Slow laptop with infuriating search engine redirect problem

[b16mts]

Jeff,

think ive done that one successfully.

thanks,

Martin

[jeffce]

Hi b16mts,

I see that you have Malwarebytes on your system. Please open Malwarebytes, update it and then run a Quick Scan. Please save the log that is created for your next reply.
----------

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the icon on your desktop.
4. Check
5. Click the Start button.
6. Accept any security warnings from your browser.
7. Check
8. Make sure that the option "Remove found threats" is Unchecked
9. Push the Start button.
10. ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
11. When the scan completes, push
12. Push , and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
13. Push the Back button.
14. Push Finish

http://www.eset.com/onlinescan/
----------

In your next reply please post the logs created by Malwarebytes and ESET online scanner.

[b16mts]

hi,

done those two, but cannot upload anything from eset, and it said no threats found and gave me no option to save a log etc.

have attached the malware log though

martin

[jeffce]

Yep...if there are no threats found by ESET there won't be a log.

How is your system running?

[b16mts]

Jeff,

It appears the redirect issue is sorted thank goodness. Computer still seems slow, but can live with that, unless you know of any way of cleabing it up to make it faster?

Thanks again for all your help :-)

Martin

[jeffce]

Hi,

Glad to hear that things are running better. Lets see about removing some temp files and this may help with your speed. You can keep this tool that I am giving you now to use for later as well. It is good to run about once a week.
--------

Old Timer Temp File Cleaner (OT TFC)

Please download TFC to your desktop
Note: Save any unsave work as running TFC will close ALL running application.

• Double click on TFC.exe to start the application
• Click Start to run the application.
• Let it run uninterrupted. It may take from few seconds to few minutes depending on the size of temporary file
• Once done, TFC will prompt for a REBOOT.
• Click Yes to reboot.

--------

After you have run that please reboot and then run a fresh scan with DDS and post both of the logs into your next reply.

[b16mts]

Jeff,

actually my wife has commented that she's really pleased that the redirect has gone and "its loads faster too", which is a bonus.

even quicker to boot now ive done the above.

attached the logs again.

thanks so much from saving my laptop!

Martin

[jeffce]

Glad to hear things are better.

Stick with me...we are almost done. Let's go back to the file we tried to send to VirusTotal. Let's remove that...

Please go to Start >> Run >> type CMD and press Enter. This will open the command prompt. Copy and paste the following text into the command prompt window and press Enter:

del c:\windows\system32\msratelcu.dll

Reboot your system and then run a fresh scan with DDS and post the new logs into your next reply.

Let me know how things are going now with the computer.

[b16mts]

Jeff,

tried to delete the file, but it keeps saying the file does not exist. guess there's not alot f point doing the logs as theyll be the same as the last ones i guess

martin

[jeffce]

Hi b16mts,

guess there's not alot f point doing the logs as theyll be the same as the last ones i guess

hahahahahahaaa!! Yep!! I am not sure why that would still be shown in the logs though?
----------------

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
----------

Please download OTM by OldTimer.

• Save it to your desktop.
• Please click OTM and then click >> run.
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
c:\windows\system32\msratelcu.dll

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.