Solved Win7 x64 Sp1 (have sfc log) crashes and errors after updates-malware?

[circumvent]

Ok, uninstalled everything suggested except dup cleaner and I uninstalled slimcleaner.

restarted, but locking up office to leave, so I did one of the security checks again and attached log to see if you can ascertain anything, because I am consistently getting I don't administrative rights error at start up (that was since the beginning of the problem).

Tomorrow when I'm using this laptop, I'll be able to report back any problems further.

Thanks in advance.

 

[Jacee]

Thanks staying with me.

 

[andrew129260]

You have UAC disabled, please re-enable it. I suggest setting it to the highest setting. Always notify. You can find this under start-rb: Control panel. System and security. Change user account control settings.

Doing this will greatly increase the security of your system. Uac is a very important feature that should not be disabled.

You will get prompted when installing software and changing windows settings, but even though its one more click do not let it annoy you. Read each prompt and make sure you are opening and doing what you want it to do.

 

[circumvent]

You have UAC disabled, please re-enable it. I suggest setting it to the highest setting. Always notify. You can find this under start-rb: Control panel. System and security. Change user account control settings.

Doing this will greatly increase the security of your system. Uac is a very important feature that should not be disabled.

You will get prompted when installing software and changing windows settings, but even though its one more click do not let it annoy you. Read each prompt and make sure you are opening and doing what you want it to do.

Thanks Andrew, I did, but everytime I log on, I get an error message that I don't have administrative privileges and if I want to restart to enable if I am an administrator (I am on this computer). when I click yes, desktop shell just refreshes. I am always getting this error.

Don't know why...but what I really would love to know is what caused all of this in the first place. Like I said, I downloaded the "Download App" from Cnet which was supposed to update programs...of course I trusted it, it's Cnet after all...then kablooie...

Saw they have an updated version (not downloading it of course) with fix to dll...someone might want to check that out and warn others against using the "download app" from cnet if it was the culprit...

 

[circumvent]

Thanks staying with me.

No need to thank me my friend...as I said, you're my Guru (bowing profusely) and my Yoda (thankfully not as cryptic).

So to update, I have the UAC problem I cited above, but so far, no memory hogging and no freezes...but have to start using the computer for editing some stuff, so I am hoping that I can test all of my programs to ensure they are working.

Let me know if there are any kinds of scans I should run (still have to do the eset scan) to satisfy that system is running smoothly and malware free and system files are in order.

Bowing profusely again oh wise one.

 

[Jacee]

Right now, I'd like you to download TFC and run it.
TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Next, download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop.

Include the contents of both logs in your next post reply.

 

[circumvent]

Right now, I'd like you to download TFC and run it.
TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Next, download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop.

Include the contents of both logs in your next post reply.

How do I disable any script blocking protection?

 

[Jacee]

I don't think you have any ... If you do, it will pop up letting you know.

 

[circumvent]

I don't think you have any ... If you do, it will pop up letting you know.

Ok, I ran TFC and once again instead of prompting for a reboot, it opened up "libraries" again. That notwithstanding, I restarted, ran the DDS and here are the log files

 

[Jacee]

Uninstall all of these programs:

Bing Bar
Bing Desktop
BitTorrent
IObit Uninstaller
IObit Unlocker
IObit\LiveUpdate
4shared Desktop (use the uninstaller)
Java 7 Update 9 (64-bit)

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.(Go off line to run)[/*]
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".[/*]
• The tool will open and start scanning your system.[/*]
• Please be patient as this can take a while to complete depending on your system's specifications.[/*]
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.[/*]
• Post the contents of JRT.txt into your next message.[/*]

 

[Jacee]

See above first!

Did you change your 'default' location to open executable files with or to "libraries"? If you did, then please see this tutorial (scroll down to 'default') http://www.sevenforums.com/tutorials/257-windows-7-tutorial-index.html#post2397029

 

[circumvent]

Uninstall all of these programs:

Bing Bar
Bing Desktop
BitTorrent
IObit Uninstaller
IObit Unlocker
IObit\LiveUpdate
4shared Desktop (use the uninstaller)
Java 7 Update 9 (64-bit)

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.(Go off line to run)[/*]
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".[/*]
• The tool will open and start scanning your system.[/*]
• Please be patient as this can take a while to complete depending on your system's specifications.[/*]
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.[/*]
• Post the contents of JRT.txt into your next message.[/*]

Good morning my Yoda...ok, will uninstall all of the above, but can I reinstall the bittorrent after all this? will send the log/txt

 

[circumvent]

Did as instructed. Computer froze after the JRT scan, so had to do a hard power off and on.

here is the file for your opinion. Thank you *bowing as usual*

 

[circumvent]

See above first!

Did you change your 'default' location to open executable files with or to "libraries"? If you did, then please see this tutorial (scroll down to 'default') http://www.sevenforums.com/tutorials/257-windows-7-tutorial-index.html#post2397029

not that I am aware of...in fact I don't even really use the libraries folder, but seeing as we're talking malware, it may have changed...which one of the defaults should I be reading? (that's me ready to follow instructions to the letter).

 

[Jacee]

This may be best because of all the 'registry cleaning/optimizing' programs you've used.
http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html

Please update Malwarebytes', run a full scan, then post the .txt log.

 

[circumvent]

This may be best because of all the 'registry cleaning/optimizing' programs you've used.
http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html

Please update Malwarebytes', run a full scan, then post the .txt log.

Ok, noted...downloaded the zip file default notifications, not really sure which are applicable lol...it only happened with TFC when the scan and cleaning was completed, and given all of my 3 stooges jokes with this laptop, I'm not keen on default type associations (which to use) without the master's guidance..

Any idea why the dllhost.exe suddenly starts hogging memory? I've isolated that (as far as I can diagnose) as the reason for crashing/programs not responding.

Thanks for ALL of your help so far

 

[Jacee]

Process explorer can probably help you see why dllhost.exe is using so much memory
Process Explorer

See this and let me know what it's related to. Is dllhost.exe safe? How to remove a dllhost error?
Don't run this page's free scan!

 

[circumvent]

Process explorer can probably help you see why dllhost.exe is using so much memory
Process Explorer

See this and let me know what it's related to. Is dllhost.exe safe? How to remove a dllhost error?
Don't run this page's free scan!

Hi Jacee, good morning...tried not to bother you over the weekend but I spent majority of it running malware and antivirus scans...clean as a whistle according to mbam, msessentials etc. I didn't bother to upload those logs because well, nothing to report.

I think my sole issue at this point is why I have to keep enabling administrative rights at startup and the unexplained dllhost.exe (sometimes dllhost.exe*32)

Trying to figure out the process explorer...not really sure how to interpret it, but that dllhost.exe seems to be the major issue.

 

[Jacee]

Have you done this? http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html

 

[circumvent]

Have you done this? http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html

Well I did read the article, but was unsure if to enable or to disable the built in elevated admin account, I enabled it, but didn't restart yet as I am running the eset scanner...and sigh...malware found...I feel like shooting myself literally in my foot since this system is figuratively doing it.