[mtnester]

Quick question:  Is the home page shown in the logs of your choosing?

 

The tomarkit.com URL is my webmail domain with GoDaddy. I noticed the last time I started IE, however, that the home page was set as MSN. I never use that, so I don't why/how that was changed. I deleted that and set my preference once again to reopen the last session.  

 

It does happen sometimes. ESET doesn't always mesh with all computers.  Sounds like it went a little nuts.
You can uninstall ESET from Programs and Features.  It is a free online scan, always available.
I suspect most of what it saw was already in quarantine from one tool or another. 

 

 

I uninstalled and deleted the ESET folder from the x86 program files just for good measure. I started ESET again and it ran for nearly 8 hours. It looked like it got to the end of Step 3 before inexplicably stopping. It hadn't found anything to that point, but it bothered me not to complete. I had set it to run during the night, which it had done successfully the first time before getting to the point of making the log. I decided to try one more time; uninstalling, reinstalling, turning of MS Security, My laptop is set not to sleep while it Is plugged in except for the display.

 

Have you rebooted yet? 

 

 

Several times. I am able to save and download files. The only problem now is one that I had not previously mentioned; i.e., Firefox frequently goes into "not responding" mode and IE constantly loses and recovers tabs. I'll let you know what happens after this last attempt at using ESET.

 

Thanks.

 

 

 

[Advertisements]

One other thing to ask. Are there any other programs you noticed that I should remove from my computer because they might cause more problems than they solve? Thanks again.

Edited by mtnester, 15 February 2015 - 09:26 PM.

[mtnester]

One other thing to ask. Are there any other programs you noticed that I should remove from my computer because they might cause more problems than they solve? Thanks again.

Edited by mtnester, 15 February 2015 - 09:26 PM.

[mtnester]

I did another ESET scan and got to the end of Step 3 before the timer stopped. Since it appears to have done nothing for the past several hours (timer has not changed from 10:21:08) I assume it is okay to use the mouse and keyboard. Attaching screenshot.

 

I don't know what to do next; if it didn't finish I would suppose there is no log. It appears that no threats were found so perhaps it is moot. I have left the online scanner open, but feel I should turn virus protection back on.

 

I will wait for further instructions from you.

 

Thanks.

 

 

 

 

 

[mtnester]

I turned on MS Security and ran a full scan. Everything OK! Only problems I'm experiencing now are software related.

 

Awaiting further instructions when you are ready.

[23red]

Hi mtnester
Apologies for the delay.

 

The tomarkit.com URL is my webmail domain with GoDaddy. I noticed the last time I started IE, however, that the home page was set as MSN. I never use that, so I don't why/how that was changed. I deleted that and set my preference once again to reopen the last session. 

 

 

Good to know

Instead of risking registry edits do this to add or change home pages:

 

For Internet Explorer

1.  Open an Internet Explorer window.
2.  Click the Tools button
3.  Click Internet options.
4.  In the General tab, under Home page, enter the URL of the site you want to set as a home page.

 

For Firefox

1. Open a tab with the web page you want to use as your home page.
2. Drag and drop that tab onto the Home button .
3. Click Yes to set this page as your home page

 

As for ESET, not a problem ~ we'll switch to another online scanner.

 

Panda Cloud Cleaner

Download Panda Cloud Cleaner and save it to your desktop.

Alternate download sites are here and here.

• Double-click on PandaCloudCleaner.exe. When the Setup - Panda Cloud Cleaner window has loaded choose Next and then Next
• Ensure Launch Panda Cloud Cleaner is selected. Click Finish Once the window appears. Click on Accept and Scan
• Please be patient as the scan may take some time to complete depending on your system's specifications.
• Once the scan has completed, if Scan finished with detections is denoted in the window do not take any action and or have Panda Cloud Cleaner clean anything!
• Now within the window click on the (or any or them if multiple) tab then on View Report a notepad file should now open called PCloudCleaner.txt
• Save this to your desktop and post the contents in your next reply.
• Then click on Back then Exit

Note: When we're all done here feel free to uninstall Panda Cloud Cleaner if you so wish.

 

 

 
When you return please post:

 

PCloudCleaner.txt Log

How is the computer running?

 

Thank you

[23red]

Hello mtnester

 

Were you able to run Panda Cloud cleaner?

 

 

I turned on MS Security and ran a full scan. Everything OK!

 

 

Great! All is running well, then?

 

 

Only problems I'm experiencing now are software related.

 

 

Please explain further.

 

 

One other thing to ask. Are there any other programs you noticed that I should remove from my computer because they might cause more problems than they solve? Thanks again.

 

 

Actually you've done well removing the unnecessary   Registry cleaners and the like are unnecessary and do definitely cause more issues than they solve. 

 

If all is well, let's check your security for vulnerabilities:

 

 

SecurityCheck by Screen317:

 

Please also download Security Check by screen317.

 

•Save it to your Desktop.

 

•Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.

 

•A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!  Try rebooting the system and then run SecurityCheck again.

 

When you return please post the checkup.txt. 

 

Thank you

[mtnester]

I've been working on your Feb 17 post and trying to figure out how to report its working condition. I saved two log separate log files from the Panda cleaner from the two tabs that reported items. As it often seems to happen, even though I saved the reports from tabs 2 and 3 in separate files with different names, only one of them actually can be found anywhere. I was very careful about this. Both log files were open at the same time with different names before I closed them. Now of course I'm sorry I did that instead of copying and pasting them.

 

I can't attach the file that exists--the attach files uploader says "This upload failed," so here are the contents:

 

 

Unknown. FILE: C:\PROGRAM FILES\ATKGFNEX\GFNEXSRV.EXE to be deleted.
Unknown. REGKEY: HKLM\SYSTEM\CurrentControlSet\Services\ATKGFNEXSrv. Key to be deleted.
Unknown. FILE: C:\PROGRAM FILES (X86)\PINTEREST\PIN IT\AUTOUPDATER.EXE to be deleted.
Unknown. TASK: Task\[PinItAutoUpdate]. Task to be deleted.
Unknown. FILE: C:\PROGRAM FILES(X86)\AMICOSINGLUN\AMICOSINGLUN64.EXE to be deleted.
Unknown. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run[AmIcoSinglun64]. Value: AmIcoSinglun64 To be deleted.
Unknown. FILE: C:\PROGRAM FILES (X86)\ASUS\ASUS DATA SECURITY MANAGER\ADSMSRV.EXE to be deleted.
Unknown. REGKEY: HKLM\SYSTEM\CurrentControlSet\Services\ADSMService. Key to be deleted.

 

Do you want me to run it again to get the results for the System Cleaning? As I remember there were 3 files indicated.

 

 

Quote

Only problems I'm experiencing now are software related.

 

 

Please explain further.

 

Briefly, browser problems.

 

1. In IE11 every time I close a tab or window, IE stops working:

 

 

Otherwise it works very s-l-o-w-l-y. Often I cannot use the scroll bar to go up or down a page or drop down list. There are long pauses while I wait for something to happen when I click a button or link. Just because I'm persistent (stubborn) I spent 3 hours doing things online that would normally have taken less than 20 minutes.

 

 

2. XMarks for IE--will not sync:

 

 

Searching the XMarks user guide tells me that this is a Windows error and links to a Windows error listing--which *not* to my surprise does not list -50. A proffered solution was to download the bookmarks from the XMarks website, thereby overwriting any existing bookmarks. I couldn't do that either--nothing would download.

 

 

3. Firefox issues. First, don't have a heart attack, but I am accustomed to running Firefox wih as many as 735 tabs in about 20 windows. I expect things to run rather slowly, but that's the way I do it. I don't want to lose tabs I've opened so that I can move among them. My latest efforts had reduced the Firefox load to about 7 windows with something over 500 tabs. Anyway, it normally works okay. I use an add-on called Session Manager, which has apparently stopped working. When I open Fx my home window opens, but sometimes that's all and it goes into "(Not Responding)" mode; sometimes I do get the Session Manager window to allow me to open any of several previous (or crashed) sessions. Sometimes I can select a session which may or may not open going to "(Not Responding)." Here is a sample of my Task Manager screens:

 

 

 

 

These screens are actually a sample of what I see when I can't even get Firefox to come up on the screen at all. The memory usage should be in the range of nearly 1GB when fully opened, this time it got stuck at this point.

 

Okay, so while you mull that over (or not). I'll go to your last set of instructions and carry them out.  (Why didn't my smiley show up when I clicked on it, I wonder?)

 

 

 

 

[mtnester]

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:`````````
 Panda Cloud Cleaner   
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1)
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 iolo Common Lib ioloServiceManager.exe
 iolo System Mechanic iologovernor64.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
 

 

How do you think I stand?

[23red]

Looks good from here!  How is it running on your side?  I'm going to look into your previous post up there ~ Be back quick as I can with more info for you.

[mtnester]

 

•A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

The scan results:

 

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:`````````
 Panda Cloud Cleaner   
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1)
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 iolo Common Lib ioloServiceManager.exe
 iolo System Mechanic iologovernor64.exe  
 iolo Common Lib MESSAG~1.EXE
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
 

 

Look good?

 

 

[23red]

Hi mtnester

 

Yes! Looks good!

 

When I said everything looks good on my end previously, I meant I see no malware related issues.  Your logs look clean!  
The issues you are currently having do not appear to be malware related.  Let's finish up with that before we move on.

 

Step 1

 

First, we'll clean up the tools and the mess I've made on your Desktop:

• Download Delfix by xplode from here.

   

   

• Ensure Remove disinfection tools is ticked

   

  Also tick:

  • Create registry backup
  • Purge system restore

   

  

   

• Click Run

The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.

 

 

Between XMarks and Session Manager there appear to be many issues.  Both of them likely could have been damaged. 

To that end, backing up the bookmarks in preparation for a new XMarks install should be done first:

 

Step 2
Backup Bookmarks

 

There is infomation here on how to back up Bookmarks. 
There is also information there on importing the bookmarks back.

 

If you have any questions before you start, please ask!

 

Step 3
Uninstall XMarks

 

From what I can see an updated fresh version may be in order.  Newer versions will likely work better.

In your log I see:

Xmarks for IE (HKLM-x32\...\{ABFA6EAE-C9C0-4B39-B722-02094EF6B889}) (Version: 127.0.177 - Xmarks)
Xmarks for IE (HKLM-x32\...\{D9933B87-F472-486A-BC56-9D04FD6838EF}) (Version: 127.0.162 - Xmarks)
Xmarks Thumbnails for IE (HKLM-x32\...\{84513125-0BC7-46F8-BE1E-309263B79AE2}) (Version: 1.0.12 - Xmarks)

 

The last version of XMarks listed for IE is 1.3.15

 

After backing up your bookmarks in Step 2, uninstall the older XMarks:

 

Please go to Start ~> Control Panel ~> Programs and Features and remove any/all versions of XMarks.

*Fresh Updated XMarks download located here

 

Import the bookmarks.

 

Step 4
Session Manager

 

Session Manager may well be damaged which is a good possibility why you're having issues.

First, remove the old one:

 

Open Firefox:

1. Click the menu button and choose Add-ons.
The Add-ons Manager tab will open.

2.In the Add-ons Manager tab, select the Extensions or Appearance panel.

3. Select the add-on you wish to remove.  In this case: Session Manager

4. Click the Remove button.

5. Click Restart now if it pops up. Your tabs will be saved and restored after the restart.

 

*Install a fresh Session Manager from this link.

 

Step 5
Post!

 

When you return please post:

1.  Delfix log
2.  Please advise how the other steps went for you, if it helped
3.  Everything running good?

Thank you

 

[mtnester]

Yikes.  I'm stuck at Step 1 because "This page can’t be displayed." I'm using my Admin account and I tried it in both regular and Safe Mode with the same result both ways. The page it takes me to is this:

http://general-chang...xplode/9-delfix

 

I have no idea why it won't load. (Using IE 11) Any ideas?

 

Thanks.

[23red]

Upon checking, it appears the link is down at the moment.  I'll prepare manual instructions to clean up in case it does not come back up shortly.  You can go ahead and try the link later on if you wish and post the log if you're able to run the tool.

  How is the computer running otherwise?  Did the above help?

 

Thank you

 

[23red]

 The link for  Delfix is back up and running ~ It should be fine now.

When you are ready

[mtnester]

23red,

 

Unfortunately I have only been able to work on the first three steps in your posting before running into a problem. Let me begin with what I've faced today in the current state of affairs.

 

Downloaded the required file (took 2 tries) before bed and just booted up to respond to an IM before working on your assignment. I know I demand a lot of my small dual-core 4GB laptop so there is a lot that goes on after it starts waking up. Here's an example with current events:

 

System Idle process may show 60-80% and yet I the little plus sign before Pictures doesn't appear so that I can select a folder to which to move a downloaded photo. As soon as I selected the plus sign it disappeared. I tried the + in front of music with the same result. Little crazy things like that. I believe because IE suddenly decided to become active when I read an email, then MBAM got all excited and decided to take up major CPU time. Even after getting CPU usage down to about 30% the +s still don't appear in explorer so I can transfer the photo download. Then I just got this popup error:

 

 

 

Now Xmarks has decided to jump in and take up 50% of my CPU. I killed that tree since you are going to have me do something with it later.

 

Typical CPU usage jumps up and down like a yoyo.

 

Mbam.exe and mbamservice.exe taking 318824 of memory; does that sound right?

Things eventually settled down and I got my file transferred to the photo folder I wanted.

 

Next I was trying to communicate with customer service on a website, but there is no response to the Send Message button. Nothing happens. CPU is at about 60%. Tried to close a tab to reduce memory and froze IE. Can't close Task Manager although I could change tabs and kill IE.

 

Just giving examples of “how things are working.”

 

 

 

Now, DelFix log:

DELFIX:

# DelFix v10.8 - Logfile created 24/02/2015 at 13:55:52

# Updated 29/07/2014 by Xplode

# Username : Shirley - MIMI-LAPTOP

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

 

~ Removing disinfection tools ...

 

Deleted : C:\FRST

Deleted : C:\AdwCleaner

Deleted : C:\Users\Shirley\Desktop\FRST-OlderVersion

Deleted : C:\Users\Shirley\Desktop\AdwCleaner.exe

Deleted : C:\Users\Shirley\Desktop\FRST64.exe

Deleted : C:\Users\Shirley\Desktop\JRT.exe

Deleted : C:\Users\Shirley\Desktop\SecurityCheck.exe

Deleted : C:\Users\Shirley\Downloads\Addition.txt

Deleted : C:\Users\Shirley\Downloads\FRST.txt

Deleted : HKLM\SOFTWARE\AdwCleaner

Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

 

~ Creating registry backup ... OK

 

~ Cleaning system restore ...

 

Deleted : RP #219 [Removed Apple Application Support (32-bit) | 02/24/2015 02:40:10]

Deleted : RP #220 [Removed Apple Application Support (64-bit) | 02/24/2015 02:42:07]

Deleted : RP #221 [Removed Apple Mobile Device Support | 02/24/2015 02:42:55]

Deleted : RP #222 [Removed Apple Software Update | 02/24/2015 02:46:08]

 

New restore point created !

 

########## - EOF - ##########

 

 

 

An observation. In the past I've tried several times updating Xmarks. Apparently it didn't work. So I uninstalled Xmarks, downloaded the new version from the link you gave and installed it. Control Panel showed the same 127.0.l77 version number that it did previously.

 

 

 

The next attempt was to uninstall Xmarks then reboot then reinstall the new download. Guess what—Control Panel has the exact same info. So if I downloaded 1.3.15 then why does it show the same version number as before? I'm stymied at this point and do not want to move on to Step 4 (Session Manager) until we resolve this conundrum.

 

Another aggravation appeared after I rebooted and reinstalled Xmarks again and imported my bookmarks. I had killed the previous IE session because it was nonresponsive, and as I expected I got the message box at the bottom asking if I wanted to restore the previous session. Before I could select it, however, it disappeared and I was left with my home page tabs. I have IE set to start with tabs from last session. That didn't happen. I have also noticed that for some time that Tools/Reopen last browsing session has been grayed out. I don't remember if that started before or after my original posting. I was accustomed to using it because the selection to restore the previous browsing session in IE options never did work. (Just one of the reasons I hate and rarely use IE. I have been using it for most of our posting work since it has so few add-ons, unlike Firefox, which I was afraid might interfere with carrying out your instructions.)

 

Sorry for the confusing, jump-around post but I am just trying to give an accurate picture of what is happening currently. Actually there's a video driver problem as well, but that's for another time.

 

 

 

Edited by mtnester, 25 February 2015 - 12:29 AM.