZIP
--> n.class
[RESULT] Contains the EXP/2012-1723.GL detection pattern
--> h.class
[RESULT] Contains the EXP/CVE-2012-1723.A.3159 detection pattern
--> van.class
[RESULT] Contains the EXP/CVE-2012-1723.A.3156 detection pattern
--> j.class
[RESULT] Contains the EXP/CVE-2012-1723.A.3170 detection pattern
--> pou.class
[RESULT] Contains the EXP/CVE-2012-1723.A.3117 detection pattern
--> e.class
[RESULT] Contains the EXP/CVE-2012-1723.GK detection pattern
C:\Users\nico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\26d83b2b-66d42c69
[0] Archive type: ZIP
--> a.class
[RESULT] Contains the EXP/2011-3544.DV.1 detection pattern
--> l.class
[RESULT] Contains the EXP/CVE-2011-3544.CD detection pattern
C:\Users\nico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\29c837e-37fe7701
[RESULT] Contains the Trojan horse TR/Necurs.A.890
C:\Users\nico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\3b1a84bf-12144c0b
[0] Archive type: ZIP
-- >

63 answers

  2.  kirabelle Author
    well, thanks to all of you and especially to Billmaxime, my PC is doing very well!!!
    thank you to you and to this forum on which I come every time I have a problem, PC, phone or other.......
    THANK YOU!
    1. billmaxime Contributor
      re

      if you have no more concerns, everything is okay for me

      tell me how your pc is doing

      see you soon
      1. kirabelle Author
        The PC is fine, but then, what do you think about it, is it good? yes or no?

        and what should I do now?
        2. billmaxime Contributor
          re

          yes it is clear and well detailed and now the report appears again on the desktop and in C:\...

          thank you
          1. billmaxime Contributor
            Hi Gen,

            what do you mean by that?

            See you later
            1. g3n-h@ckm@n
              and even though he is quite demonstrative of everything he does, and enumerates his actions...
          2. billmaxime Contributor
            translation
            - You still have problems? How’s the PC doing?
            - See you soon
            1. g3n-h@ckm@n
              hi

              the DelFix reports are good like this !!!
          3. kirabelle Author
            RAPPORT CELFIX

            # DelFix v10.1 - Report created on 2013-04-02 at 19:19:17
            # Updated on 2013-02-23 by Xplode
            # Username: nico - PC-DE-NICO

            ~ Activation of UAC ... OK

            ~ Removal of disinfection tools ...

            Deleted: C:\ZHP
            Deleted: C:\Program Files\ZHPDiag
            Deleted: C:\PhysicalDisk0_MBR.bin
            Deleted: C:\Users\Public\Desktop\MBRCheck.lnk
            Deleted: C:\Users\Public\Desktop\ZHPFix.lnk
            Deleted: HKLM\SOFTWARE\AdwCleaner
            Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

            ~ Purge of system restore ...

            Deleted: RP #659 [Scheduled Restore Point | 03/16/2013 16:42:45]
            Deleted: RP #660 [Scheduled Restore Point | 03/17/2013 11:18:23]
            Deleted: RP #661 [Installation avast! Free Antivirus | 03/17/2013 20:58:06]
            Deleted: RP #662 [Scheduled Restore Point | 03/18/2013 10:51:56]
            Deleted: RP #663 [Removed Adobe Reader X (10.1.1) - French. | 03/18/2013 19:32:15]
            Deleted: RP #664 [Removed Java(TM) 6 Update 22 | 03/18/2013 19:41:38]
            Deleted: RP #665 [Removed Java(TM) 6 Update 29 | 03/18/2013 19:42:44]
            Deleted: RP #666 [Installed Java 7 Update 17 | 03/18/2013 19:46:16]
            Deleted: RP #667 [Windows Update | 03/19/2013 04:10:41]
            Deleted: RP #668 [Scheduled Restore Point | 03/20/2013 11:22:16]
            Deleted: RP #669 [Scheduled Restore Point | 03/21/2013 12:02:03]
            Deleted: RP #670 [Windows Update | 03/22/2013 15:56:38]
            Deleted: RP #671 [Scheduled Restore Point | 03/23/2013 08:21:02]
            Deleted: RP #672 [Scheduled Restore Point | 03/23/2013 20:58:42]
            Deleted: RP #673 [Scheduled Restore Point | 03/24/2013 13:47:00]
            Deleted: RP #674 [Windows Update | 03/26/2013 17:32:31]
            Deleted: RP #675 [Scheduled Restore Point | 03/27/2013 07:03:11]
            Deleted: RP #676 [Scheduled Restore Point | 03/27/2013 23:28:48]
            Deleted: RP #677 [Scheduled Restore Point | 03/29/2013 05:12:41]
            Deleted: RP #678 [Removed Microsoft Antimalware Service FR-FR Language Pack | 03/29/2013 18:38:59]
            Deleted: RP #679 [Windows Update | 03/29/2013 18:39:05]
            Deleted: RP #681 [P | 03/29/2013 18:39:42]
            Deleted: RP #683 [P | 03/29/2013 18:44:50]
            Deleted: RP #684 [Scheduled Restore Point | 03/30/2013 13:38:32]
            Deleted: RP #685 [Scheduled Restore Point | 04/01/2013 10:38:11]

            New restore point created!

            ########## - EOF - ##########
            1. billmaxime Contributor
              re kirabelle

              download delfix to your desktop (click the green arrow)

              the link http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/9-delfix

              run it as administrator (right-click)

              the box "delete disinfect tools" is checked by default

              also check the boxes "reenable UAC" and "purge restore"

              click "run"

              the report will appear on your desktop and in C:\delfix.txt

              post the report via 1 copy/paste

              @+
              2. billmaxime Contributor
                Hi Kirabelle

                You run PureRA as administrator (right-click)

                In the window that opens, click “Next”

                In the new window, click “Check all” and uncheck the 2 boxes

                As in the image

                When done, click “Clean”

                Just post the last line of the report (total space cleaned)

                See you soon
                1. kirabelle Author
                  for g3n-h@ckm@n....."you must read!"

                  for juju666 ......."when you’ve checked the boxes you have to click on clean"

                  Indeed, in my previous message, I said I don’t understand English and therefore what they tell me... so, can someone tell me:
                  - if I should click NEXT, ABOUT or EXIT ?
                  - then if I should check CHECK or CREATE LOY ?
                  - which boxes to check to clean? ? ? ? ? ?

                  so, I repeat my question:

                  "I tried to download "purera", but it's in English and I don’t understand what they are telling me... for example:
                  in the first window there are: NEXT - ABOUT - EXIT ? which one should I click,
                  if I click NEXT they give me a choice:
                  - CHECK ALL
                  - CREATE LOY
                  and then: CLEAN
                  BACK
                  and after a checkbox choice:
                  -SQM
                  -CEYPRNET URL CACHE
                  -ICON CACHE.DB
                  -THUMBNAILCACHES
                  - SPYBOTSPD
                  -SOFTCARE DISTRIBUTION LOG....etc...
                  WHAT TO DO?
                  THANKS
                  1. juju666 Security Contributor
                    NEXT -> you check the boxes as in the screenshot and then CLEAN
                  2. yoann090 Security Contributor
                    For information (because a number of installers may be in English even if the software is French)

                    NEXT : It means next (to proceed in the program)
                    ABOUT : It means About (it's just to provide information about the program: version number, copyright,...), generally no one reads it.
                    EXIT : It is now commonly used in French as well, it means quit
                    Check/uncheck : It is to check/uncheck (all = all)
                    Create log : Create report
                    Clean : Clean

                    The rest is computer science.

                    So as Juju said, once you are on the screen with the screenshot, just check the same boxes as on the screenshot and then click Clean to start the cleaning.
                2. kirabelle Author
                  I tried to download "purera," but it’s in English and I don’t understand what they’re telling me... for example: in the first window there are options: NEXT - ABOUT - EXIT? what should I click, if I click NEXT they give me a choice: - CHECK ALL - CREATE LOY and then: CLEAN BACK and after a checkbox choice: - SQM - CEYPRNET URL CACHE - ICON CACHE.DB - THUMBNAILCACHES - SPYBOTSPD - SOFTCARE DISTRIBUTION LOG... etc... WHAT TO DO?
                  2. kirabelle Author
                    you have to read, yes, that's kind, but what do I do?
                  3. juju666 Security Contributor
                    when you’ve checked the boxes that need to be clicked on, clean up
                3. billmaxime Contributor
                  re juju

                  I have no doubt about it whatsoever (and I’m glad you’re making remarks to me)

                  thank you and have a good evening ;)
                  1. juju666 Security Contributor
                    Experience ;)

                    --
                    .::. Security Contributor .::.
                    1. billmaxime Contributor
                      re juju

                      i’m going to make additional Canned Speech to properly warn and alert the user who asks for help (see: raise awareness) to this kind of issue

                      thanks for your tips

                      see you later
                      3. juju666 Security Contributor
                        Hi, I’m surprised that at this stage of disinfection no warning about Java has been given!

                        --
                        .::. Security Contributor .::.
                        1. billmaxime Contributor
                          Hi Kirabelle,

                          You ran it twice (zhpfix)

                          C:\ZHP\ZHPFix[R1].txt - 29/03/2013 19:41:26 [5946]
                          C:\ZHP\ZHPFix[R2].txt - 29/03/2013 19:45:11 [5564]

                          but it's okay

                          do this now

                          download purera to your desktop

                          the link https://www.commentcamarche.net/telecharger/utilitaires/18611-purera/

                          the configuration https://www.cjoint.com/c/CCxr5oR9p18

                          run it as administrator (right-click)

                          post only the last line (total space cleaned Mo)

                          see you later
                          • 1
                          • 2
                          • 3
                          • 4