Jump to content
Davide07

Malware and Pop up, Help

Recommended Posts

1 hour ago, Maurice Naggar said:

N.B.   I do have a question at this time.  What is the active / resident antivirus presently on this machine?

Is it Kaspersky ?

In this moment i have ONLY Avast.  btw when you told me to uninstall Avast I tried to do a virus scan with Kaspersky but it did not work then I uninstalled it.

Share this post


Link to post
Share on other sites

This  is for member Davide07  only

There is a small cleanup for some oddities  & also a new search to do with FRSTENGLISH   ( below).

[ 1 ]

What follows is a first step to have Windows 10 show all files and folder. Do not let this spook you out.

There is a how-to at Tenforums. Use either option one or two or three

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

 

[ 2 ]

Locate and Delete the prior copy of the files FIXLIST.txt  on the Downloads folder.   I am sending a new one with this message.

[ 3]

  

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRSTENGLISH tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) to the Downloads folder

The tool named FRSTENGLISH.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRSTENGLISH

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

FRST_Fixl.png.c4c1c0dddcc49b11fa400590f070bd5e.png

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

 

Please attach 3 files with next Reply.  Fixlog.txt & from the DESKTOP  ..... File-1-reg.txt & File-2-reg.txt

[ NEXT ]

Could you take a minute or two and just look at the contents of this folder.   See if some thing is odd.
C:\Users\Sunshine\AppData\Roaming\Microsoft\Windows\SendTo

 

NOTES:  The fix above is not necessarily going to fix the issue with File Explorer.  and, I need to see the results of the 3 files above.

We will do more later on.   at this point, I do not need any more screen image captures.

What we are seeing and dealing with is not a infection.  It is more like a glitch on Windows and on some special context menu settings for Windows.

Sincerely,

Fixlist.txt

Share this post


Link to post
Share on other sites

For information, the presence for "compressed folder" is very normal.  That is  expected  and OK.

Thank you for the reports.  The fix run with FRST is a good one.

Question please: is this pc just your home machine ?   That is to say, you are not on any office / networking type setup ?

also,

On this Windows, did you elect to do any sort of Microsoft encrypting of files ?

 

 

Share this post


Link to post
Share on other sites
29 minutes ago, Maurice Naggar said:

Question please: is this pc just your home machine ?   That is to say, you are not on any office / networking type setup ?

also,

On this Windows, did you elect to do any sort of Microsoft encrypting of files ?

 

 

1) Yes, it's just my home machine

2) nope, never done before

Share this post


Link to post
Share on other sites

Thank you.

Lets use the Windows System File Checker app

Select the Windows-key on keyboard and X key together, from the start-menu select Command Prompt (Admin)

At the prompt either type or copy/paste the following commands, select Enter after
that

Quote

sfc /scannow

tap Enter-key to get that started.   Monitor that run.   Let me know the result.   Make sure to let me know if something is reported as not normal.

Share this post


Link to post
Share on other sites

Done, it says:

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not supported in offline servicing scenarios.

Share this post


Link to post
Share on other sites

I very much regret to read of the windows resource protection / corrupt files.

Please zip the following log and attach it on your next reply.

 C:\Windows\Logs\CBS\CBS.log

 

Also, please do this special report run.

Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

  • List last 10 Event Viewer log
  • List Devices

Click Go and attach the result (Result.txt).

A copy of Result.txt will be saved in the same directory the tool is run.

Share this post


Link to post
Share on other sites

Thank you for the logs.

Lets take a few minutes and do the following.

Close and save all open work  ( if any).

Do a Windows shutdown.   Then wait about one minute.   Then Restart the computer.  Wait until Windows reloads and is ready.

 

I would like to see if you can do a Microsoft Windows Update check-run  and allow it to check for and then apply all updates.

From Start menu, select windows Settings  and then Update & Security and then click on Check for Updates.

My hope is that the update(s) will be a benefit.    Let me know the result.

 

Then, press and hold the Windows-key on keyboard and tap the R key

type in

Quote

winver

Kindly let me know the full Build information displayed.

We will do more later.

Sincerely,

Share this post


Link to post
Share on other sites

No updates found. My device is up to date. My Build information is:

Version 1903 (build SO 18362.239)

Share this post


Link to post
Share on other sites
Posted (edited)

Thank you.  Yes, your computer has the latest Windows 10 updates.   Bravo.

 

The main "problem" area on this case is about Windows Explorer  ( also known as File Explorer in Windows 10 ).
It seems to me it would be worthwhile to see & review what possible non-Microsoft shell extensions are associated to Windows Explorer.  That is termed "context-menu" for Explorer.
Winhelponline is a good specialty resource on Windows.   and Nirsoft is a respected source of special tools.

Read this article at Winhelponline that describes similar issue to what you are having on your machine.
https://www.winhelponline.com/blog/fix-slow-right-click-crashes-shell-extensions/

some of the Extensions hooked in Explorer may cause the issue you have had.

you can try to find it out for yourself via ShellExView by Nirsoft what is outdated or critical, OR that maybe you do not need & could remove or disable
ShellExView - Shell Extension Manager For Windows
http://www.nirsoft.net/utils/shexview.html

 

Quote

 

The ShellExView utility displays the details of shell extensions installed on your computer, and allows you to easily disable and enable each shell extension.

ShellExView can be used for solving context-menu problems in Explorer environment.

 

 

also,

Also see ShellMenuView  at Nirsoft
http://www.nirsoft.net/utils/shell_menu_view.html

Quote

ShellMenuView is a small utility that displays the list of static menu items that appeared in the context menu when you right-click a file/folder on Windows Explorer, and allows you to easily disable unwanted menu items.

 

Edited by Maurice Naggar
adfed note on ShellMenuView

Share this post


Link to post
Share on other sites

Yeeee i found the Extension problem, it was "HelloExtNoAtl" so... no more RunDll error!

Citazione

KfT2MMI.png?1

 

 

 

Share this post


Link to post
Share on other sites

Good morning.

That is very good news.  You did well.

Is there anything else that you need, at this point?

Share this post


Link to post
Share on other sites
4 hours ago, Maurice Naggar said:

Good morning.

That is very good news.  You did well.

Is there anything else that you need, at this point?

No, thanks for your help :wub:

Share this post


Link to post
Share on other sites

Hello Davide.

I am very glad that things are normal.  😍    At the start, I thought perhaps we had a 2-headed hydra.  I am happy to have helped you.

 

Safer practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Free games & free programs are like "candy". We do not accept them from "strangers".


Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

 

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.


Check in at http://windowsupdate.microsoft.com 
Windows Update and install any Important Updates offered.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq




Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

.

Best wishes to you.

Maurice

Share this post


Link to post
Share on other sites

N.B.  You should delete the FIXLIST.txt  files I had you use.  You may also delete the files named Fixlog.txt

Share this post


Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.