win7 freeze

[fpefpe]

Hello --

 

about a  week ago my win7 system started to sorta  freeze -- I could move the mouse and even start  some programs  – the issue seems to  be connected to the network adaptor in some way I had  a  browser open and  tried to open a new tab and it would not open I then was  able to open a cmd window and  I  issued  

 

ipconfig 

 

and I got back info but when I  issued 

 

ipconfig /all 

 

the command never returned to the cmd prompt  I  tried to shutdown the computer but it would not shutdown  -- I had to power it down the pc. I then restarted and I responded to boot prompt to start  normally and it started ok 

 

I am not sure if this started about  the same time I installed MalwareBytes (premium, v2)  – If I were to deactivate and uninstall (to rule out malwarebytes)  – will my license still be ok and will the objects in quarantine still stay on the disk? 

 

Any  suggestion on how to figure out what is going on would be appreciated

 

 thanks 

 

fpe

[daledoc1]

Hi:
 
If you uninstall MBAM, items in Quarantine will be permanently removed from the computer.

There are many reasons for system "freezes" (hardware, software conflicts, bad disks, corrupt files, malware, etc).

 

So, let's do this first:
In order for us to have a better idea what might be going on, please read the following and post back attached to your next reply the 3 requested logs - Diagnostic Logs (the 3 logs are: FRST.txt, Addition.txt and CheckResults.txt)

 

Thanks,

[fpefpe]

Hello -- 

 

Thanks for the info -- here are the files / logs in the zip 

 

fpefpe

logs.zip

[daledoc1]

Please just post the 3 .txt files separately as attachments, if you would.

(They should not be so large as to require archiving/compression.)

 

Thanks,

[fpefpe]

ok --  Here are the files as plain text 

 

Addition.txt

CheckResults.txt

FRST.txt

[AdvancedSetup]

The logs indicate that the computer is infected. I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.
 

[fpefpe]

Hello -- thanks for the reply -- 

 

can you point me to the item(s) in the attached files that  lead you to conclude that the pc is infected? 

 

Thanks

[AdvancedSetup]

The logs show applications that are having trouble reading/writing to the registry which is not normal. For some reason your drop box is adding AlternateDataStreams to files (legit but not normal, unless you specifically did it I'd want to know why dropbox is doing that)

 

You also have many files set to compatibility mode which if at all possible no file should be running under compatibility mode unless they simply wont' run. I would recommend that you remove all the entries for compatibility under these keys

 

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\appCompatFlags\Layers

    E:\Software\chromeinstall-6u25.exe
    C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
    C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe


HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\appCompatFlags\Layers

    C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowProtect.exe
    C:\Program Files (x86)\JPSoft\TCCLE13\tcc.exe
    C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe


HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\appCompatFlags\Layers

Runnning these under compatibility is going to cause instability for most computers and should really be removed.

    C:\Users\frank\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Safari\Safari.exe
    C:\WINDOWS\explorer.exe
    C:\Windows\SysWOW64\mmc.exe
    C:\Windows\SysWOW64\svchost.exe

Runnning these under compatibility will probably have no ill affect but personally unless a program demonstrates it needs a compatibility setting then it should not have one. You can always put it back if it does cause an issue. If the program does not work well without then I'd look at finding a better program that does work 100% with Windows and does not need such settings.

    C:\Program Files (x86)\DVDFab 9\DVDFab.exe
    C:\Program Files (x86)\DVDFab 9\Options\FabAddonBluRay.exe
    C:\Program Files (x86)\DVDFab 9\Options\FabAddonDVD.exe

 

 

 

 

 

 

There is a command processor set to run but has no obvious shown reason to run or what it's trying to run.

[fpefpe]

Hello  --

 

Thanks for the reply .... Just to be clear, its not the  "exe"   file that you are suugesting be removed, but the entry in

the registery that marks its  to run in "compatibility mode" ?

 

Also,  some of the listings are  windows  (system) programs lie IE and MMC  -- I would think that these are set up

this way my  microsoft

 

Is that not the case?

[AdvancedSetup]

You are correct. I am not suggesting you to remove any files listed there, only Registry entries.

 

No those entries are not there by Microsoft by default. Often they get put in there as Microsoft has what I would consider a weak method of attempting "automatic fix/repair". What often happens is you can have a temporary issue due to maybe memory or a program crash or something unexpected so Microsoft monitors that and "assumes" that something is not working correctly and thus asks you if the program worked okay or if it installed correctly etc. Depending on what you answer it will then flag the Registry that this program needs some "compatibility" settings made to allow it to run with Windows. In some cases for very old or poorly written programs it might work but in most cases I've seen its a bad entry and will often cause the opposite where things will not work well with it set especially security programs or core OS files.

 

I have changed the entries to remove to purple to show better. You open Regedit.exe and then browse to each of those 3 main key locations and find the entries listed and remove those entries, not any files.

 

Then once done restart the computer. I'm not saying this is going to fix your issues with the program but it's certainly a step in the right direction.

[fpefpe]

Hello --  THanks for the info ....  I am not sure if its connected, but there seemed to be some correlation between with this issued  started and when I

installed malwarebytes

 

I did start with  verion 1.71 of the code then installed the 2.0.2 version on top of that

 

Just to make sure that isnot any connection, I  uninstalled MB to see if  the issue happens again

 

Again, thx for your help

 

fpe

[AdvancedSetup]

Well you can do a Clean Removal and then reinstall and see if that makes any difference but the items I listed should still be removed.

1. Please uninstall your current version of MBAM and reinstall the latest version. MBAM Clean Removal Process 2x
2. If that does not correct the issue then please read the following and post back the requested logs. - Diagnostic Logs
3. NOTE: There is an FAQ section with valuable information located here: - Common Questions, Issues, and their Solutions
   

Thank You
 

[fpefpe]

Thanks for the links .... I did a  "regular" uninstall and it seemed to work OK --  would I still have to run the clean tool?

[AdvancedSetup]

That would be the preferred method