Windows 8 browsers freezing. Other devices are OK. [Solved]

Hello elbowpipe and welcome back to the WTT forum.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

This might not be a malware problem but here are a few entries in your logs that need to be dealt with and I’d like another couple of scans before going any further.

Run Zoek

Please temporarily disable your AV program.

Download zoek.exe to your Desktop:

Important: Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.
 

• on Windows Vista, 7, 8 and 10, right-click Zoek.exe and select: Run as Administrator
• give it a few seconds to appear
• copy/paste the entire script inside the codebox below into the input field of Zoek:
  

  autoclean;
  emptyalltemp;
  emptyclsid;
  FFdefaults;
  iedefaults;
  chrdefaults;
  

• close any open programs.
• click the Run script button, and wait. It takes a few minutes to run.
• when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\
• if a reboot is needed, the log will be opened after the reboot.

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

Logs to include with next post:

zoek-results.log
RKreport.txt

Thanks

Satchfan

Hi Nina,

I know, I only get in touch when I want something! I started running the kit and then I wondered about being in safe mode (it's the only way I can get on the Internet). Should I run the reports in normal mode and then switch to safe to send them?

Duncan

Hi Duncan

Yes, please run them in normal mode.

Nina

Hi Nina,

reports attached. Thanks

Thanks for the logs.

I'm not familiar with OCS software or Blackboard.

Can you tell me if use them and if so, what they are.

Thanks

Nina

Not sure about OCS software. I used Blackboard as part of a learning technology suite, but I use neither now.

OK thanks.

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

• close all programs
• double-click RogueKiller.exe - Windows 7/8/10 users right-click the program and select Run as Administrator'
• after it has completed it's prescan, click on Scan
• click on the click on the ‘FilesSystem’ tab
• make sure the following entries there are checked:
  

  
  [PUP.Gen1][Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec -> Found
   

• click on the click on the ‘Registry’ tab
• make sure the following entries there are checked:
  

  
  [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\Link64 -> Found
  [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\OCS -> Found
  [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\Link64 -> Found
  [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\OCS -> Found
  [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyFreeCodec -> Found
  [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyFreeCodec -> Found
  [Suspicious.Path|PUP.Gen0|PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\Microsoft\Windows\CurrentVersion\Run | VideoDownloaderUltimate : C:\ProgramData\VideoDownloaderUltimateWinApp\VideoDownloaderUltimate.exe /repair [x] -> Found
  [Suspicious.Path|PUP.Gen0|PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-222209725-2823862911-2758884793-1001\Software\Microsoft\Windows\CurrentVersion\Run | VideoDownloaderUltimate : C:\ProgramData\VideoDownloaderUltimateWinApp\VideoDownloaderUltimate.exe /repair [x] -> Found
  [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\aswVmm (\??\C:\Users\DUNCAN~1\AppData\Local\Temp\aswVmm.sys) -> Found
  [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{0F061F83-001B-43C8-95AF-2F1F4D22A277}C:\users\duncan macinnes\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\duncan macinnes\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe|Name=javaw.exe|Desc=javaw.exe|Defer=User| [x] -> Found
  [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{B772EA28-F682-4465-B91B-02F8426D0175}C:\users\duncan macinnes\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\duncan macinnes\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe|Name=javaw.exe|Desc=javaw.exe|Defer=User| [x] -> Found
  
   

  NOTE: Do NOT select these:
  
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5CCDE653-E20A-47AF-AFDA-000261DC0389} | DhcpNameServer : 172.20.10.1 ([])  -> Found – Private IP address of router/modem
  
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FCADB591-D985-4DF6-BD5A-7F38476CEC4E} | NameServer : 217.171.135.1 ([United Kingdom])  -> Found
   
• then press the Delete button and post the log it produces.

===================================================

Run Farbar Service Scanner

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services
Windows Firewallsfc
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other Services

• press "Scan".
• it will create a log (FSS.txt) in the same directory the tool is run.
• please copy and paste the log to your reply.

Logs to include in the next post:

RogueKiller fix log
FSS.txt

Thanks

I won’t be around for a few hours now but will get back as soon as I can.

Are you still unable to access Firefox & Chrome?

Nina

Hi Nina,

here are the logs. The good news is I didn't have to go into safe mode to post this.

That all looks fine.

How are things now?

Yeah, I'm back browsing again. Thanks so much. Any advice on protection? I have Avast installed. Should I pay for Malwarebytes?

I have Avast installed

My choice is Windows Defender but Avast is fine.

Should I pay for Malwarebytes?

Your choice again. I personally don't but many of the Malware Team do. I would suggest in your case that it's a small price to pay for the excellent protection it gives these days.

I'll leave this open for 24 hours in case there are any remaining problems.

Take care Duncan and happy piping.

Nina

Thanks once again. I'll play 'An Eala Fhiain' (the one you liked) in the pub for you tonight. "This one's for Nina the Tech". 

I'll play 'An Eala Fhiain' (the one you liked) in the pub for you tonight. "This one's for Nina the Tech".

Thank you Duncan, much appreciated.

I was just listening to you on Soundcloud playing The Wild Geese and it's so haunting, (reminds me of the Lonesome Boatman).

Enjoy tonight.

Nina

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.