Laptop freezes and internet surfing causes ad popups [Solved]

Hello elbowpipe and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.

Please DO NOT run any scans other than those requested

I am looking at your logs now and will reply with instructions shortly.

Satchfan

Hello again elbowpipe

Registry cleaners

I see you are using a “Registry Cleaner”, Systweak. It's not a good idea to use registry cleaners/boosters.

The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid and erroneous entries does not affect system performance but it can result in "unpredictable results". Unless you have a particular problem that requires a registry edit to correct it, (and you are expert in the registry), I would suggest you leave the registry alone.

I strongly advise you to get rid of Systweak, Uniblue and any other cleaner/optimizer/booster/tuneup/tweak type utilities that you have on this or any other  computer.

One of the malware experts, miekiemoes, has an excellent write-up here
Another excellent article by Bill Castner is located here

===================================================

Uninstall programs

Please uninstall these programs:

BitGuard
Delta Chrome Toolbar
Delta toolbar  
Lyrics-Pal
PricePeep
SpeedUpMyPC

• click Start, Control Panel, Programs and Features
• click on BitGuard and then Uninstall
• repeat this for the other programs listed above.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.
 

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot - allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run aswMBR

• download aswMBR.exe to your desktop.
• double click the aswMBR.exe to run it
• if asked, accept the AVAST virus definition download
• click the "Scan" button to start scan
• on completion of the scan click Save log, save it to your desktop and post in your next reply. Note - do NOT attempt any Fix yet.

Please run OTL again and send a new log.

Logs to include with next post:

AdwCleaner log
aswMBR log
New OTL log

Thanks

Satchfan

Hi Duncan

I don’t see anything else malicious here and a couple more scans should show up anything else but as you have no active antivirus at the moment, please don’t use the Internet except to follow these instructions until I tell you you’re all clear.
 

I wondered about Win07codecs by Shark007?

Yes; uninstall that also.

Download Malwarebytes-Anti-Malware

Click here (at the top of the page, click on "Download Current Version")

• double-click mbam-setup.exe and follow the prompts to install the program – (Note: Vista & Windows 7 users, please right-click and select “Run as Administrator”)
• at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
• if an update is found, it will download and install the latest version.
• once the program has loaded, select Perform quick scan, then click Scan.
• when the scan is complete, click OK, then Show Results to view the results.
• be sure that everything is checked, and click Remove Selected.
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Can you tell me if there are any outstanding problems.

Satchfan
 

Hi Satchfan,

logs below:

SCAN:

I was going to install AVG as it's completely free whereas Malwarebytes runs out after trial?

Morning Duncan

Malwarebytes is not an antivirus but please don’t install any antivirus until we are all clear. I’ll advise you of some good free ones when we tidy up.

Meanwhile, we have a few more scans to run.

===================================================

Run Security Check

Download Security Check by screen317 from here or here.
 

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

===================================================

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• click the Eset online Scanner button.
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  

  
  o    click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
  o    double click on the Eset installer icon on your desktop.
   

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Scan archives and Remove found threats
• click Advanced settings and select the following:

  
  o    Scan potentially unwanted applications
  o    Scan for potentially unsafe applications
  o    Enable Anti-Stealth technology
   

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
  Note - if ESET doesn't find any threats, no report will be created.
   
• push the back button
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    Click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here.

Please tell me the situation now and if there are any remaining problems,

Thanks

Satchfan

Hi Satchfan,

ESET results below:

Hi

I have to leave for a while now but meanwhile, can you give me any information about the "Download App" - name or location etc.

Also can you send the other log (SecCheck) when you reply.

Thanks

Nina

Hi Nina,

Download App would appear to be what it says on the tin - it assists with downloading -  "powered by C|NET" ??

We’ll clear up what was found by the scan and then I’d like a different look.

Please copy all text in the code box below and paste it into Notepad:
 

@echo off
del /f /s /q "C:\Users\Simona\Downloads\FlashPlayer (1).exe”
del /f /s /q "C:\Users\Simona\Downloads\FlashPlayer (2).exe Win32/DomaIQ.F”
del /f /s /q "C:\Users\Simona\Downloads\FlashPlayer.exe”
del /f /s /q "C:\Users\Simona\Downloads\setup.exe Win32/Toolbar.Conduit.S”
del /f /s /q "C:\Users\Simona\Downloads\speedupmypc.exe Win32/SpeedUpMyPC”
del /f /s /q "E:\simona\Videos\BitLord Downloads\The Blind Side {2009} DVDRIP. Jaybob\jaybob's_movies_Toolbar_Firefox.xpi Win32/Toolbar.Conduit.A”
del /f /s /q "E:\simona\Videos\BitLord Downloads\The Blind Side {2009} DVDRIP. Jaybob\Jaybob's_Movies_Toolbar_Internet Explorer.exe”
del %0

• save the Notepad file to your desktop and name it delfiles.bat
• save type as "All Files"
• on your desktop, double-click on delfiles.bat to run it, (a black CMD window will flash, then disappear - this is normal).

==============================================

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.  

Link 1
Link 2

**Note:  It MUST be saved directly to your desktop. Choose save as and then make sure you choose Desktop

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.
 

• when finished, it will produce a report for you.  
• please post C:\ComboFix.txt in your reply.

Satchfan
 

Hi

Sorry for the delay.
 

There's a Download App which keeps being updated

We can stop this from starting up automatically.

Run HijackThis

Open HijackThis and click Do a system scan only.

Place a check mark next to:

O4 - Startup: Download App.lnk = C:\Users\Simona\AppData\Roaming\CBS Interactive\Download App\CBSI.AppStore.Main.exe

Close all windows except for HijackThis and click Fix checked.

=====================================

Submit a file to VirusTotal

There is a driver file here that I don’t know, (neither does Google). Unless you know what it is, we’d better check it out.

Go to VirusTotal and submit this file for analysis:

C:\WINDOWS\system32\Drivers\ryiqzhck.sys

• click on Browse
• click on the arrow and choose Local Disc (C:)
  
  🖼Click to load external image (ChooseLocaldiscC.jpg)
• below, double-click on Windows
• double-click on the System32 folder and then the Drivers folder
• locate the file ryiqzhck.sys click on it and then on Open
• click on Send File
• if you get a message saying File has already been analyzed, click Reanalyze file now.

You will get a report back; please post the report into this thread for me to see.

Thanks

Satchfan