Slow computer and suspicious windows file and folder behaviour
Posted on 2007-10-03
I'm just about at my wits end with this computer at the moment!
Windows XP Pro SP2
Firewall - ZoneAlarm
Anti-Virus - NOD32
Anti-Spyware - see below
The computer is running very slowly, particularly when I'm on the internet. Opening links can be extremely slow and recently, sometimes when I do a search, the google search results page opens up OK, but any links I click on don't connect. I get a message dialogue box saying that my internet connection is OK and then have a range of options available like retry, ping, whois, etc (maybe that's due to a Firefox Extension I've installed - I'm not sure).
The weird things relate mainly to my directory structure(s) including things like - I have folders with multiple sub-folders but nothing in them (even when I show all files including those that are normally hidden). I have new folders added to the C:\ directory every now and then. In the C:\Temp directory, I have files and folders dating back a year or so, when I've run programs that clean out temp files in the last few days. Although I have IE7 installed, there is reference to IE5 when I run software to delete temp files etc
What I've tried to resolve the problems -
First I ran NOD32 - the first time I ran it in relation to this problem, I found I had an infection (Win32 Netsky).
I quarantined the offending files, found that they were residing in a folder I didn't even know I had under C:\Import. This directory, which was not created by me, seemed to be a duplicate of my C: Drive and contained 2 folders - Drive C and Drive D. I've since removed this directory to an external drive and don't think it's causing me any problems.
Then I ran NOD32 again and can't remember now whether I found no further threats or aborted the scan after it was taking so long (I mean hours and hours).
I then ran -
Spybot Search & Destroy
NTREGOPT (to optimise the registry)
There were no further threats detected and I had thought that the system should be pretty clean by this stage but there was still an issue with the speed.
Because of the Weird Things mentioned above, I thought I might have some corrupt windows files so I tried to do a Windows Repair but when I tried to select the option on the installation CD to install windows, I received an error message saying that the version of windows on my computer was a later version than what was on the disc and I couldn't get to the point where you would normally get the options to repair or install. Even though I've installed all windows updates and hotfixes etc, I'm pretty sure I've been able to repair windows files before using this method so I checked that the serial numbers matched using Belarc Advisor and they do.
I then purchased Uniblue Power Suite and ran Registry Booster and SpeedUpMyPC which seemed to make a difference but it was still taking a long time to do things like forwarding emails, accessing the internet, etc. Then when I ran SpyEraser (the 3rd part of the Power Suite), it scanned cookies, memory and registry fairly quickly, detected a few registry issues but was still scanning files more than 8 hours later. I sent Uniblue an email to see if this was normal and I received a reply saying it could be depending on what was running and to try running SpyEraser in Safe Mode which I did. Again, it scanned cookies, memory and registry fairly quickly, detected no registry issues this time, but was still scanning files more than 2 hours later so I had to abort the scan and get some real work done.
In the meantime, I had some extra RAM installed which has made a difference but startup is still slow, my Uniblue Power Suite had some components missing when I rebooted and Webroot SpySweeper has been removed.
In relation to the Weird Things, today I noticed another new folder under C:\Documents and Settings. A directory called Administrator:BACKOFFICE which contains directories for things I don't even recognise. I've also noticed a bunch of files in the root directory with an .sqm extension.
So, to cut a long story short, the strange files and folders thing is making me wonder if there is serious problem I haven't been able to detect/remove and the speed thing is still an issue.
Any thoughts on where to from here would be greatly appreciated.
If I need to run a HijackThis scan, would you mind including some instructions on what to do to be able to post it back here?