rg163 Posted September 14, 2015 Author ID:989678 Share Posted September 14, 2015 Thank you Ron. FYI: My router has two computers attached to it. No.2 computer runs Malewarebytes also and is not getting popups. Does this make a difference as far as resetting the router? Thanks for the review of my situation. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 14, 2015 Root Admin ID:989954 Share Posted September 14, 2015 I don't think that it is router related but often times users have no information about their router or even the password. You can skip the router reset if you like. Thanks Link to post Share on other sites More sharing options...
rg163 Posted September 14, 2015 Author ID:989991 Share Posted September 14, 2015 I did not do the reset and reboot of the router. Here are the other logs that you need. Hope this works.JavaRa Log.txtComboFixLog914.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 15, 2015 Root Admin ID:989999 Share Posted September 15, 2015 Please visit each of the following sites and lets reset all of your browsers back to defaults to prevent unexpected issues. If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in. Internet Explorer How to reset Internet Explorer settings Firefox Click on Help / Troubleshooting Information then click on the Reset Firefox button. Chrome Start by disabling Sync How To Delete Your Google Chrome Browser Sync Data Chrome - Reset browser settings If that fails then Uninstall Google Chrome and do not reinstall until sure the system is clean. Link to post Share on other sites More sharing options...
rg163 Posted September 15, 2015 Author ID:990014 Share Posted September 15, 2015 Done as you suggested.Don't have google crome but used to have Opera. It was uninstalled a while back. About the three scannes I did (JavaRa, TFC and Combofix) MWB stopped recording the Protection Log.In fact it is now blank for the day. Am still getting the same " malicious website blocked" popup. This is getting discourging. Maybe there is no fix? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 15, 2015 Root Admin ID:990053 Share Posted September 15, 2015 Sometimes it takes a while to find the culprit. Please restart the computer and then run a new FRST scan and make sure to place a check mark on the Additions.txt check box and post back both new logs. Thanks Link to post Share on other sites More sharing options...
rg163 Posted September 15, 2015 Author ID:990157 Share Posted September 15, 2015 OKMr Lewis thanks for your efforts.FRST 9_15.txtAddition 9_15.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 15, 2015 Root Admin ID:990271 Share Posted September 15, 2015 STEP 1 Please download MiniToolBox save it to your desktop and run it.Checkmark the following check-boxes:Flush DNSReport IE Proxy SettingsReset IE Proxy SettingsReport FF Proxy SettingsReset FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList last 10 Event Viewer logList Installed ProgramsList DevicesList Users, Partitions and Memory size.List Minidump FilesClick Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.Note: When using Reset FF Proxy Settings option Firefox should be closed. STEP 2 Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.Run FRST or FRST64 and press the Fix button just once and wait.If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Link to post Share on other sites More sharing options...
rg163 Posted September 16, 2015 Author ID:990288 Share Posted September 16, 2015 Here are the logs, Ron.ThanksMTB Results 9_15.txtFixlog 9_15.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 16, 2015 Root Admin ID:990351 Share Posted September 16, 2015 The logs indicate that many services crashed on 9/14/2015 Not sure if you ran some tool then or if it's an ongoing issue. It also shows your VSS (Volume Shadow Copy Service) is having issues with one of the writers.The disk may be having issues so let's do a full disk check please. Click on START and type in CMD.EXE and when it shows on the menu right click and choose "Run as administrator" and type the following. CHKDSK C: /R Then it will say it cannot lock the drive. Press the Y key to say yes to allow it to run on reboot. Then press the Enter key, then restart the computer and let the disk check run. Once that's done then run a new FRST scan and make sure you place a check mark in the Additions.txt check box and post back both new logs. Error: (09/14/2015 01:18:04 PM) (Source: Service Control Manager) (User: )Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:%%997Error: (09/14/2015 01:18:04 PM) (Source: Service Control Manager) (User: )Description: The Peer Name Resolution Protocol service terminated with the following error:%%997Error: (09/14/2015 01:18:04 PM) (Source: PNRPSvc) (User: )Description: 0x800703e5Error: (09/14/2015 12:05:52 AM) (Source: Service Control Manager) (User: )Description: The MBAMScheduler service terminated unexpectedly. It has done this 2 time(s).Error: (09/14/2015 12:05:52 AM) (Source: Service Control Manager) (User: )Description: The MBAMService service terminated unexpectedly. It has done this 2 time(s).Error: (09/14/2015 12:05:51 AM) (Source: Service Control Manager) (User: )Description: The Apple Mobile Device Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.Error: (09/14/2015 12:05:51 AM) (Source: Service Control Manager) (User: )Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. Link to post Share on other sites More sharing options...
rg163 Posted September 16, 2015 Author ID:990459 Share Posted September 16, 2015 The logs indicate that many services crashed on 9/14/2015 Not sure if you ran some tool then or if it's an ongoing issue. It also shows your VSS (Volume Shadow Copy Service) is having issues with one of the writers.I belive that happened after I Ran JavaRa and or TFC. The popups have slowed way down since yesterdays ops. Every couple of hrs. now. When they do popup it is still 8-12/minute. Ran CHKDSK Here are the FRST Logs.FRST Log 9_16.txtAddition Log 9_16.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 17, 2015 Root Admin ID:990508 Share Posted September 17, 2015 For temporary testing purposes can you uninstall your AVG Internet Security 2015 software (if using a paid version make sure you have your license information) Then install Microsoft Security Essentials for now so that you have do have an antivirus while we continue to look at this. http://windows.microsoft.com/en-us/windows/security-essentials-download Link to post Share on other sites More sharing options...
rg163 Posted September 17, 2015 Author ID:990531 Share Posted September 17, 2015 Have installed Microsoft Security Essentials.What's next? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 17, 2015 Root Admin ID:990549 Share Posted September 17, 2015 Please run Combofix again. It should ask to update please update it and run it again and post back the new log. Also post back the Protection Log from MBAM for today and yesterday. Thanks Link to post Share on other sites More sharing options...
rg163 Posted September 18, 2015 Author ID:990726 Share Posted September 18, 2015 Here they are.ComboFix Log 9_17.txtMBAM Protection Log 9_16.txtMBAM Protection Log 9_17.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 18, 2015 Root Admin ID:990742 Share Posted September 18, 2015 Please follow the commands here to reset the Network stack on the computer. https://support.microsoft.com/en-us/kb/299357 Then go here and set your DNS Server to the Google Public DNS server entries. https://developers.google.com/speed/public-dns/docs/using?hl=en Then restart the computer Link to post Share on other sites More sharing options...
rg163 Posted September 19, 2015 Author ID:990922 Share Posted September 19, 2015 I can handle resetting the Network stack.Will that affect my other computer?But I don't think I can handle setting to Google Public DNS server entries. So I guess that's the end then, huh? Link to post Share on other sites More sharing options...
rg163 Posted September 20, 2015 Author ID:991178 Share Posted September 20, 2015 I will give it a try on Monday or Tuesday. Thanks for all the help.Will let you know how things worked out. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 21, 2015 Root Admin ID:991301 Share Posted September 21, 2015 Why can't you do the DNS change? Link to post Share on other sites More sharing options...
rg163 Posted September 21, 2015 Author ID:991399 Share Posted September 21, 2015 I can't change the the dsl modem because: Frontier hard codes their isp into their modem. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 22, 2015 Root Admin ID:991542 Share Posted September 22, 2015 Not asking to change the modem. You should be able to change the entries on your local computer. They should look there first for DNS Link to post Share on other sites More sharing options...
rg163 Posted September 23, 2015 Author ID:991721 Share Posted September 23, 2015 Yes you are right! I misread the instructions. I did the two things that you asked at around 4:30 PM .As of now (5 hrs.) no popups from MWB!!! I will report back tomorrow and let you know how things are going. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 23, 2015 Root Admin ID:991737 Share Posted September 23, 2015 Sounds good, let us know. Link to post Share on other sites More sharing options...
rg163 Posted September 23, 2015 Author ID:991804 Share Posted September 23, 2015 Ron, I forgot to mention that when I strart/restart my computer I sometimes get a pink screen.This started after I applied the above fix. If I hit restart when that happens it goes into safe modeand I hit enter and then it loads fine.Any ideas? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 23, 2015 Root Admin ID:991858 Share Posted September 23, 2015 Seems a bit odd. Might try reinstalling the latest video driver and see if that helps. Link to post Share on other sites More sharing options...
Recommended Posts