Laptop Slow & Freezes

[jemmo]

[jemmo]

This is the RKill log from 09/10/14;

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 02/09/2014 09:58:49 PM in x86 mode.
Windows Version: Windows Vista (TM) Home Basic Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

* ALERT: ZEROACCESS rootkit symptoms found!

* C:\Users\Bev\AppData\Local\{2ee9930a-52c8-0f2f-2ea3-d7c248d7e63d}\ [ZA Dir]
* C:\Users\Bev\AppData\Local\{2ee9930a-52c8-0f2f-2ea3-d7c248d7e63d}\L\ [ZA Dir]
* C:\Users\Bev\AppData\Local\{2ee9930a-52c8-0f2f-2ea3-d7c248d7e63d}\U\ [ZA Dir]

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 02/09/2014 09:59:45 PM
Execution time: 0 hours(s), 0 minute(s), and 56 seconds(s)

[Gecko]

It looks like you might still have a rootkit let's try another removal tool.

Please download the (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
Vista/Windows 7 users right-click and select Run As Administrator.
If TDSSKiller does not run, try renaming it.
To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
Click the Start Scan button.
Do not use the computer during the scan
If the scan completes with nothing found, click Close to exit.
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
Copy and paste the contents of that file in your next reply.

[jemmo]

Nothing found.

[Gecko]

Well that's good.

So how is it running now?

[jemmo]

Was running better last night, but wifey says it's running slow again now.

Another ComboFix?

Oh hang on - McAfee is doing a scan. Always slows things down. Will update when finished.

[jemmo]

[Gecko]

Try running the TDSSKiller.exe rootkit removal tool again
Please download the (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
Vista/Windows 7 users right-click and select Run As Administrator.
If TDSSKiller does not run, try renaming it.
To do this, right-click on TDSSKiller.exe, select Rename and give it a random name (i.e. 123abc.exe).
Click the Start Scan button.
Do not use the computer during the scan
If the scan completes with nothing found, click Close to exit.
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
Copy and paste the contents of that file in your next reply.

[jemmo]

Ran the TDSS killer tonight - deleted 1 item.
Contents of the file are too big to be copied here and I can't upload a .txt file so have had to zip up - file attached.

[Gecko]

Good at last the root-kit was found and removed, this should resolve your issues.

If you do home banking from this system you might want to notify your bank and definitely change all your online passwords for safety.

[jemmo]

Many thanks for your help. Again.
Wish I could buy you a beer!