(It's) back again! Browsers compromised, HD full of hidden files

[kevinf80]

Ok, close out Firefox then restart normally. Select the following keys together Ctrl - Shift - A that will open "Addons - Manager" Select "Extensions" disable or remove any that you do not recognize. Do the same for and open Plugins, these are slightly different, Plugins have 3 options related to "Activate" Always, Ask and Never. Any you do not recognize change to never...

 

Does that help?

[5potatoes]

Ok, I did as suggested. Everything looked OK in my extension/add-ons. I disabled Java Deployment toolkit and that seems to have done the trick with the graphics issue. I am able to load pages and see graphics, but pages still load very slowly. Also, after I restarted Firefox, several windows pop up in succession. It keeps happening every time I open FF.

Now, when I try to search anything, the resulting window is FF homepage.

[kevinf80]

Maybe is a better option to do a direct "Refresh" of Firefox, that action is known to correct many nuisance issues, instructions at following link:

 

https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings?redirectlocale=en-US&redirectslug=reset-firefox-easily-fix-most-problems

 

let me know if that helps....

[5potatoes]

for the most part it helped. I refreshed FF and reinstalled the adons. there are graphics issuse again. streaming works but pics do not show up. also, the computer in general is moving very slowly now.

[5potatoes]

i should have added that starting up the computer took far longer than usual, almost 5 minutes. I have no programs on the task manager/startup options enabled.

[kevinf80]

Run the system in "Clean Boot" mode, see what happens is there any difference. Basically a clean boot has all non MS services disabled, when disabling non MS services leave any related to security or internet connection active.

 

Go to this link: https://support.microsoft.com/en-gb/kb/929135 expand the option for Windows 8.1 and follow those instructions, is there any improvement?

[5potatoes]

ok, I did as suggested. The computer would not restart, i was just hanging on to the Windows retarting page (light blue with the dotted circle thing). I hitthe reset button and it took about 3mins to boot up. Computer is running a little faster, but still seems slow. right after the desktop loaded, a Kaspersky notification popped up that "seclogon" has been moved to low restricted group. Just got another notification that Task scheduler has been move to low restricted too.

[kevinf80]

So no real gains in clean boot mode, reset back to normal mode, instructions are included in the link quoted for clean boot..

 

Next,

 

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs....

[5potatoes]

as requested!

[kevinf80]

Those logs are clean, np obvious malware or infection, run the following to clean up:

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

 

• 
  

    Remove disinfection tools
    Purge System Restore <--- this will remove all previous restore points and create a fresh point relative to system status at present.
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Next,

 

If you still have issues related to the OS have look at the following link:

 

http://windows.microsoft.com/en-gb/windows/support#1TC=windows-rt

 

As we see no remaining malware/infection are we ok to close out...

 

Thanks,

 

Kevin...

[5potatoes]

ok, I downloaded the program and ran it.

Wen I started the computer this morning, it started in the Windows diagnose and repair mode. When I finally got to the desktop a notification that that program was moved to low restricted group. now my internet security will not load at all.

thanks for the help.

[kevinf80]

The way you describe your current issue is not down to any Malware/infection. When Delfix runs all it completes is tool removal, System restore reset and system settings reset, the latter being re-hiding files folders or extensions we may have altered.

 

if Kaspersky has reacted to those changes it is a new one to me, I`ve got Kaspersky myself and never experince such actions during test runs... The original issue with the HD filling was also very odd, why default settings related to "Traces" was changed from deault setting is hard to understand as it needs user action to change it.....

 

If your system is not running correctly then maybe a system refresh is the way forward. Go to the following link for instructions:

 

http://windows.microsoft.com/en-GB/windows-8/restore-refresh-reset-pc

 

Thank you,

 

Kevin....

[5potatoes]

It looks like it may have been my Kaspersky all along. I just got an email from them to reinstall Kaspersky because an update was corupted and it will cause system instability. I literally just got the email.

Also, I just got a MS notification that Windows10 has just complete pre-installing; I had no idea that was going on.

Thank you again for the help!

[kevinf80]

I too had the offer of a free upgrade to Windows 10 on my other laptop that runs Windows 8.1, I believe was an offer of a limited time upgrade. The full release is supposed to be July 29th. have read at the following link:

 

http://www.theguardian.com/technology/2015/jun/01/microsoft--indows-10-for-free-july

 

If no remaining issues or concerns are we ok to close out...

 

Thank you,

 

Kevin

[5potatoes]

yes, ok to close out.

thank you

[kevinf80]

Thanks for the update, take care and surf safe,

 

Kevin...

[Maurice Naggar]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.