White rectangle with internet icon and x's covering 1/4 of screen

[EddieM]

Hello, new here, not sure if I'm posting this in the right place. 

I started up my laptop today and on the desktop there's a large white rectangle in the bottom right hand corner. Inside it has a grey internet globe icon, 1 'X' in a circle and 3 small 'x's. There's no way to close it or right click. If I hover the mouse under the globe an 'OK' box reveals itself. (It doesn't seem wise to click on this.) There's nothing in Task Manager that is immediately obvious. Pics attached

I've done a scan with MB, IObit, Avira (quick scan) and Supertantispyware. Nothing shows up. 

Anybody know what this is or what I should do? Browser works fine. Internet connection has been noticeably slow over the last few days. 

Cheers

Eddie

[Maurice Naggar]

Hi  

My name is Maurice.  I will be guiding you going forward.  Kindly run this report tool  & then you can ZIP the reports & tehn attach with your next reply.

Please download the Farbar Recovery Scan Tool 64-bit and save it to your desktop.

 Right-click on FRST64.exe     and select Run as Administrator to start the tool , and reply YES to allow it to proceed and run.

 Windows 10 users will be prompted about Windows *SmartScreen protection* - click line More info information on that screen and click button Run anyway on next screen.

Click YES when prompted by Windows U A C prompt to allow it to run.

Note: If you are prompted by Windows SmartScreen, click More info & followup & choose Run anyway.

 

Approve the Windows UAC prompt on Windows Vista and newer operating systems by clicking on Continue or Yes. 

Click Yes when the  *disclaimer* appears in FRST.

The tool may want to update itself - in that case you'll be prompted when the update is completed and ready to use.

 

Make sure that Addition options is *checked* - the configuration should look exactly like on the screen below (do not mark additional things unless asked).

Press Scan button and wait.

 

 

The tool will produce 2  logfiles on your desktop: FRST.txt , Addition.txt 

Click OK button when it shows up. Close the Notepad windows when they show on screen. The tool saves the files.

 You may put the files into a ZIP file.

Please attach to your next reply.

Thank you.

[Maurice Naggar]

P.S. After the Farbar FRST report run is done.....
What is that on the Desktop that has   "  Lava Lamp receipt " ?
What is that on the Desktop that has  " Rectangle Globe " ?
Do you think possibly it has anything to do with the odd screen ?
Is that a item you can delete off the Desktop ?

also, if you still see that odd window, could you Hover your mouse pointer over that white screen
 & then press and hold the CTRL-key on keyboard & then tap the W key.
CTRL+W  key-presses just may get that window closed.
Try that.

also, housekeeping, if you are no longer using "Iobit" see about uninstalling the program.
also if "Driver booster 7" was recently installed or downloaded, Uninstall all of that.
Most all "driver boost" type things are junk, snake-oil type junk.  and can actually cause problems.

[EddieM]

Hi Maurice, thanks for replying so quickly.

The 'lava lamp receipt' was just an image file from a flatmate. I deleted it when I realised it was in the screenshot.

'Rectangle globe' is one of the screenshots I uploaded to this topic 🙂

I was trying other solutions after posting on here cos I didn't expect a reply so quick. I've just done a Malwarebytes scan in safe mode and it flagged up a lot of IObit ASC stuff so I quarantined it. I'll take your advice and remove all that stuff after I've done this Farbar Scan. 

Thanks

[EddieM]

P.S. After restarting in 'safe mode with networking' the rectangle isn't currently there.

[EddieM]

Hello again, here's the Zip file.

What do you mean by odd screen? The background photo? Or the Desktop icons/shortcuts? (I cropped the image so it didn't show the whole screen)

Farbar scan.zip

[Maurice Naggar]

What I meant by "odd screen" is the white image with the globe icon.

Please take a few minutes and do this report run.

Let’s  please try to get and run a special  report  tool from Microsoft. 

It does not make changes. It will be just a report.

 

• Please download Sysinternals Autoruns from here and save it to your desktop.
• Note: you also need to do the following:
• Right-click on Autoruns.exe and select Properties
• Click on the Compatibility tab
• Under Privilege Level check the box next to Run this program as an administrator
• Click on Apply then click OK

Double-click Autoruns.exe to run it.
Once it starts, please press the Esc key on your keyboard.
Now that scanning is stopped, click on the Options button at the top of the program and select Filter Options...

In the Autoruns Filter Options dialogue, verify that the following are unchecked, if they are checked, uncheck them:

• Include empty locations
• Hide Microsoft entries
• Hide Windows entries

Verify that the following is checked, if it is unchecked, check it:

• Verify code signatures

Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.

Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
Attach the Autoruns.zip folder you just created to your next reply

Thank you.

[EddieM]

Odd screen - Ah ok 😄

Autoruns scan attached

Autoruns EddieM.zip

[Maurice Naggar]

Thanks for the reports.   This next part is a first action step.

The system will be rebooted after the script has run.

This custom script is for  EddieM  only / for this machine only.

 

NOTE-1:  In addition, This fix will also run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

The  custom Fix script is going to be used by the FRST64.exe   tool   which you have on your DESKTOP folder.

Please save the (attached file named) FIXLIST.txt   to the  DESKTOP  folder   

Start the Windows Explorer and then, to the Desktop   folder.

RIGHT click on  FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it do its thing.  

Do let me know how things are overall,  after all this.

Sincerely.

 

Fixlist.txt

Edited January 26, 2021 by Maurice Naggar

[Maurice Naggar]

I just updated the last post to include the FIXLIST.txt

If you do not see it, make sure to do a Browser screen Refresh    (  F5 function key-press ).

[EddieM]

Hi again

Fixlog attached (took about an hour) and uninstalled the IObit/Driver Booster software that I forgot to earlier.

Seems fine, no rectangle 🙂

Thanks

Fixlog.txt

[Maurice Naggar]

Thanks for the report.  Great to know that the oddity on screen is no more.

I have 2 suggestions.

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

[    2     ]

Please do a new Scan on this machine, using Malwarebytes for Windows.

To run a Threat Scan, open Malwarebytes for Windows and click the blue Scan button.

Have patience during the run.

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.

See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

[EddieM]

Hi

Have changed settings in Waterfox, Firefox and Edge.

Malwarebytes scan attached. Nothing detected.

Mwb scan report.txt

[Maurice Naggar]

Good morning.  Thanks for the scan report.  One other report before we wrap-up this case.

I would like you to run a tool named SecurityCheck to inquire on the current-security-update  status  of some applications.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.
• This tool is safe.   Smartscreen is overly sensitive.
• Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
• Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[EddieM]

Hiya, attached Security Check file

SecurityCheck.txt

[Maurice Naggar]

Here's what the SecurityCheck tool has reported as needing your attention for some applications that need security related updates.

LibreOffice 6.4.4.2 v.6.4.4.2 Warning!  Download Update

OpenOffice 4.1.5 v.4.15.9789 Warning!  Download Update
------------------------------- [ Imaging ] -------------------------------
GIMP 2.8.22 v.2.8.22 Warning!  Download Update
-------------------------- [ IMAndCollaborate ] ---------------------------
Discord v.0.0.306 Warning!  Download Update
---------------------------- [ ProxyAndVPNs ] -----------------------------
OpenVPN 2.4.0-I602  v.2.4.0-I602   Warning!  Download Update

and these next ones, are flagged as Potential  unwanted

---------------------------- [ UnwantedApps ] -----------------------------
App Explorer v.0.273.4.137 Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it 

Avira System Speedup v.6.9.0.11050 << Hidden Warning! Suspected demo version of anti-spyware, driver updater or optimizer. 

[EddieM]

Hi, will do, thanks for your help with this :)

[Maurice Naggar]

You are most welcome.

To remove the FRST  tool & its work files, do this.  Go to your Desktop folder.  Do a RIGHT-click on FRST64.exe & select RENAME & then change it to UNINSTALL.exe .
Then run that ( double click on it)  to begin the cleanup process.

 

Delete Securitycheck.exe

Delete the autoruns

Any other download file I had you download, you may delete.

.

Backup is your best friend.  Keep backups of your system on a regular basis to offline storage & keep those safe. https://forums.malwarebytes.com/topic/136226-backup-software/

It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use.

Best  practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Don't remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.

 

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

 

Stay safe.  I wish you all the best.   😎

Sincerely,

Maurice

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

[Maurice Naggar]

Note for readers. If you have the same image as on post #1 then be sure to let your guide know if you had a failed Avira install or if the pc ever had Avira.