[whitlangr]

The geeks in my life have not had success in fixing this issue, so I am turning to you!

I got a new computer in October 2012 (Windows 7 OS), and the issue started in early December. Mozilla Firefox would freeze, crash, or just be very slow. In mid-December, Firefox would not open at all when I double clicked the icon on my desktop or when I clicked the link on the Start tab. Mozilla does not open whatsoever! Instead, what opens is the Mozilla Firefox Crash Reporter that says "Firefox had a problem and crashed. We'll try to restore your tabs and windows when it restarts. To help us diagnose and fix the problem, you can send us a crash report." Sometimes multiple Crash Report windows pop up. Sometimes the Crash Reporter from Firefox opens randomly when I am using Google Chrome or Internet Explorer, or even MS Office or something else not-web-related. Since Firefox itself won't open at all, I can't do anything I would normally do, like seeing if it works in Safe Mode, fiddling with the options, etc.

In mid to late December, I uninstalled and reinstalled Mozilla Firefox twice, I believe. However, in the last couple weeks, I cannot uninstall Firefox whatsoever. When I go to the Control Panel and Uninstall Programs tab, I can right click on Mozilla Firefox, hit Uninstall, and nothing happens. I can highlight the Mozilla Firefox icon in the list of programs to uninstall, click the Uninstall button at the top of the Uninstall Programs window, and nothing happens.

So what do you think I should do? I would really appreciate any help at all! I really don't want to lose my files or break my computer in half out of frustration! Thank you for your help and expertise.

PS: I ran OTL by Oldtimer in order to get logs to show you what was going on with my computer, but even that froze and crashed. It finished the scan, but never loaded the logs into a Notepad document. I was waiting for it to do that when it stopped responded. That's not a good sign, is it?

[Advertisements]

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.





I need to get some reports to get a base to start from so I need you to run these programs first.


-DeFogger-

• Please download DeFogger to your desktop.
  
  Double click DeFogger to run the tool.
  
• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.


-Security Check-

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

• Please download DDS from one of the links below and save it to your desktop:
  
  
  Download DDS and save it to your desktop
  
  Link1
  Link2
  Link3
  
  
  
  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    
  • DDS.txt
  • Attach.txt
• A window will open instructing you save & post the logs
• Save the logs to a convenient place such as your desktop
• Copy the contents of both logs & post in your next reply

information and logs

• In your next post I need the following
  
  
• both reports from DDS
• report from security check
• let me know of any problems you may have had

Gringo

[gringo_pr]

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.





I need to get some reports to get a base to start from so I need you to run these programs first.


-DeFogger-

• Please download DeFogger to your desktop.
  
  Double click DeFogger to run the tool.
  
• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.


-Security Check-

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

• Please download DDS from one of the links below and save it to your desktop:
  
  
  Download DDS and save it to your desktop
  
  Link1
  Link2
  Link3
  
  
  
  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    
  • DDS.txt
  • Attach.txt
• A window will open instructing you save & post the logs
• Save the logs to a convenient place such as your desktop
• Copy the contents of both logs & post in your next reply

information and logs

• In your next post I need the following
  
  
• both reports from DDS
• report from security check
• let me know of any problems you may have had

Gringo

[whitlangr]

Hi Gringo! Thank you so much for helping me. I will do everything you said in your post by later tonight and let you know. I am sorry for the late reply...work has been crazy lately, and I'm moving at the same time, so I apologize!

THank you again.

[gringo_pr]

No problem and I will be around all night tonight

[whitlangr]

Hi! I did the Defogger program...when I clicked the Okay button on the Finished window, Defogger did not close automatically. The box saying Disable or Re-enable was still open. I'm not sure if it was supposed to fully close or not, but just in case, I thought I would let you know.

I downloaded the Security Check program to my Desktop, and then I double-clicked it. Nothing opened, nothing happened.

I didn't do anything else in your recommended checklist because I know it has to go in a specific order. Since the Security Check didn't do anything (no Notepad document opened), I stopped there.

Any recommendations?

Thank you so much for your help!

[whitlangr]

I'd like to add that last night I tried to download Microsoft Silverlight to my computer to watch Netflix (hey, it's been a stressful week!). It never downloaded from IE or Chrome. Chrome after a couple minutes actually opened the Chrome window, but the window was blank and it was Loading the entire time.

It might be difficult for me to download and/or run things to my computer. But to fix it, I have to download and run certain tools! How do I get around this roadblock? I'm guessing that's what happened with the Security Check program...

[gringo_pr]

go ahead and run DDS so we can get a report to start


also use whatever you can to start the downloads and when the computer starts gewtting better we will use IE

[whitlangr]

I found the Defogger logs, though it says it is still checking:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:09 on 27/01/2013 (JWhitneyR)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-



Security Check is still not opening any windows. However, in Windows Task Manager in the Processes tab, it says that Security Check is running and using about 4,868 K of memory. Since I double clicked it multiple times (because I get frustrated a little too easily LOL), it is running about 6 processes right now.

I downloaded DDS to my desktop. It will not open the window you were talking about. I double click it again, and a window pops up saying that it is already running. On Windows Task Manager in the Processes tab, it says that DDS is running and using 5,924 K of memory. Even though I also double clicked DDS multiple times, it only has one process open.

I hope that helps. I also hope that my computer is not beyond repair!

Thank you!

[whitlangr]

I just noticed this, so I apologize for the multiple posts...

I downloaded Security Check twice (yes, you can tell I'm a novice who thinks hitting the computer is going to help fix it!). When I went to move the second one from my Downloads folder to my Desktop, which already had one on it, a window popped up saying I needed administrator access in order to replace files on my Desktop. I am signed in as the only account and administrator on this computer though, unless it's been hijacked...

[gringo_pr]

Hello


These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.


-AdwCleaner-

• Please download AdwCleaner by Xplode onto your desktop.
  
• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Delete.
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

--RogueKiller--

• Download & SAVE to your Desktop RogueKiller or from here
  
• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select "Run as Administrator to start"
• For Windows XP, double-click to start.
• Wait until Prescan has finished ...
• Then Click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• click on "delete"
• Wait until the Status box shows "Deleting Finished"
• Click on "Report" and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
• Exit/Close RogueKiller+

Gringo

[whitlangr]

I downloaded AdwCleaner, and it will open its window and start. However, after a couple minutes, it becomes unresponsive and must be closed.

I will run RogueKiller now.

[whitlangr]

RogueKiller worked! Yay!

When I tried to get the report from the RogueKiller program itself, it became unresponsive. Not yay.

However, it thankfully saved the report to my desktop like you said. Here it is:

RogueKiller V8.4.3 [Jan 27 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : JWhitneyR [Admin rights]
Mode : Scan -- Date : 01/27/2013 20:51:29
| ARK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
--- User ---
[MBR] dd7a4a81deca4c28f20e50a6762c3220
[BSP] 6a4d86d5acfff778e2c8e3feac687f4b : KIWI Image system MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 931349 Mo
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1907609600 | Size: 22419 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: SanDisk iSSD P4 8GB +++++
--- User ---
[MBR] a9232299b552b7ec6e5a3854e401f884
[BSP] 0a9420da5d388cf72c9f5653515471d4 : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNOWN (0x73) [VISIBLE] Offset (sectors): 2048 | Size: 7639 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_01272013_02d2051.txt >>
RKreport[1]_S_01272013_02d2051.txt

[whitlangr]

RogueKiller actually saved a second report, RKReport[2]:

RogueKiller V8.4.3 [Jan 27 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : JWhitneyR [Admin rights]
Mode : Remove -- Date : 01/27/2013 20:52:14
| ARK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
--- User ---
[MBR] dd7a4a81deca4c28f20e50a6762c3220
[BSP] 6a4d86d5acfff778e2c8e3feac687f4b : KIWI Image system MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 931349 Mo
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1907609600 | Size: 22419 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: SanDisk iSSD P4 8GB +++++
--- User ---
[MBR] a9232299b552b7ec6e5a3854e401f884
[BSP] 0a9420da5d388cf72c9f5653515471d4 : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNOWN (0x73) [VISIBLE] Offset (sectors): 2048 | Size: 7639 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2]_D_01272013_02d2052.txt >>
RKreport[1]_S_01272013_02d2051.txt ; RKreport[2]_D_01272013_02d2052.txt

[gringo_pr]

Hello

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

[whitlangr]

Hi Gringo! I have been running Combofix on my computer since LAST NIGHT. It is not even halfway through yet. I disabled all my antivrius and firewall stuff before I started Combofix, and I have not clicked on the Combofix window. The little green bar showing Combofix's progress is still "shining" with that white shine going along the green bar every couple seconds. I don't think it's frozen because of that white shine thing going on...but is it normal for it to take this long? Am I doing something wrong?

Thank you for your much needed help! I really appreciate it.