TechSpot

Browser crawling/freezing

By BergerBerger
Apr 20, 2010
  1. Hi

    I can see from looking on here, this is a common problem, but if someone could help me out?

    I am running IE8, I know the general internet connection is ok, cos my laptop via the wireless connection works ok downstairs. I have run AVG, Malwarebytes, SuperAntiSpyware, and nothing except tracking cookies found.

    Yet IE is almost unusable, as everything on searching just slows down to a standstill. No 'error' messages, or Page Not Found, just 'connecting', and endless pause, no matter what website - the same websites work fine on the laptop downstairs.

    I see some people have benefitted from others on here analysing a HJT log, I've never used HJT, but if someone can take the time to look at mine, I'll give it a go?

    Many thanks

    Marc
     
  2. Broni

    Broni Malware Annihilator Posts: 52,895   +344

  3. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    OK thanks that will take a while, my full AVG scan takes 3 hours, and as some of the other steps require re-starts, we may be some time! I ran Piriform CCleaner yesterday in one of my first efforts to resolve this, so do I need to download and run TFC as well?

    My Adobe & Java were out of date, so sorted that, but the Microsoft Updater is just going round and round 'checking' for updates, which is probably part of the problem...

    Already had Malwarwbytes, as per my original message, although I noticed it was slightly out-of-date (the Updater had not been working!), so have downloaded the latest and will run that...
     
  4. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    Hi there

    The anti-virus log requested was a csv. file as exported by AVG. As per step 7, I won't attach it, but there is little on it anyway: Log contents here:

    Scan "Scan whole computer" was finished.
    No infection was found during this scan
    Folders selected for scanning:;"Scan whole computer"
    Scan started:;"20 April 2010, 18:21:03"
    Scan finished:;"20 April 2010, 19:54:51 (1 hour(s) 33 minute(s) 48 second(s))"
    Total object scanned:;"263765"
    User who launched the scan:;"Me" *(edited, don't need my full name on here!)


    I have attached all other logs requested, plus a HJT log if it helps. As you can see, I can get to the internet intermittently, but there is still random freezing going on.
     

    Attached Files:

  5. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Did you try different browser, like Firefox, to see, if same issue occurs?

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  6. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    I haven't tried Firefox - I don't use it because some useful sites to me run Active X controls that are incompatible. Will run the combofix. Did the logs reveal nothing sinister to you?
     
  7. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    GMER shows some suspicious activity, but it's not clear.
    It's always a good idea to have second browser, so you can find out, if your issue is caused by a browser, or something else.
     
  8. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    Combofix done

    Hi

    Re: the Gmer log, it looked even more suspicious on-screen as it was highlighted in red as an issue...

    Combofix log and new HJT log attached for your perusal. Combofix did seem to find a hidden program and associated files called "Need2find" that nothing else had found so far...hope it is a clue.

    Thanks for your help. As I'm in the UK and it's 23.30, I'm off to bed, look forward to your thoughts tomorrow

    Marc
     

    Attached Files:

  9. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\docume~1\MARCWE~1\LOCALS~1\Temp\gel90xne.sys
    
    
    Folder::
    
    Driver::
    gel90xne
    
    
    Registry::
    
    RegLockDel::
    
    

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.
     
  10. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    Hi Broni

    All done, logs attached. Was gel90xne a virus of some sort?

    Thanks

    Marc
     

    Attached Files:

  11. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Yes, it was a malicious file.

    Delete your GMER file, download fresh one, run it and post new log.
     
  12. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    Gmer log attached :)
     

    Attached Files:

  13. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Looks good :)
    How is your computer doing?

    Delete GMER file.

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start>"Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall"
    Click OK (Vista users - press Enter).
    Restart computer.


    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.


    2. Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

    Post fresh HijackThis log as well.
     
  14. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    seems to be running a little free-er. Will go back up shortly and do these things on the desktop before logging off for the night. Thanks again for all your help.
     
  15. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    You're welcome :)
     
  16. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    fyi, the Kaspersky online scanner comes up with a digital signature error, saying it was generated with a trusted certificate, but has expired.
     
  17. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Make sure, your computer date is correct and try again.
     
  18. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    I ran it anyway. Taking a long time to download the required databas updates
     
  19. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Take your time :)
     
  20. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    now scanning, but going mega-slowly through DRIVER.CAB files after a bright start! IE working well otherwise though. Will leave it scanning and check back in the (English) morning.
     
  21. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Yes, those scan may take a while.
    Did you check your computer date? It's important to have it correct.
     
  22. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    thought I would need to re-start it to get into the BIOS and check? Forgive my naivety if not
     
  23. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    No. Go Start>Control Panel>Date and Time
     
  24. BergerBerger

    BergerBerger TS Rookie Topic Starter Posts: 47

    oh yes, that time is correct. however I was under the impression you could change the date in the BIOS (which I may have done years ago, don't ask), without it affecting the display date/time?
     
  25. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    ...and a date is correct too?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...