Slow startup; auto-turn off of Virus protection; Browser freeze

Hi peteinmaine,
 

HijackThis is an outdated program that just doesn't work well with modern operating systems.  Please run the following diagnostic tool:

[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe or FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

I see you have peer-to-peer (P2P) file sharing software installed on your computer (frostwire). I advise you avoid P2P file sharing programs; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infested with malware - worms, backdoor Trojans, IRCBots, and rootkits propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install malware. The best way to reduce the risk of infection is to avoid these types of web sites and P2P programmes. Please read the following articles for more information.

• Risks of File-Sharing Technology
• P2P Software User Advisories
• More malware is traveling on P2P networks these days

Your P2P software can be removed by following the instructions below.

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the aforementioned program, right-click and click Uninstall. Follow the prompts.

If you choose not to, please refrain from using the program during this process.
 
Other than that, let's just do a little straigtening up:



[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
  FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
  FirewallRules: [TCP Query User{08764A5A-5EEE-4445-BC2F-65FDBEAAA6C9}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
  FirewallRules: [UDP Query User{ACA56992-5223-40FF-BF86-909E7B199639}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
  FirewallRules: [{A87BABDF-98EA-442C-B4EA-75DE46A63945}] => (Allow) C:\Program Files (x86)\FrostWire 6\FrostWire.exe
  FirewallRules: [{83CF893D-B0EB-4E9A-AE25-A8ED12702F96}] => (Allow) C:\Program Files (x86)\FrostWire 6\FrostWire.exe
  FirewallRules: [TCP Query User{62A66E10-66EE-4AFC-B9F2-33DE3D62467E}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
  FirewallRules: [UDP Query User{DEB986D2-95CE-4D82-8F1D-B4A0F642F272}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
  S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys 
  
  
  CMD: ipconfig /flushdns
  CMD: netsh int ipv4 reset
  CMD: netsh int ipv6 reset
  EmptyTemp:
  end
  

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 
• NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.
  • Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the program.
  • Click Fix.
  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

Also, windows update looks like it is hanging.  Please try to manually run updates and let me know how it goes.

We'll remove the remnants of frostwire before I turn you loose.

The update history shows your full history.  All we care about are whatever is trying to update now.  Try manually updating again and then see if your history shows any current failures.

Hello 

Re: "Try manually updating again and then see if your history shows any current failures."  Aaahh, yes. I now see.  Thank you.  And NO current failures, (attachment)

Great!

Now let's run a couple more scans.

STEP 1
[external image: GfiJrQ9.png] Malwarebytes Anti-Malware (MBAM)

• Please download the Malwarebytes Anti-Malware setup file to your Desktop.
• Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the program. 
• Open Malwarebytes Anti-Malware and click Update Now.
• Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is selected and click Start Scan.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply. 
   

STEP 2
[external image: GzlsbnV.png] ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the program. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click [external image: esetListThreats.png]. If no threats were found, skip the next two bullet points. 
• Click [external image: esetExport.png] and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to [external image: KN1w2nv.png] and click [external image: SzOC1p0.png].
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.

Also, please let me know how things seem to be running.

One other issue is with viewing pics on the browser.  Ex: Yahoo page (see attachment)

This happens about 50-70% of the time, where pics are not displayed.

Boot up time has improved.

Malware Bytes Log & ESET Logs to follow:

=====================================Malware Bytes=====================================

One of the things that MBAM took out was Yontoo.  That is a very annoying PUP that can bring your computer to a crawl.  It usually come attached to a "free" download manager.  I suspect you'll notice some time improvement with it gone.

[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  C:\Users\pete\.frostwire5
  C:\Users\pete\Downloads\mp3rocket (1).exe
  C:\Users\pete\Downloads\mp3rocket.exe
  E:\Documents and Settings\pete\.frostwire5
  E:\Documents and Settings\pete\Application Data\OpenCandy
  E:\Program Files\FrostWire
  E:\WINDOWS\Installer\1a2bc3f.msi
  E:\WINDOWS\system32\ColorMedia.dll
  E:\WINDOWS\system32\m2gTmI.dll
  F:\My Documents\Downloads\frostwire-5.3.8.windows.exe
  F:\My Documents\Downloads\mp3rocket (1).exe
  F:\My Documents\Downloads\mp3rocket.exe
  F:\_OTL
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the program.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

As to the images… I believe you are using FireFox.  Give this a try:

Let's try resetting all of your browsers:

[external image: b8zkrsY.png] Browser Reset
 
Before proceeding, please refer to the following instructions on how you can backup your Favourites/Bookmarks.

• [external image: ehzOq95.png] Internet Explorer: Backup Internet Explorer Favourites
• [external image: Qlf57ne.png] Firefox: Backup Firefox Bookmarks
• [external image: U5NwUGc.png] Chrome: Backup Chrome Bookmarks
• [external image: MMFS6Lg.png] Opera: Backup Opera Bookmarks (scroll down)
   

Using the relevant instructions below, please reset your installed browsers.
As Internet Explorer is an integral part of Windows, please ensure you reset this browser.

• [external image: ehzOq95.png] Internet Explorer: How to reset Internet Explorer settings
• [external image: Qlf57ne.png] Firefox: Reset Firefox
• [external image: U5NwUGc.png] Chrome: Chrome - Reset browser settings
• [external image: MMFS6Lg.png] Opera: How to perform a clean reinstall of Opera
   

Let me know how it goes.

Hello Tomk,

All three are done (although I never use IE):

Chrome seems to be displaying pics better, including advertisements, LOL.

IE is so inter tied with the operating system that sometimes it will affect the others - even if you never use it.

So… it's better but not correct yet.  Hmm…  Let me think about it a bit more.  If I can't figure something out I'll send you to the Tech Team.

Hello Tomk,

Truth be told, my response about the pics displaying is guarded.  The proof will be in the pudding.

Currently, it appears that the pics are not completely being displayed. (See two instances of Yahoo page in one attachment)  As I click on the Yahoo pic news reel, there continue to be pics which do not display.  Previously the pic display was sporadic, mostly not.  And so, as I use Chrome more, I will be able to give a more confident answer.

I have also included an attachment showing a vid site of mine.  W/in the attachment, see the areas which should populate but fail to.  Instead, the "Loading" msg continues to appear. (i.e. hangs)