Jump to content

Damage from the Saturday update still not fixed


Recommended Posts

I had two computers affected by the Saturday (27th) update which caused the excessive RAM use and internet blocking issues. When the computers went bonkers, I was able to manually uninstall MWB using the Windows 7 control panel programs and features application once I had observed that Malwarebytes was causing the problems. This fixed my computer but my wife's still refuses to connect to the internet. I downloaded the MB-Clean utility today to a usb drive using another computer which had internet access and ran it on her computer. No luck, her computer still won't connect to the internet. Incidently, when I ran the MB-Clean utility, I did not get any of the expected prompts outlined in the post by msherwood:

All I got was a message asking for permission to let the program run and then a prompt to reboot. Since I am not all that tech savvy, I am not sure what to do next. Please help.

Link to post
Share on other sites

  • Replies 65
  • Created
  • Last Reply

Top Posters In This Topic

10 minutes ago, rikki55 said:

No luck, her computer still won't connect to the internet. Incidently, when I ran the MB-Clean utility, I did not get any of the expected prompts outlined in the post by msherwood:

:welcome:

Use that flash drive to do the following.

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues.... Please use an Administrator account when doing the following,

  1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
  2. Download FRST and save it to your desktop. Tell any program that blocks it to ignore or allow. It IS SAFE. It contains no info that can identify or harm you.
  3. NOTE: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  4. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  5. Press the "Scan" button
  6. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
    NOTE: These two files will be collected by the MB-Check Tool and added to the zip file for you
  7. NEXT: Create and obtain an mb-check log
  8. Download MB-Check and save to your desktop
  9. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
  10. This will produce one log file on your desktop: mb-check-results.zip
  11. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

 

Link to post
Share on other sites

Thanks for responding so quickly.  I did as you asked but the MB-check aborted - I'm pretty sure because Malwarebytes isn't installed on the computer any more. In my panic Saturday, I uninstalled Malwarebytes using the Windows (7) uninstall process. Here are the FRST and Addition files as well as what MB-Check did produce.

Thank you!

mb-check-results.txt

FRST.txt

Addition.txt

Link to post
Share on other sites

That's correct. It's on an ethernet connection usually. The network widget shows it's connected to the network and says it has internet access but nothing can actually access the internet. Steam, Bitdefender, a browser, nothing. Tried a WiFI adapter too - same story.

Beats me, but that is the state the computer was left in after I uninstalled MB Saturday. I've tried resetting winsock but that doesn't seem to do anything either. I can ping the router (the 8.8.8.8 thing) but nothing beyond.

Link to post
Share on other sites

I know all your other devices on your network are working but, Would you please unplug your router /modem or both if you have both, from the power for a couple of minutes and plug it/them back in and wait a couple of minutes and restart the affected computer and report back.

Link to post
Share on other sites

  • Root Admin

Hello @rikki55 and :welcome:

I will assist you in trying to fix the computer. Please use a USB disk to copy files to the affected computer.

 

Please visit this web page and read the ComboFix User's Guide:

  • Once you've read the article and are ready to use the program you can download it directly from the link below.
  • Important! - Please make sure you save combofix to your desktop and do not run it from your browser
  • Direct download link for: ComboFix.exe
  • Please make sure you disable your security applications before running ComboFix.
  • Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
  • Please attach that log file to your next reply.
  • If needed the file can be located here:  C:\combofix.txt
  • NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

 

Thanks

Ron

 

Link to post
Share on other sites

Hi Ron. Thanks for helping. I put the combo fix app onto the computer's desktop, disabled bitdefender and started it running. The first few seconds all was proceeding as outlined in the user's guide. Then I got a pop up saying that the Combofix version was expired and it would only have reduced functionality; did I want to continue? I clicked "no" and stopped there. Should I let it run anyway (with the reduced functionality)?

Link to post
Share on other sites

Had to wait till I got home from work to try this again. I did as instructed (fresh restart) and ran Combofix. As soon as I told Combofix to go ahead and run after the message about reduced functionality it simply vanished. Just, poof!

Now the machine is just sitting there. It's not locked up or anything, just doing nothing. Same as last night. I gave it a couple of hours then and it never did do anything.

sigh...

Link to post
Share on other sites

  • Root Admin

Please review the documentation and alerts for your NETGEAR WNA1000Mv2 N150 Wireless USB Adapter as well as making sure you have the lastest driver

Latest driver: 1.0.0.3
Installed driver: 1.0.0.1

https://www.netgear.com/support/product/WNA1000Mv2.aspx

https://kb.netgear.com/30155/WNA1000Mv2-Software-Version-1-0-0-3-Supports-Win10

 

You're also have a lot of errors with Bitdefender, here is just one example in the logs. You might want to temporarily uninstall Bitdefender until we get this networking issue resolved.

 

System errors:
=============
Error: (01/30/2018 05:44:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Bitdefender RedLine Service service terminated unexpectedly.  It has done this 7 time(s).  The following corrective action will be taken in 600000 milliseconds: Restart the service.

 

Is this a home computer or a work computer? You're having errors about another computer with the same name which is rare at home

Error: (01/30/2018 04:51:24 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "JULIE-PC       :20" could not be registered on the interface with IP address 192.168.1.124.
The computer with the IP address 192.168.1.132 did not allow the name to be claimed by
this computer.

Error: (01/30/2018 04:51:24 PM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{2E7DE9A6-C6D5-4BFE-ADD2-F9442984AF7A} because another computer on the network has the same name.  The server could not start.

Error: (01/30/2018 04:51:17 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "JULIE-PC       :0" could not be registered on the interface with IP address 192.168.1.124.
The computer with the IP address 192.168.1.132 did not allow the name to be claimed by
this computer.

 

 

 

 

 

Please copy the required files to a USB stick and run the following from that stick or copy to the affected computer to run it.

 


Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

 

Thanks

Ron

 

Link to post
Share on other sites

Hi Ron,

That particular machine is hardwire connected via an ethernet cable. I only installed the NETGear adapter to provide a wireless connection when this trouble started Saturday. The adapter is no longer in place.

I uninstalled Bitdefender and ran the script you provided. Results attached. I also didn't realize I had two computers with the same name which were causing conflicts. I changed it on one although I found that when I tried to change the name on the problem machine, it wouldn't let me - Windows said I was trying to use unallowed characters. Not sure how relevant that is to the current issue but it looks like something is corrupted there.

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

Looks like your System Restore is not functioning for some reason. The tool says it was unable to create a system restore.

Let's go ahead and do a full disk check on this computer and see if that corrects any issues. Please run the following fix and it will run the full disk check for you.

NOTE: A full disk check make take a couple of hours or more depending on the speed of your computer and how much data is on the drive. Please let it run

Maybe run it before you go to bed. Then after the disk check run a new set of FRST logs and make sure you place a check mark on the Additions.txt check box to get a new log for that too and post back those new logs.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

Ron

 

 

Edited by AdvancedSetup
Link to post
Share on other sites

  • Root Admin

Please do the following

Press the Windows + R keys to open the Run dialog, type powershell.exe, and press Enter.

In PowerShell, copy and paste the command below, and press Enter

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

CHKDSKResults.txt file will be created on your desktop, that is the log file of your chkdsk scan results from Event Viewer.

Please upload that file on your next reply

 

Link to post
Share on other sites

  • Root Admin

Please download the following file and save it to your desktop. http://kixhelp.com/wr/files/mb/check_bfe/CheckBFEServices.exe

Close your browser and run the program. Then find the files it creates on your desktop and upload them as an attachment.

Then run the following fix for me.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

Thanks

Ron

 

Link to post
Share on other sites

  • Root Admin

No hard drive issue this run, but there were on 2 previous runs that were able to fix items.

Let me have you run the following please.

Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices
  • List Users, Partitions and Memory size.
  • List Minidump Files


Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using Reset FF Proxy Settings option Firefox should be closed.


Thank you

Ron

 

Link to post
Share on other sites

  • Root Admin

Please try changing the Ethernet cable if you have another one, if not then unplug it from both ends and then plug it back in again.

Then if still not working, look at changing the DNS to use Google Public DNS and try again.

There is definitely something going on with maybe a path environment or something. Multiple programs and references to things that are failing because they can't find a drive. Are you using some external drive?
Is this a laptop or desktop computer?

https://developers.google.com/speed/public-dns/

Ron

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.