Extremely slow laptop with Bluescreen when using MBAM and Firefox

[Wolverine]

Hello Malwarebytes people, I have been using MBAM for a long time and I'm really happy with it. I think it is an extremely helpful software. I'm currently using the 2.2.0.1024 free version. Unfortunately I have had some problems lately though.

 

Some days ago my laptop started to run really slow (running a W7 Professional OS) and now it also crashes randomly. A Bluescreen appears. It seems to happen when I open at the same time MBAM and Firefox (which also runs extremely slow). I downloaded the program BlueScreen View and this is what it's giving me:

 

BlueScreen View:

Bug Check String: KERNEL_DATA_INPAGE_ERROR

Bug Check Code: 0x0000007a

Caused by Driver: ntkrnlpa.exe

File Description: NT Kernel & System

 

I would really appreciate if you could please help me with this. I'm afraid I have been infected by some kind of virus. I haven't logged in any bank website since then. I don't know if this could be something serious or not. Please find attached the Bluescreen View report.

 

Many thanks in advance for all your help!!

 

Wolverine

Bluescreen View report.txt

[kevinf80]

Hello and welcome to Malwarebytes.org

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.
Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Next,

Follow the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Please open Malwarebytes Anti-Malware.

• On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
• Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
• Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
• A Threat Scan will begin.
• With some infections, you may or may not see this message box.
  
          'Could not load DDA driver'
• Click 'Yes' to this message, to allow the driver to load after a restart.
• Allow the computer to restart. Continue with the rest of these instructions.
• When the scan is complete, click Apply Actions.
• Wait for the prompt to restart the computer to appear, then click on Yes.
• After the restart once you are back at your desktop, open MBAM once more.
  

To get the log from Malwarebytes do the following:

• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click Export > From export you have three options:
  
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
    XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
• Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…
  

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

• Double-click mbam-setup and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
• Launch Malwarebytes Anti-Malware
• A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish. Follow the instructions above....
  

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either accept the alert or disable your security and allow FRST to run...

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

• Quit all running programs.
• For Windows XP, double-click to start.
• For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
• Read and accept the EULA (End User Licene Agreement)
• Click Scan to scan the system.
• When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
• Close the program > Don't Fix anything!
  

Let me see those logs in your reply....

 

Also zip up and attach this folder C:\Windows\Minidump

Thank you,

Kevin...
 

[Wolverine]

Hello Kevin!!

 

Thanks for your extremely quick response. Sorry for the delay, it has been a little bit of a challenge since the laptop runs really slow. I think specially when it goes into "inactive" mode and you try to activate it back again.

 

Please find attached all the files you have asked me for. MBAM scan didn't find anything, but I think RogueKiller did. Sorry but I couldn't zip the Minidump file.

 

Once again, millions of thanks for all your help!!

 

 Wolverine

[Wolverine]

Sorry, here are the files!!

 

Many thanks!!

MBAM Scan log.txt

FRST.txt

Addition.txt

RogueKiller Report.txt

[kevinf80]

Can you also zip up and attach minidum folder is here C:\Windows\minidump

[Wolverine]

Sorry Kevin, I have try to zip the Minidump file but don't know why it's not letting me do it :unsure:

[Wolverine]

Sorry for the delay Kevin,

 

Finally I have been able to zip the Minidump file. Please find it attached.

 

Many thanks for all your help!!

 

 

   Wolverine

102015-54444-01.zip

[kevinf80]

Dump file is not conclusive, continue please:

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.
 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• Double click on Adwcleaner.exe to run the tool.
• Click on the Scan in the Actions box
• Please wait fot the scan to finish..
• When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
• Click on the Cleaning box.
• Next click OK on the "Closing Programs" pop up box.
• Click OK on the Information box & again OK to allow the necessary reboot
• After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...
  

 
Next,
 
Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts. (re-enable when done)
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.
  

 

Next,

 

Please download Kaspersky Virus Removal Tool from http://devbuilds.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

•   Right click on KVRT.exe and select Run as Administrator.
•   Read the EULA, then select Accept.
•   Wait for Kaspersky Virus Removal Tool to initialize.
•   In the main screen, select Change parameters, place a checkmark in System drive, then click OK.
•   Click Start scan.
•   Wait for Kaspersky Virus Removal Tool to complete scanning.
•   When the scan is finished, select Neutralize all for all detected objects.
•   When complete select "Reports" let me see that log... If no malware/infection is found there will be no report.
•   Close Kaspersky Virus Removal Tool when done.
  

 

Post those logs, also let me know if any remaining issues or concerns...

 

Kevin..

 

 

Fixlist.txt

[Wolverine]

Hello Kevin!!

 

Just finished running all those programs you told me. Please find attached all the different logs.

 

I would also like to inform you about a problem that I have had while running these last programs. After running JRT, I initialized KVRT and I started the scan. When the scan was nearly finished my computer went into the "inactive mode" since I had to be afk for a while. When I came back, I tried to activate it back again but my laptop crashed and the bluescreen with the same reported error appeared. After restarting my computer, I run KVRT again and this time I finished the scan detecting one object.

 

Sorry I don't know how to attach the KVRT log to this message. The object that was found was a trojan in:

 

C:\Users\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\5fe083c-40d60c63

 

Information: HEUR:Exploit.Script.Generic

 

After the scan finished, I neutralized this object.

 

Please let me know what to do now.

 

Many thanks for all your help!!

 

 

   Wolverine

Fixlog.txt

AdwCleanerC1.txt

JRT.txt

[kevinf80]

Was another minidump file created, can you zip and attach....

 

Is your system responding any better after running KVRT?

[Wolverine]

Hello Kevin!!

 

Many thnaks for your help. Please find attached the minidump file created at the time of my laptop's last crash. As I told you in my last message, after that crash I was able to run KVRT and I think my laptop now is running better and faster It has gone to the "inactive mode" after that, and I managed to bring it back to the active mode without any probs.

 

May I ask you? Any of the programs you told me to run could have affected some Firefox extensions like Adblock or NoScript? And also the Firefox customization? I had some extensions before and I don't have them any more. 

 

You reckon the problem has been solved? Could have been caused by that trojan KVRT found?

 

Many thanks for all your advice and support!!

 

 

   Wolverine

102015-51183-01.zip

[kevinf80]

 AdwCleaner and or JRT will have removed suspicious extensions, I do not believe Adblock or NoScript would be affected. Look back at the logs from AdwCleaner and JRT I do not see either listed...

 

I look at the latest minidump file file, it lists a .dll file as the possible cause. Do the following:

 

Go to http://www.virustotal.com/

• Click the Choose file button
• Navigate to the file C:\WINDOWS\system32\ci.dll
• Click the Scan it tab
• If you get a message saying File has already been analyzed: click Reanalyze file now
• Copy and paste the results back here please.
  

 
Next,
 
Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe     <<-   64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe   <<-  32 bit

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  

  :filefindci.dll

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

Let me see those logs, also let me know how your system is responding, are there any remaining issues or concerns...

 

Thank you,

 

Kevin...


 

[Wolverine]

Hello Kevin!!

 

Many thanks for your indications. I have run the last tools you told me. It seems the virustotal scan has not found anything, or at least it considered the ci.dll file safe to use. I paste the results of the scan here:

 

Copyright: © Microsoft Corporation. All rights reserved.

Publisher: Microsoft Windows

Product: Microsoft® Windows® Operating System

Original name: ci.dll

Internal name: ci.dll

File version: 6.1.7601.18519 (win7sp1_gdr.140626-1508)

Description: Code Integrity Module

Signature verification: Signed file, verified signature

MD5: d31fb78f37f075fa9605d7ed9b2070d2

SHA1: 2c1bd77227288cadbb1066587d62ce56610ce684

SHA256: 5ae569da8669867d0f78f4e85effd6f2acfcd1a1dd4c19b396b59ca1e398286d

ssdeep: 12288:icPuqFAxX39Uqo/+78KvV7oUNZfEJW9bc:icPWxX3yqo/+oKd7oUNag9bc

authentihash: 9fe05c3fb3df6fa0661db4f586602364e57d70e95e116bd5e61e4e295a2680d1

imphash: b772ef912fc744cf2dca772b2d74cc14

File size: 399.7 KB ( 409272 bytes )

File type: Win32 DLL

Magic literal: PE32 executable for MS Windows (DLL) (native) Intel 80386 32-bit

TrID Win32 Dynamic Link Library (generic) (43.5%)
Win32 Executable (generic) (29.8%)
Generic Win/DOS Executable (13.2%)
DOS Executable Generic (13.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

I'm also attaching the SystemLook log. I would also like to inform you that after the KVRT scan and neutralizing the object found, my laptop seems to work better and it has gone from the inactive mode to the active mode several times without crashing again 

 

I'm not sure if the problem has been completely solved, though.

 

Many thanks again for all your help!!

 

 

   Wolverine

 

 

SystemLook.txt

[kevinf80]

Thanks for the logs and the update, yes systems appears to be ok.. Run it for 24 hours, see if it responds as expected. After that post back and we can clean up...

 

Thank you,

 

Kevin...

[Wolverine]

Millions of thanks Kevin!!

 

I'll do as you say and keep you posted if anything happens in these 24 hours. My laptop seems to work better now.

 

May I ask you, I haven't logged in any bank website or my email accounts since these problems appeared. Do you reckon I would be able to do that again without having the risk of my personal info (passwords, etc) being compromised? Or you think is better to wait these 24 hours?

 

And regarding any external hard drive, any risk of becoming infected if I connect it to my laptop? Do I need to run MBAM on them or any other tool to check if they have been infected as well? Better to wait these 24 hours before connecting them again?

 

Many thanks for all your support!! Great help!!

 

 

    Wolverine

[kevinf80]

Change any all passwords you normally use, i`d wait the 24 hours and see how your system responds. If all is well just use as you would normally..

 

Before attaching any external USB devices d/l and install McShield, this will give protection to/from any usb devices that are used on your system...

 

Please download McShield by dr_bora and save it to your desktop.

• Install it on your system.
• It will initially run a scan and show the result as a toaster by the system clock.
• When complete plugin your ext hard drive, McShield will check it out...
  

 

Thanks,

 

Kevin...

[Wolverine]

Many, many thanks Kevin!!

 

I'll do as you say and change the passwords. Thanks also for the McShield advice. I'll install it and run it :)

 

Cheers!!

 

 

   Wolverine

[kevinf80]

You`re very welcome....

[Wolverine]

Hello Kevin!!

 

Just writing to inform you after the time we have left for me to check my laptop's performance I installed and run McShield as you told me and although many of my drives seemed clean, the program found lots of Malware in the Recovery drive I don't know exactly what this means. I'm attaching the log to this message for you to have a look.

 

I would like to let you know also that today I run again MBAM, my antivirus (AVG), and KVRT just to check my whole system again. Seems my system is clean, although AVG and KVRT found a couple of viruses in an external hard drive that was plugged in. Those viruses were located in two executables that I store in this hard drive but I don't use.

 

Apart from all this, my computer seems to work much better and faster now.

 

May I ask you:

 

Was the problem related to that ci.dll file? Do I have to delete this file manually?

 

If I change my passwords now, do you reckon it would be safe again for me to enter in my email accounts or bank websites, without thinking my personal info could be compromised?

 

Millions of thanks for all your help and advice during all these days!!

 

Cheers!!

 

 

    Wolverine

 

 

McShield scan log.txt

[kevinf80]

Your system should be good to go, make sure you change all relevant passwords and repeat that action maybe on a weekly basis.

 

The .dll file you mention is clean, no need to do anything just leave as is...

 

McShield log is fine, all found entries have been dealt with. Keep McShield is a very good security tool to protect USB flash drives etc....

 

The next action is to clean up, as follows please:

 

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

 

•    
• Remove disinfection tools
     
• Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
     
• Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…
 

 

Next,

 

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin...

[Wolverine]

Hello Kevin!!

 

Sorry for this very late response. Just writing to thank you and to inform you that I finished cleaning up with Delfix as you told me. My laptop runs smoothly now after what we did      I left the .dll file as it is and I have also kept McShield (very useful tool that I didn't know about before). After reading the info you sent to me through those links, I will try to surf safer from now on

 

Many thanks for all your great help, advice and guidance through all this process!!

 

Cheers!!

 

 

   Wolverine

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!