12 replies to this topic

[mickey7]

Hello,

 

I am at my wits end and hope you all can help.  My coworker came to me yesterday and stated she was having issues connecting and could I look at her computer.  Everytime you clicked on one of the browsers it would just spin and time out.

I brought it home last night and looked it over.  She did not have any anti malware programs on so I thought simple, she must have some malware, I will install malwarebytes and clean up the machine.

 

Her machine is:

HP Windows 8 machine

AMD E-300 APU with Radeon

4GB Ram

64 bit operating system

no touch screen

 

I was able to install malwarebytes via flash drive and it updated via my wifi and ran it.  Found almost 500 threats.  Nothing on virus scan.(After it cleaned 2 threats previously ~~ per coworker. I did not at this point see reason to run it after the other scan.)

Rebooted and tried to go online.  Now instead of the spinning and timing out I get proxy errors on both Chrome and IE.  She has no other browsers installed.

I noticed some windows updates were needed and was able to get them installed without browsers but still the proxy errors existed.  I went into settings on both and went to LAN and tried to uncheck the use proxy box but it would not stay.  So I assumed more malware.

There are also a couple of items that the HP Assistant states need updating I was able to download (so it looked per screen) but apparently failed on install because all 3 are still showing after numeros attempts.

     HP System Event Utility

     Qualcomm Atheros AR9000 Series Wireless LAN Driver for Microsoft Windows

     Cyberlink MediaSuite 10-desktop

 

Reran malwarebytes, came back clean.  Installed and ran Malwarebytes anti root kit came back clean.

I have not been able to run or uninstall AVG even with removal tool.

I ran rogue killer and reset proxy.

I have turned off (who knew you couldn't uninstall IE in Windows 8?) and uninstalled Chrome.

Rebooted and turned IE back on.  Still proxy errors.

I installed HJT and ran it but it flashed a msg about hosts and then would not let me save a log to notepad when it was done.  I was also unsuccessful in trying to highlight and copy and paste it into notepad. 

 

Every time I check the wireless settings it states I am connected to the internet. All other machines, tablets and phones in house are fine in connections and browsing etc...

 

So here I am coming to you with no logs and a huge amount of frustration at my inexperience with Windows 8 hoping that someone will be able to provide me some hope in what my next steps would be.

 

Thanking you in advance......

[terry1966]

seeing how you mention host file, i think the first thing you want to try is to reset it, below are a couple of links with the answer on how to do that, with any luck that should solve your internet connection problems.

 

http://support.microsoft.com/kb/972034

http://answers.micro...fb-4412db9db971

 

not sure how avg got on there in the first place when you said there was no anti-malware programs on the machine, (don't forget windows 8 has it's own built in anti-malware program called defender which should be on there and up and running and what i'd suggest using instead of any 3rd party anti-malware/virus programs like avg) but try running the uninstaller again in safe mode once you've reset your host file.

if still no joy then i'd suggest installing the latest version of avg again and then uninstall it, with luck this should fix any problems your currently experiencing with removing it.

 

as for the rest not being able to run hjt and copy and paste etc, have no idea not being a windows user myself and never having used windows 8 but i would try running a dds scan instead of hjt and see if you have better luck with that, post the results in the malware part of the forum to make sure the pc is clean from infection.

 

this is a copy and paste from a post made by one of the sites malware team, which includes the dds links. in might be a good idea to follow all the instructions in it and post all logs in your malware topic just for thoroughness.

 

 

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
• Please be sure to subscribe to the topic if you have not already done so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.
 
Having said that....     Let's get going!!  
----------
 
Every computer that is infected should be inspected individually.
-----------
 

Please download DDS from either of these links
 
LINK 1
LINK 2
 
and save it to your desktop.

• Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
• Double click dds to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

---------------------------------------------------
Please include the contents of the following in your next reply:
 
DDS.txt
 
Attach.txt
----------
 

Please download TDSSKiller

• Double click TDSSKiller.exe
• Press Start Scan but do nothing else as we are just looking for what is there.
• If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
• Attach the log in your next reply
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

----------
 

 AdwCleaner
 
Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

----------

 

also add a link to this topic so the expert can see what's been happening with the laptop so far.

 

Edited by terry1966, 31 October 2014 - 08:43 AM.

[mickey7]

Ok reset host file no change>

Also forgot to mention that I did do a system restore with no change either.

I tried to boot in safe mode no luck.

Once again no luck uninstalling AVG either via control panel nor removal tool.

I have not downloaded a newer version and transferred it yet.

As I was not told to, I did not do anything with the scans except run them.  No fixes run etc.....

Please note when having me run and download things, that while I AM connected per wireless settings I CAN NOT access any web sites on my coworkers machine.  I must download and transfer via USB drive from my machine.  Being this is the case would I still be able to transfer ESET and run one of those scans?

Here are the results of the scans you suggested:
REMOVING SCAN RESULTS PER ADMIN REQUEST AND MOVED TO ANOTHER FORUM
 

Edited by mickey7, 31 October 2014 - 03:42 PM.

[mickey7]

And since there was not an option to attach a file, here are the results from the DDS scan:

REMOVING SCAN RESULTS PER ADMIN REQUEST

Edited by mickey7, 31 October 2014 - 03:41 PM.

[paws]

Hi Mickey7,

Your logs need to be posted over in the Virus and Spyware removal forum.

Here's the link that tells you the steps:

http://forums.whatth...howtopic=106388

(Please try and just make at first, the one post in that forum, do not post again in your topic there until you have received a reply as the malware removal experts often look for topics with Zero responses...if you make an additional post then they may think you are already receiving assistance and that could delay you getting the help you need)

 

As you are having difficulty downloading using your co workers machine the malware removal expert should be advised of this and they will provide you with detailed step by step steps on how best to proceed.

 

It would be very helpful if you would please remove the logs from your topic here.... It's only the Virus and Spyware removal forum that deals with these logs, and when the search enngines index these pages here, if they find your logs here folks might think that they should also post their logs here, and that we defintely don't want!

 

If you could remove them quickly then it would be very much appreciated.

Thanks

Regards

paws

[mickey7]

I have removed the scans..... sorry thought I was to post per the other poster. I have opened another topic in the other forum and attached the scans there.

[paws]

Hi Mickey7,

Very many thanks for your prompt action.

Hopefully one of the Malware removal experts will be along soon to analyse your logs over in the Virus and Spyware removal forum* and advise you on the best way forward.

Regards

paws

* link to Topic in Virus and Spyware removal forum

http://forums.whatth...901#entry857294

[mickey7]

Returning to this forum and topic per Ken in malware forum... They have declared it clean and are at a loss and suggested I repost in original forum.  Since scans are not permitted here, the following link show all work done and where we currently stand..... In a nutshell, still receiving exact proxy errors.  Any and all help gladly received, I just don't understand why it is not working.

 

http://forums.whatth...howtopic=128901

[terry1966]

ok at least you now know the problem isn't malware related.

 

there are a few different options to try in this link, with luck at least one will solve your proxy problem and enable you to connect to the internet again.

 

http://answers.micro...40-1461b8c01642

 

the problem may be caused by an ie add on or maybe even the avg program you can't seem to un-install, first one i'd try is to reset ie to default.

 

1. Close all Internet Explorer windows that are currently open.

2. Open the desktop, and then tap or click the Internet Explorer icon on the taskbar. Changing your settings will affect both Internet Explorer and Internet Explorer for the desktop.

3. Tap or click the Tools button , and then tap or click Internet options.

4. Tap or Click the Advanced tab, and then tap or click Reset.

5. In the Reset Internet Explorer Settings dialog box, tap or click Reset.

6. When Internet Explorer finishes applying default settings, tap or click Close, and then tap or click OK. You'll need to restart your PC for these changes to take effect.

http://windows.micro...ttings#ie=ie-10

 

Edited by terry1966, 02 November 2014 - 10:53 AM.

[mickey7]

Sorry terry, been there tried that several times ... no luck

[terry1966]

what you've tried all the options in the link including manually editing the registry? or just resetting ie?

 

maybe it might be worth trying to refresh windows 8. :-  http://windows.micro...efresh-reset-pc

 

try these first tho :-

 

Hey all, I have finally fixed the issue for me.

The original issue was that I was unable to uncheck the Proxy server settings. After unchecking it, I would exit the menu and it would recheck itself. I have attached a picture of the problem.

My fix was quite simple:

1) Safemode with Networking - restart your computer, and tap F8 repeatedly as soon as it starts back up, until a menu pops up with a bunch of options. Choose "safemode with networking". (My assumption is that this works because it starts your computer up with only the essential drivers, meaning the program that is causing your proxy setting to continue to check itself isn't even running when we start our computer up like this)

2) Internet Settings - Go back to the Proxy settings box, click "Advanced", delete everything on that window, click "OK", a Proxy error window will pop up. Click "OK", then uncheck the troublesome box, and make sure you check the box at the top of the window that says "Automatically detect settings" and voila! It should be fixed!

https://www.daniweb....ections-setting

 

if no luck then this :-

 

Let me fix it myself Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

To reset your Internet Explorer proxy settings yourself, follow these steps:

1. On Windows XP, click Start, or on Windows Vista or Windows 7, click
   
   , and then click Run. On Windows 8 or Windows 8.1, to access the Run command, press the Windows logo key
   
   + R. Or, swipe in from the right edge of the screen, and then tap Search (or if you are using a mouse, point to the upper-right corner of the screen, move the mouse pointer down, and then click Search).  Type Run in the search box, and then tap or click Run.
2. In the Run text box, copy (CTRL+C) and paste (CTRL+V) or type the following:
   reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
3. Click OK.
4. On Windows XP, click Start , or on Windows Vista or Windows 7, click
   
   , and then click Run. On Windows 8 or Windows 8.1, to access the Run command, press the Windows logo key 
   
    + R. Or, swipe in from the right edge of the screen, and then tap Search (or if you are using a mouse, point to the upper-right corner of the screen, move the mouse pointer down, and then click Search).  Type Run in the search box, and then tap or click Run.
5. In the Run text box, copy (CTRL+C) and paste (CTRL+V) or type the following:
   reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
6. Click OK.

 

http://support.micro....com/kb/2289942

 

Edited by terry1966, 02 November 2014 - 04:34 PM.

[mickey7]

I tried both resetting in IE and editing the reg via the methods above before.....

 

HOWEVER.... the first method in quotes above to boot in safe mode with networking did work.  I waited til now because I wanted to test several web pages and several reboots to make sure it stuck.

 

Thank you for your help.

[terry1966]

glad that fixed the problem, i didn't know what else to suggest.

 

you get avg fully uninstalled as well?