Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Confirmed Yontoo and Possible Other Infection [Solved]


  • This topic is locked This topic is locked

#46
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
Well, I thought I would be updating shortly, but I had to wait for several thousand files to upload to Google Drive. It took all day yesterday.

The last two times that I went into Chrome settings Genio was not listed as one of the start pages. Only www.google.com appears there now. So no change made there. I deleted all the Chrome shortcuts as requested and then added a new one to the task bar from the specified location. Is Genio still showing up in the logs?

Ran OLT custom fix; log below.

When we first started working on this, yes I was connecting remotely, but early last week I retrieved the laptop from its offsite location and have been working on it directly. So no the shutdown is not related to the remote connection. It happens even when I'm sitting right in front of it. It has greatly improved, but on the last shutdown it still took almost 5 minutes. (However, since it was taking close to 20 when I got the laptop, this is a great improvement.)

Maps Galaxy Toolbar and Yahoo Toolbar have been successfully removed from Programs and Features. Thank you!

If you have any other suggestions regarding the shutdown time I would greatly appreciate it.


========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MapsGalaxy_39bar Uninstall\ deleted successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.69.0 log created on 07012013_123105
  • 0

Advertisements


#47
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts
Hello Velarie, I'm pleased those uninstall entries are cleared. We will deal with the Chrome issue to make sure once and for all that it is clear and start dealing with the shutdown issue. 5 minutes is quite a long time but 20 minutes is ridiculous, I'm pleased the PC is out of ridiculous mode :)

This is from your last scan. CHR - homepage: hxxp://search.genieo...0415,19432,11,0, I think it was a hijacked shortcut. This looks to be taken care of but to be on the safe side there is one more place I would like you to check in Settings:

  • In the Chrome Search Bar Copy and Paste the following: chrome://settings/ and press Enter
  • Under Search click Manage search engines and delete everything bar Google.
  • I'd be interested to know if Genio was listed there.

Shutdown Issue
  • Click Start, type msconfig in the Start Search box, and then press ENTER.
  • Check the Selective Startup box.
    Posted Image
  • Click to clear the Load Startup Items check box.
  • Click the Services tab.
    Posted Image
  • Click to select the Hide All Microsoft Services check box.
  • Click Disable All then click OK.
  • When you are prompted, click Restart.
  • Once back in windows does the problem still occur?

  • 0

#48
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
Yes Genio and Funmoods were both listed in the manage search engines section of Chrome settings. I removed them both, Bing and Yahoo. Left only Google.

I followed the instructions to shutdown all non-Microsoft services and then rebooted. The shutdown did not seem to be affected by this.

Awaiting your next instruction. And thanks for sticking it out. ;)
  • 0

#49
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts
Hello to you :)

Awaiting your next instruction. And thanks for sticking it out.

:lol: It should be me saying that. I really appreciate you sticking with me, the more I do the more I learn.

O.K so Chrome is now cool beans. Shutdown problems here we go.

Back into Msconfig again.

1. Shutdown Issue
  • Click Start, type msconfig in the Start Search box, and then press ENTER.
  • Now select the Services Tab click enable and uncheck Hide all Microsoft Services Everything is now back to the way it was.
  • Click the General Tab and check the Diagnostic Startup box. Click Apply then O.K
  • Restart the computer and shutdown. Problem still there? Yes or No lets set everything back to normal and soldier on :)

2. Normal Settings
  • Click Start, type msconfig in the Start Search box, and then press ENTER.
  • Now select the Services Tab Check Hide all Microsoft Services then click enable all
  • Now select the General tab and select Normal Startup then click Apply and O.K and everything is now back to the way it was.
  • Restart for changes to take effect


3. System File Checker
  • Click Start and type cmd in the search box. In the list that appears right click CMD and Run as Administrator
  • At the prompt copy and paste the following: sfc /scannow and press Enter
  • Let me know if anything was repaired.


4. Error Checking
  • Click Start and in the search box type CMD - You should see CMD under programs, right click and Run as Administrator.
  • CMD window will open, at the prompt copy and paste the following: CHKDSK C: /F /R and press Enter
  • Choose Yes (y) at the next prompt to schedule disk check and press enter.
  • Exit CMD by typing exit
  • Restart computer. This will check your hard drive for errors. I dont need to see a log just inform me if errors were found and fixed.

5. CHKDSK LOG
  • Click Start and in the search box type Event Viewer and press Enter See Image below
  • Click the small arrow to the left of Windows Logs then click Applications the events will show in a few seconds.
  • Scroll down the information list to locate the Wininit entry then Double click Wininit
  • In the window that pops up select Copy then open Notepad and Paste the log there.
  • Copy and Paste the log in your reply :)

Posted Image

Things I want to see in your next post.
  • Wininit log.

  • 0

#50
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts
Hi Velarie, just doing my 3 day check. Don't worry I know your busy and ChkDsk can take a very long time to complete :)
  • 0

#51
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
Yeah, my pesky job keeps getting in the way, lol. Actually had to spend a couple days frolicking in the sun with my kid. It is summer. ;)

Last Tuesday when I went back into msconfig, the 'hide all microsoft services' was unchecked already. On the services tab I re-enabled the services I want and then followed the instructions for a 'Diagnostic Startup'. It may have restarted 60 seconds faster. It did seem slightly quicker than the usual five minutes. Then I changed all the settings back to normal and rebooted.

Then I ran 'CHKDSK C: /F /R' and it did find and correct errors. "Windows Resource Protection found corrupt files and successfully repaired them."

I am back to work right now and will be completing the rest of the instructions you provided. I'll update the thread as soon as the scans are done.

Thanks for your patience.
  • 0

#52
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
Brain fart. I did the System File Checker not the Error Checking. Running Error Checking now.
  • 0

#53
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts
Awesome Sauce :) look forward to your reply.
  • 0

#54
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
I ran Error Checking, but fell asleep waiting for it to finish. Not sure what it did other than finish restart. Ooops.

************************************************************
Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 7/7/2013 2:57:51 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: owner-PC
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
115072 file records processed.

272 large file records processed.

0 bad file records processed.

0 EA records processed.

60 reparse records processed.

145882 index entries processed.

0 unindexed files processed.

115072 security descriptors processed.

CHKDSK is compacting the security descriptor stream...
Cleaning up 10015 unused security descriptors.
15406 data files processed.

CHKDSK is verifying Usn Journal...
34348128 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
115056 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
15504267 free clusters processed.

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

108953599 KB total disk space.
46665200 KB in 76157 files.
50440 KB in 15409 indexes.
0 KB in bad sectors.
220887 KB in use by the system.
65536 KB occupied by the log file.
62017072 KB available on disk.

4096 bytes in each allocation unit.
27238399 total allocation units on disk.
15504268 allocation units available on disk.

Internal Info:
80 c1 01 00 b8 65 01 00 26 72 02 00 00 00 00 00 .....e..&r......
74 45 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 tE..<...........
42 00 00 00 a2 73 f1 76 58 82 16 00 58 7a 16 00 B....s.vX...Xz..

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-07T19:57:51.000Z" />
<EventRecordID>52822</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>owner-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
115072 file records processed.

272 large file records processed.

0 bad file records processed.

0 EA records processed.

60 reparse records processed.

145882 index entries processed.

0 unindexed files processed.

115072 security descriptors processed.

CHKDSK is compacting the security descriptor stream...
Cleaning up 10015 unused security descriptors.
15406 data files processed.

CHKDSK is verifying Usn Journal...
34348128 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
115056 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
15504267 free clusters processed.

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

108953599 KB total disk space.
46665200 KB in 76157 files.
50440 KB in 15409 indexes.
0 KB in bad sectors.
220887 KB in use by the system.
65536 KB occupied by the log file.
62017072 KB available on disk.

4096 bytes in each allocation unit.
27238399 total allocation units on disk.
15504268 allocation units available on disk.

Internal Info:
80 c1 01 00 b8 65 01 00 26 72 02 00 00 00 00 00 .....e..&amp;r......
74 45 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 tE..&lt;...........
42 00 00 00 a2 73 f1 76 58 82 16 00 58 7a 16 00 B....s.vX...Xz..

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
  • 0

#55
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts
Hi Velarie, thanks for those. You can get the error checking log by doing the following:

  • Click Start and in the search bar type cmd in the list that appears right click CMD and Run as Administrator
  • Copy the following: findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" and Paste at the CMD prompt and press Enter
  • On your Desktop should be an SFCdetails.txt copy and paste in your next reply.

  • 0

Advertisements


#56
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts

I ran Error Checking, but fell asleep waiting for it to finish. Not sure what it did other than finish restart. Ooops.

You posted these results that's what the Wininit log is for. :)

This then made my brain do a fart as I asked you for the SFC log, which is the one I want to see.

To clarify - Error checking log posted and thank you.

SFC scannow log instructions above. I want to see what files were damaged and if they were fixed :)
  • 0

#57
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
Maybe I'm doing something wrong, but I can't 'cut n paste' into the command prompt. I carefully typed the requested command in and it replied, "can not open CBS log." I browsed to the directory through widows explorer and when I tried to open the log I got an 'Access Denied' error.
  • 0

#58
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
So I retried the command string with no spaces and it did produce and text document on my desktop, but when I opened it, it was empty.
  • 0

#59
Nutloaf

Nutloaf

    Trusted Helper

  • Malware Removal
  • 1,790 posts
O.K I only get those errors if I haven't run CMD as an Administrator and a blank page is presented when I run the command from a C:\> prompt.

Run as Administrator and you should have a C:\windows\system32> prompt. Also don't Cut, Copy and Paste :thumbsup:
  • 0

#60
velarie2112

velarie2112

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 108 posts
I did run as Admin. See attachment. I understand it makes a difference. I pay attention when told to 'Run As Administrator'. When I ran the scan I'm sure I did it as Admin as well.

Attached Thumbnails

  • findstr cbs log.jpg

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP