12 replies to this topic

[kangaroo]

I had a plea for help from an elderly friend who had not been able to access the Internet for a week. She has Windows 8.1 with ESET Internet Security. She reported that all lights on the router were on but neither of the two home page tabs loaded. She is using Internet Explorer.

 

I asked if she had powered the router off and on, which she had done several times. Each time all the router lights came back on but she still could not access the Internet. She had also powered off the computer several times. As she doesn't use the computer a lot, she normally shuts it down each day. This included turning power off at the wall plug.

 

I suggested she call her ISP's help but she got an Asian lady whom she could not understand. She then went to the ISP's local office and they arranged for a technician to call her back; although she spent 45 minutes on the phone she was left with the comment that someone was trying to access her computer and still no Internet access.

 

I was able to call on her today and found that the computer was in Airplane mode; turning this off showed that her Ethernet connection to the router had Internet access but still no pages would load although I tried several sites as well as her two home page tabs.

 

I then found that none of the shortcuts on her Taskbar responded nor did I get any response when I right clicked the Start button and tried to open Task Manager, Control Panel, File Explorer and others. None would respond except Run. I noted that the Run box had "www.teamviewer.com" entered but she was unaware of how this had been done; she had not been asked to enter this when on the phone to the technician.

 

I was able to enter "cmd" in the Run dialog and open a command window, do a "dir" and then exit.

 

I then tried to do a Shutdown and got the message that one application needed to close which soon disappeared and the screen went to black. However, when I tried to restart the computer it did not respond to the power button; I noted that the mouse lights were still on so I forced a shutdown by holding down the power button and heard the HDD switch off. I was then able to restart the computer and accessed File Explorer and pages on the Internet through Internet Explorer including her Gmail account and banking login page.

 

I then ran a scan with ESET which did not find any threats.

 

However, I am concerned that initially there had been no response to any attempt to run programs or access the Internet.

 

Are there any tests I could run to try and investigate what was going on and ensure that there is no malware on her computer?

[PhillPower2]

Hello Kangaroo,

 

This from a tech aspect and any signs that there could be a malware issue we will need to ask a security expert to take a look.

 

Download then run Speccy (free) and post the resultant url for us, details here, this will provide us with information about your computer hardware + any software that you have installed that may explain the present issue/s. 

 

To publish a Speccy profile to the Web:

 

In Speccy, click File, and then click Publish Snapshot.

In the Publish Snapshot dialog box, click Yes to enable Speccy to proceed.

Speccy publishes the profile and displays a second Publish Snapshot. You can open the URL in your default browser, copy it to the clipboard, or close the dialog box.

 

[kangaroo]

Hi Phill, Thanks for picking this up. I'll visit my friend this morning and run the Speccy report and post the Publish Snapshot url here.

[kangaroo]

Hi Phill,

 

The Speccy Snapshots published at: http://speccy.pirifo...ppAuEg7SuKcWMy8

 

I look forward to your further advice.

[PhillPower2]

Hello Kangaroo,

 

Thanks for the Speccy url 

 

Only thing of note in the report is the failed Windows update, we can come back to them but first of all we can check that there is nothing on the HDD that should not be there, please feel free to uninstall Speccy when you are ready.

 

Download from here then run Autoruns, save and upload the results for us “how to” below

 

1: Extract the Autoruns Zip file contents to a folder.

2: Double-click the "Autoruns.exe".

3: Click on the Hide Microsoft and Windows Entries

4: Go to File then to Export As or Save in some versions.

5: Save AutoRuns.txt file to known location like your Desktop.

6: Attach to your next reply.

 

Autoruns tutorial here

[kangaroo]

Hi Phill,

 

I ran the Autoruns64 application as this is a 64-bit system. I trust that is right.

 

When I used Save it defaulted to an .arn extension so I've saved this (took a few minutes) and was 6.4Mb so I've just kept a copy of it here. I then changed the save file type to .txt which save in a flash.

 Kangaroo.txt   50.27KB   390 downloads

Look forward to your further analysis.

Edited by kangaroo, 05 April 2018 - 01:02 AM.

[PhillPower2]

Hello Kangaroo,

 

That is most likely the cleanest Autoruns log that I have ever encountered, your friends computer is well cared for, well done 

[kangaroo]

Hi Phill,

 

Thank you; I'll pass on the compliment.

 

In your 3rd April message you mentioned, "any signs that there could be a malware issue we will need to ask a security expert to take a look."

 

Do you think we need to pursue this yet or was the unresponiveness just one of those intermittent things?

[PhillPower2]

Hello Kangaroo,

 

Credit where it is due 

 

I can only comment on tech related issues but I see nothing in the Autoruns log or the Speccy report that should not be on the computer, Autoruns is so clean that there are only two items that I would not have running on boot, Adobe and Winzip.

 

If the computer s now running as it should I would suggest three things, keep an eye on how it behaves in the future, any repeat of the behaviour check the Event Viewer logs to see if anything is flagged up, Event Viewer info here and check to see if the computer was updating at the time as that can cause some real frustrating problems such as lag and programs not opening/closing as they should and finally run regualar AV scans and download the free version of SAS from here

[kangaroo]

Hi Phill,

 

The computer has been running without issues since my original report.

 

I'll check the Event Viewer and let you know if I find anything untoward. I'll also check the AV scanning and make sure regular scans are done.

 

It may be a few days before I report again as I have to cope with one of my mini goats who had triplets yesterday which probably means bottle feeding one; the joy of having livestock!

Edited by kangaroo, 07 April 2018 - 05:08 PM.

[PhillPower2]

[kangaroo]

Hi Phill,

 

Nothing untoward in the Event Viewer and all running smoothly for now.

 

We've setup a regular malware scan so hopefully all will stay good.

 

Thank you very much for your support.

 

This request can now be closed.

[PhillPower2]

Hello Kangaroo,

 

Thanks for the update and glad to hear that is is now well with the computer 

 

You are welcome btw and thank you for the follow up