[mtnester]

I downloaded and ran Advanced System Care 8 which I used for to optimize my C: drive and clean my registry (laptop was running slow) it said I had driver updates available, so I proceeded to update--thinking it would help my laptop work faster/better and ignoring the "if it ain't broke, don't fix it rule" I normally follow.

Close to the end of the project my Comodo internet firewall popped up and disappeared really FAST several times in a row. My immediate thought was "uh-oh virus time," so I immediately ran a spyware scan which came up clean. I also did a virus scan with Comodo and another spyware scan with Malwarebytes all of which also came up clean. However--I found I could no longer save any files or download files from the internet. When trying to save a text document I get something like a "there are no more files" error message, and when trying to download files (like HiJackThis or other repair programs) nothing happens. Nothing at all. No error message or anything. Just nothing happens.

I hoped I could at least save the document on which I was working by using a USB stick; but although the laptop recognized the drive and said it was ready to use, when I tried to save my document there was an error message telling me to insert a disk in that drive. (Huh?) As a last step I have booted into safe mode with networking and find that I can save a text file and download files. I don't relish spending the rest of my computing life working in safe mode, though. It is a bit limiting.

How can I resolve this? I really, really, REALLY do not want to reinstall my OS; I have too many programs that would be a hassle to reinstall since I don't even remember which ones required a license or where to find that info, etc., etc., not to mention a boatload of photos, videos, and documents. I get that "please insert a disk into Drive F:" error message in safe mode as well.

Particulars:
Asus laptop UL80VT
4 GB RAM, Partitioned HD--C: 74 GB, 14 GB free; D: 208 GB, 61 GB free
No OEM disk; hidden partition only
Windows 7 Home Premium, x-64 version, 6.1.7601

Thank you, thank you!

 

 hijackthis.log   11.22KB   385 downloads

[Advertisements]

Hi  mtnester        

 

I'm 23red, and it'll be my pleasure to assist you with your problem.  To move us forward easier,  I'd be grateful if you would note the following:

 

•  Please make sure to carefully read every post completely before doing anything.
 
•  If you're not sure, or if something unexpected happens do not continue!  It is not a problem if you stop and ask! 
 
•  Please do not run any other scans or other download other software on your computer unless asked as it may make this repair more difficult.
 
•  Please stick with me until all malware is gone from your system.  Malware removal is not an instant process, just because you no longer see any symptoms it does not necessarily mean your system is completely clear.

 

•  Please copy/paste to Notepad and save my instructions as a text file on your desktop, or print them out, as you may not be able to access this thread at times. 

 

• Back up your data. I will not knowingly suggest your any course that might damage your system but sometimes Malware infections are so severe that only option we have is to re-format and re-install the operating system.

 

•  I do my best to respond as quick as I can.  I, like everyone else here am also a volunteer and sometimes life keeps me busy    If you feel I've missed you, please send me a PM!

 

•  Posts not replied to in 4 days will be closed.  Please PM myself or a Mod if you would like it reopened.  

 

 

I'd like to take a look with a different tool:

 

Please download Farbar Recovery Scan Tool and save it to your Desktop.

 

Note: You need to run the version compatible with your system.  If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

• Right click to run as administrator.  When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

 

Thank you

[23red]

Hi  mtnester        

 

I'm 23red, and it'll be my pleasure to assist you with your problem.  To move us forward easier,  I'd be grateful if you would note the following:

 

•  Please make sure to carefully read every post completely before doing anything.
 
•  If you're not sure, or if something unexpected happens do not continue!  It is not a problem if you stop and ask! 
 
•  Please do not run any other scans or other download other software on your computer unless asked as it may make this repair more difficult.
 
•  Please stick with me until all malware is gone from your system.  Malware removal is not an instant process, just because you no longer see any symptoms it does not necessarily mean your system is completely clear.

 

•  Please copy/paste to Notepad and save my instructions as a text file on your desktop, or print them out, as you may not be able to access this thread at times. 

 

• Back up your data. I will not knowingly suggest your any course that might damage your system but sometimes Malware infections are so severe that only option we have is to re-format and re-install the operating system.

 

•  I do my best to respond as quick as I can.  I, like everyone else here am also a volunteer and sometimes life keeps me busy    If you feel I've missed you, please send me a PM!

 

•  Posts not replied to in 4 days will be closed.  Please PM myself or a Mod if you would like it reopened.  

 

 

I'd like to take a look with a different tool:

 

Please download Farbar Recovery Scan Tool and save it to your Desktop.

 

Note: You need to run the version compatible with your system.  If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

• Right click to run as administrator.  When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

 

Thank you

[mtnester]

23red,

 

Thanks so much for responding; spent all PM and most of night trying to get Carbonite to back up files with partial success. Wouldn't finish even after restarting a couple of times. I'll just go with what I have.

 

Requested logs:

 

 FRST.txt   52.61KB   366 downloads

 

 Addition.txt   40.17KB   486 downloads

[23red]

Thank you for the logs   I'm going to study these, I'll post back quick as I can
 

[23red]

Hi mtnester
 
It is extremely likely the Advanced System Care caused the issue.  Registry cleaners are just plain dangerous and very unnecessary.  A registry cleaner will not increase your system's speed or performance, and has the potential to break your registry to the point that your PC is no longer bootable. We strongly advise that people stay away from any of the registry cleaners out there. Go HERE to get more information about why registry cleaners aren't needed.
 
 
If you need to start in safe mode with networking, do it. It's not a problem.

  Please attempt a regular boot after the Uninstalls.
 
Let me know how the computer is doing after these steps:
 
Step 1
Uninstalls
 
Please go to  Start ~>  Control Panel ~> Programs and Features and remove the following if present:

Advanced System Care 8
COMODO Internet Security
Java 7 Update 15
FlvPlayer
Yontoo
 
After that, Reboot the computer
 
Step 2
Antivirus
 
Come directly back here and then:
 
Choose one of the following free Antivirus programs and install it (These are direct links for you):
 
A.  Microsoft Security Essentials

or

B.  AVAST!
 
 
Once installed, run a full system scan, let me know if anything is found.

Step 3
Fresh FRST Scan

• Right click to run as administrator. When the tool opens click Yes to disclaimer.
• **Please check the Addition box.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste both logs back here.

When you return:

1.  Let me know how the uninstalls and install of Antivirus went.
2.  How is the computer running now? 
3.  Post the fresh FRST log
 
Thank You

[mtnester]

QuoteQuoteQuote

 1.  Let me know how the uninstalls and install of Antivirus went.
2.  How is the computer running now? 
3.  Post the fresh FRST log

 

 

Discovered uninstalls could not be done in safe mode, so used my Administrator account to do them. Used Iobit Powerful Uninstall to accomplish cleaning on a couple of them. All uninstalls seemed to go smoothly; but Comodo? What is wrong with it? I bought that and have run it for a couple or so years and didn't realize it could be causing any problems. I thought it was a hightly rated antivirus program. Please share what you know. Thanks.

 

Installed MS Security OK without having to go to Safe Mode, so apparently that part is fixed since before I couldn't download anything except in Safe Mode.

 

FRST folder was not on my desktop, so I rebooted into Safe Mode to get it from there since I had saved it on the SM desktop. Unfortunately, that did NOT go well since the logging screen got hung up at whatever comes after “Loaded: \Windows\System32\DRIVERS\CLASSPNP.SYS. ( wonder why System 32 drivers get loaded when I have a 64-bit machine?) I waited a couple of minutes took a screen shot w my phone then left the room for about 3 minutes. When I returned my “non Safe Mode” sign-in screen was coming up, so it had gone ahead and booted into regular mode. I don't know what happened there. A bit disturbing if I can no longer get into Safe Mode.

 

Downloaded a new FRST, left it in download folder and ran it. Am attaching the two requested files. Since they both were able to be saved to my laptop the problem of saving files/text seems also to have been fixed.

 

Should I also go ahead and uninstall my registry cleaners, then?

 

Thanks so much for helping.

 

 FRST.txt   52.57KB   416 downloads

 Addition.txt   41.3KB   332 downloads

 

 

Edited by mtnester, 08 February 2015 - 03:57 PM.

[23red]

Hello mtnester
 
Sincere apologies for the delay!  Family visiting.
Ok, as for Comodo, we can uninstall MSE and reinstall Comodo afterward if that is what you'd prefer. 
As for my thoughts on it? I've always been very happy with the aforementioned free AVAST! or MSE.
For myself, Comodo is more invasive, heavier ~ it has more processes and addons ~ and requires more user intervention and attention than I would like, and not necessarily as good as.

 

Downloaded a new FRST, left it in download folder and ran it.

 

 
 
Before starting, may you please copy and then paste FRST on to the Desktop.  Most Tools work better from there. I promise I'll clean them all up when we're done.
 

Should I also go ahead and uninstall my registry cleaners, then?

 
Absolutely!  Yes, please
 
 

Thanks so much for helping.

 
You're very welcome!
 
 

Please do the following in regular mode not safe mode.  If you are unable to, please advise before commencing:

Separate posts for the following scan results are not a problem
 
Alright, let's get to it:
 
 
Step 1
FRST Fix

Download attached fixlist.txt file and save it to the Desktop. ~>  fixlist.txt   4.8KB   316 downloads

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
 

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Step 2
Junkware Removal Tool

•   Please download Junkware Removal Tool to your desktop.

•  Shut down your protection software now to avoid potential conflicts.

•  Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

•  The tool will open and start scanning your system.

•  Please be patient as this can take a while to complete depending on your system's specifications.

•  On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

•  Post the contents of JRT.txt into your next post.

 

Step 3
ADWCleaner

1.  Please download AdwCleaner from this link to your Desktop.

•  If it happens to save to another location, right click the ADWCleaner icon and select Cut then right click on Desktop and select Paste.

2.  Right click on your Desktop, choose Run as Administrator.

3.  Accept UAC prompt.

4.  Accept AdwCleaner's Terms of Use.  And the AdwCleaner window opens:

5.  Click on the <~ Scan button and wait for the scan to finish.

6.  After the Scan has finished the window may or may not show what it found and above the progress bar you will see Pending..... Please uncheck elements you don't want to remove. Please check to be sure no good items accidentally got picked up.

7.  Once that is complete, click the <~ Clean button

8.  Once it has finished Cleaning, click the <~ Report button to get the log.

9.  Copy and Paste it into your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner.txt.
 

Step 4
Fresh FRST Scan

• Right click to run as administrator. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.

Step 5
Post!

1. Fixlog.txt
2. AdwCleaner.txt
3. JRT.txt
4. Fresh FRST log
5. Please advise how the computer is running and any issues you are currently experiencing.

Thank you

 

 

[mtnester]

Quote

 
Before starting, may you please copy and then paste FRST on to the Desktop.  Most Tools work better from there. I promise I'll clean them all up when we're done.
 

I copied FRST to the desktop and ran it again just in case there was a difference. The two .txt files are attached. I will then proceed to the rest of the directions.

 

 FRST.txt   54.28KB   317 downloads

 

 Addition.txt   41.57KB   353 downloads

[23red]

[mtnester]

23red,

 

I believe I am seeing sunlight at the end of the tunnel. Laptop seems to be running pretty well overall. At least I can save, download files, and retrieve and save files to a USB stick. I did lose some functionality re: recent documents list, but hopefully they will build again. Thanks!  I'm looking forward to finishing this little project, since I have another laptop that needs a different kind of fix.  

 

The reports you requested:

 

 

 AdwCleanerR1.txt   8.39KB   329 downloads

 

 JRT.txt   2.63KB   346 downloads

 

 Fixlog.txt   11.71KB   443 downloads

 

 FRST.txt   52.92KB   302 downloads

[23red]

Hello mtnester

 

Great work with the scans!     

 

 

I believe I am seeing sunlight at the end of the tunnel. Laptop seems to be running pretty well overall

 

 

Great to hear!     We are nearing the end.  Looks good from here.

A little bit left to remove and to check:

 

Step 1
Windows Sidebar Advice

 

It is no longer advisable to have this feature enabled as outline in the below Microsoft article:

Vulnerabilities in Gadgets could allow remote code execution 

I advise you download and run the Disable Windows Sidebar and Gadgets Fixtit Utility to rectify this.

 

Step 2
FRST Fix

Download attached fixlist.txt file and save it to the Desktop. ~>  fixlist.txt   1004bytes   288 downloads

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

Step 3
Malwarebytes

I'd like you to run Malwarebytes.  You already have it on your computer

Right click on Malwarebytes' icon and choose Run as administrator

• If an update is found, it will download and install the latest updates automatically:
  

   

   

• Now select the Settings tab, and check the box next to Scan for rootkits:
  

   

   

• Go back to the Dashboard tab, and click the Scan Now button:
  

   

   

• The scan may take some time to finish,so please be patient.
  

   

   

• When the scan is complete, it will show you the results.  (This one is clean):
  

   

   

• Make sure that everything is checked, and click Quarantine All (or similar).

   

   

• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.  (See Extra Note below)  If the log doesn't open, select View detailed log in the Scan tab:
  

   

   

• The log is automatically saved by MBAM and can be viewed by going to the History tab and clicking on Application Logs:
  

   

   

• Choose the latest Scan Log, and click on the View button:
  

   

   

• In the bottom of the Scanning History Log window that opens, you can click on Export > Save to Text file (*.txt).  Save the report to your Desktop.
  

   

   

• Copy & Paste the entire contents of the report log in your next reply.

 

Step 4
ESET Online Scanner

 

Please run a free online scan with ESET ~> *click here*

Note: You will need to disable your current installed Anti-Virus for the duration of the online scan, how to do so can be read here.

Vista / Win7 users: Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator.

Note: This scan works with Internet Explorer or Mozilla FireFox.

If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

 

• Click the    <~ ESET Online Scanner box
• A new window will open:
• Tick the box next to YES, I accept the Terms of Use
   then click on: Start ~> 
• You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology
• Click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close, make sure you copy the logfile first!
• Then click on: Finish
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

 

When you return please post:

 

1.  FRST fixlog.txt
2.  Malwarebytes' log
3.  ESET log.txt
4.  How is the computer running?  Any further issues?
5.  Are you going to reinstall Comodo or no?

 

Thank you

[mtnester]

Okay, after hours and hours of reading, re-reading, checking, and double-checking, let me give you first what went right.

 

 

 

Step 1
Windows Sidebar Advice

I downloaded and ran the Fixit Utility to disable the Windows Sidebar Gadgets, rebooted, and the desktop was clean.

 

 

Step 2
FRST Fix

Downloaded fixlist.txt to Desktop, ran FRST64, pressed the Fix button and waited until Fixlog.txt was generated.

 

 Fixlog.txt   3.23KB   309 downloads

 

 

Step 3
Malwarebytes

Selected Malwarebytes and ran as administrator, set it to scan for rootkits, the clicked the Scan button. When the scan completed the results showed that no malicious items were detected. The detailed log was exported to my desktop as a .txt file.

 MBAM 2-13-15 log.txt   1.04KB   285 downloads

 

 

Step 4
ESET Online Scanner

 

I disabled MS Security Essentials, checked all applicable boxes as instructed and started the ESET scan using IE. The signature database downloaded and the scan began, taking over six hours to complete.

 

Here is where things began going downhill.

When completed select Uninstall application on close, make sure you copy the logfile first!

I didn't see where I could select Uninstall, nor could I find a button to find the logfile. I did skip down to the instruction to open the logfile in notepad from Program Files\ESET … . The logfile is only 1 KB and has no real information. I had noticed when ESET began scanning there were about 7 threats detected immediately, and by the time the scan was finished it indicated there were well over 50 threats.

 

 log.txt   112bytes   229 downloads

 

At this point is where my laptop apparently went kaflooey. The ESET screen completely disappeared, as well as the right half of the IE screen. What was showing was that Geekstogo.com was not responding. (See screenshot 1).

 

 

After clicking around a bit trying to make something work I arrived at the screen arrangement in screenshot 2. Most of IE showed up again, but the tabs for the ESET website say Blank Page, even though you can see the left side of the page shows correctly. The files at the very forefront are OpenOffice files which I used for working copies of your directions and my notes.

 

 

The third screen shot shows what happened when I attempted to click on the section of the ESET site that was showing in the previous shot. I didn't get a screenshot of the next event, but the ESET Scanner re-appeared at the first step as though it had never run but was ready to go. This is where I have stopped for further instructions. I have been noticing that IE acts up on occasion and has to close and try to reopen a tab. This latest episode indicates that it doesn't want to work at all, since the only thing I could do was use Task Manager to kill the process tree and start again. After restarting I began typing a reply and explanation of events and uploading the files I was able to generate in the first couple of steps. Unfortunately, IE froze again and would not allow me to finish typing or upload anything more (i.e. the screenshots). I also could not copy the detailed explanations already typed—very discouraging, that. This time I am using OO to do my composing and will cut and paste into the reply box and hopefully be able to upload the requested log files—at least as far as I was able to get.

 

 

My question now is do I dare attempt to run the ESET scanner again? I have the impression it can be done only once before having to pay for subsequent scans. Am I correct? Should I try again downloading the special file for Firefox and run it there?

 

Please advise. That light at the end of the tunnel is getting dimmer and dimmer.

 

[mtnester]

Addendum: my dual core CPUs are running at near 100% even though the process tab showed IE using ~70% and occasionally taskmgr 2-4%. IE is not wanting to respond. I have switched to Firefox at the moment and keep getting stuck with "Not Responding" messages. CPUs stuck at 100% for a long time, but finally came down to 10%.

[23red]

Hi mtnester

 

Not a problem.  It does happen sometimes. ESET doesn't always mesh with all computers.  Sounds like it went a little nuts.
You can uninstall ESET from Programs and Features.  It is a free online scan, always available.
I suspect most of what it saw was already in quarantine from one tool or another. 
Have you rebooted yet?  If no, please do and please advise how the computer is doing.

 

Thank you

[23red]

Quick question:  Is the home page shown in the logs of your choosing?

 

 

FF Homepage: hxxps://login.secureserver.net/index.php?app=wbe&domain=email.tomarkit.com|hxxp://pinterest.com/

 

 

a similar one came into IE that was not there earlier:

 

hxxps://login.secureserver.net/index.php?app=wbe&domain=email.tomarkit.com

 

 

Are these set by you?  Please advise.

 

Thank you