Solved Explorer 11 does not work after cleaning with antivirus

[smoking84]

Hello unfortunately, after scanning with Panda Cloud Cleaner , ( the scan was routine and I do not have the infected PC , everything worked fine ), I also deleted 5 Unknown Autorun files that were to be required of the Explorer 11 since shortly after he started giving me problems of all sorts. Meanwhile, when I opened the browser, the processor was working erratically , reaching 51% at idle, then the download does not work anymore , clicking on sites such as Mega or others, but Microsoft is not the bar at the bottom with options to save the file . When Google asks me to set it as the default search engine , click on " No thanks" but when I open the page the banner keeps appearing as before and no various other similar problems. Also the pages where I Loggo does not save , and the history is gone , there are not even the folders column is empty!

So I decided to try uninstalling and reinstalling IE11 , but I have not solved even with IE10 gives me the same problems , including the processor is overworked when I surf on the browser, I also tried to remove the 10 and everything works with IE9 , history, can not download etc. .. very strange?:sarc: I would not use the 9 because it is obsolete, but to remedy the problem

I tried to go to Internet Options > Tools> Advanced > Reset but still no results, I can not download the file. I also tried to check in Security> Custom Level to see if it's on the download file, and everything is ok, SFC/SCANNOW is all ok, how can I solve these problems?

I only have problems with Explorer, but Firefox everything is ok, downloading and surf without any problems, but my default browser is Explorer then I would try to solve. Thank you so much!

 

[ThrashZone]

I also deleted 5 Unknown Autorun files that were to be required of the Explorer 11 since shortly after he started giving me problems of all sorts.
!

Hi,
How exactly did you do that ?

 

[smoking84]

I also deleted 5 Unknown Autorun files that were to be required of the Explorer 11 since shortly after he started giving me problems of all sorts.
!

Hi,
How exactly did you do that ?

I do not remember exactly, i selected unknown autorun program at the end of scan. 5 file, i see the log saved of scan, but i do not see anything of IE11, i post the log of scan

nknown. FILE: C:\WINDOWS\SYSWOW64\ASGT.EXE to be deleted.

Unknown. REGKEY: HKLM\SYSTEM\CurrentControlSet\Services\ASGT. Key to be deleted.

Broken Link. FILE: File not found:\REGISTRY MECHANIC\REGMECH.EXE "\F" to be deleted.

Broken Link. TASK: Task\[RMSchedule.job]. Task to be deleted.

Broken Link. FILE: File not found:C:\WINDOWS\AUTOKMS\AUTOKMS.EXE "" to be deleted.

Broken Link. TASK: Task\[AutoKMS.job]. Task to be deleted.

 

[ThrashZone]

Hi,
The adage goes like this,
If you don't know what it is don't delete it if using Autoruns,
autoruns,
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
What not to uncheck,
http://forum.sysinternals.com/topic5226_page4.html
http://forum.sysinternals.com/faq-common-autoruns-issues_topic4719.html

How long ago was this ran ?
System restore to an earlier time might be a good idea to try ?

 

[smoking84]

Hi,
The adage goes like this,
If you don't know what it is don't delete it if using Autoruns,
autoruns,
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
What not to uncheck,
*** What to uncheck and what not. *** - Sysinternals Forums
http://forum.sysinternals.com/faq-common-autoruns-issues_topic4719.html

How long ago was this ran ?
System restore to an earlier time might be a good idea to try ?

With this software i can restore the autorun missing?

 

[ThrashZone]

Hi,
I was really asking if that was what you used,
You referred to the program you used as "Unknown autorun" ?

 

[smoking84]

I wanted to do a system restore, but the earliest date is April 27 11pm hours but the damage I've done April 27 in the morning!! if I click "show more restore points" do not come out of the older. It is normal?

 

[Slartybart]

Hi,
I was really asking if that was what you used,
You referred to the program you used as "Unknown autorun" ?

@Thrashzone: I think Smoking84 selected the option to clean unknown autoruns in Panda. I don't think the member used autoruns.

@Smoking84: No, autoruns will not repair the damage.

Please post two screen shots of System Protection Restore Points (RP)
1 - where it shows the most current RP
2 - where it shows older RPs

It appears to me that more is going on with your system than just what was highlighted when you ran Panda. None of those objects deleted would cause IE to behave as you describe

Unknowns:
ASGT appears to be Asus GPU Tweak

Brokens files and associated tasks:
RegMechanic is a 3rd party tweaking utility - these are never recommended.
-> Task\[RMSchedule.job]

AUTOKMS.EXE: might be a virus, at least a Potentially Unwanted Program (PUP)
Malware scan of AutoKMS.exe (AutoKMS) 53d5c81eee1d9397ad6657088a49d72343022203 - herdProtect
-> Task\[AutoKMS.job]​

Please follow this tutorial:
http://www.sevenforums.com/tutorials/92394-sf-diagnostic-tool-using-troubleshooting.html and attach the SF_DD_MM_YYYY zip folder to a new post on this thread.

---

Run AdwCleaner to follow-up on what Panda reported (AutoKMS might be malware)

Follow steps I, II, and III (Download, Scan, and Clean) in this tutorial on the author's site: How to use AdwCleaner version 3.x

Post any logs here on SevenForums - not on the General Changelog Team (GCT) site. SevenForums members might ask you to launch other on-demand scanners that are not familiar to GCT.

When your system is clean of malware, launch AdwCleaner a final time and click the Uninstall button.

Thanks

 

[Slartybart]

I also tried to remove the 10 and everything works with IE9 , history, can not download etc. .. very strange?:sarc: I would not use the 9 because it is obsolete, but to remedy the problem

I tried to go to Internet Options > Tools> Advanced > Reset but still no results, I can not download the file. I also tried to check in Security> Custom Level to see if it's on the download file, and everything is ok

Just so I'm clear.... you rolled IE back to version 9 and everything works as it should, including downloads.

I understand not wanting to stick with IE 9, but I had some issues with IE 10 and then IE 11 when they first came out and had to roll back. I just today moved back up to IE 10. The IE 10 update required a platform update and I think that in combination to the way IE works and is configured caused the issue on my HP.

If you're still on IE 9, and I recommend stating on 9 until things are sorted out,
1. Check the shortcut - IE 9 should point to the (x86) programs folder and start in the same
2. Please run a manual Windows Update (WU) and accept / install all offers. Run WU until it offers no updates.

Restart your machine - post when you've caught up to the requests / suggestions I've made.

Thanks

 

[andrew129260]

I do not think this is a panda issue. I think this is something else wrong with internet explorer or malware.

Questions to answer:

• Do you have protected mode enabled in internet explorer?
  
• Does safe mode with networking show the same issues?

Steps to do:

1.) Run a full scan with panda cloud antivirus again. Remove anything found.

2.) Download herdprotect:

Download herdProtect - Free Anti-Malware Platform

Then run the scan, when it finishes, save the results per the screenshot below. Then upload the log here.

DO NOT REMOVE ANYTHING YET. I will advise if anything needs removed when I receive the log.

3.) Run sfc /scan now using option 2 in this tutorial: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

4.) Most people that run the offline installer seems to fix their internet explorer issues with version 11.

See here:

http://windows.microsoft.com/en-us/internet-explorer/ie-11-worldwide-languages

Download using firefox or internet explorer 9. Install and then restart.

 

[smoking84]

@Slartybart Now I still have 11 explorer but I'll try to uninstall until 9 and do as you said. I noticed one thing probably also caused by deletion of files by Panda: right-click the folder of SF diagnostic and control "Add to archieve Winrar" was not longer there!:shock: I have uninstalled and reinstalled WinRar and all ok..
Now your request:
- Screen of restores points, today go until 28 april, yesterday until 27

 

[smoking84]

 

[smoking84]

I add the results of SF diagnostic and scan with ADWCleaner (so after Panda i have already cleaned with ADW and also CureIT for this i think the log is clean). Many thanks!

 

[andrew129260]

When you reinstall internet explorer 11,

See my post #10

http://www.sevenforums.com/browsers...ork-after-cleaning-antivirus.html#post2763656

 

[smoking84]

@andrew129260 I tried in safe mode and something works! Still does not download, but the chronology is present and properly saved, logins are stored and tabs are also saved!
So what does this mean? is a virus?
I runned sfc/scannow and sfc/verifyonly and all ok.
I add the results of scan with HerdProtect has found some malware.

 

[ThrashZone]

Hi,
Until either of them return see if safe mode with networking helps,
What are you attempting to download one of the scanners ?
Don't download anything but scanners for now please and only the ones these guys recommend
Cheers.

 

[NoelDP]

I believe that AutoKMS is an Activation Exploit - however, it's not one that I'd have associated with a Home Premium install.


Please follow this tutorial and post an MGADiag report - then we can see what the problem is.

http://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html

Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
http://www.microsoft.com/en-us/howtotell/Hardware.aspx

 

[smoking84]

@TrashZone Ok i await the response of andrew129260 regarding the safe mode, and if I have to remove something from the report of herdProtect

@NoelDP My windows 7 is original and genuine. The KMS activator i used two years ago to activate Office 2010 not original. I add the report MGAD:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-RC36R-7G4HB-M8VG2
Windows Product Key Hash: 7ARrP4gB1NU79i3Pjs+6izseHFE=
Windows Product ID: 00359-OEM-8703424-89321
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {BB325F30-0231-48A5-94D5-9AC798DFB4BC}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{BB325F30-0231-48A5-94D5-9AC798DFB4BC}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-M8VG2</PKey><PID>00359-OEM-8703424-89321</PID><PIDType>3</PIDType><SID>S-1-5-21-3703924579-2982921444-2800388492</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1305</Version><SMBIOSVersion major="2" minor="6"/><Date>20110211000000.000000+000</Date></BIOS><HWID>89893507018400FE</HWID><UserLCID>0410</UserLCID><SystemLCID>0410</SystemLCID><TimeZone>ora solare Europa occidentale(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Versione servizio di gestione licenze software: 6.1.7601.17514

Nome: Windows(R) 7, HomePremium edition
Descrizione: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
ID di attivazione586bc076-c93d-429a-afe5-a69fbc644e88
ID applicazione: 55c92734-d682-4d71-983e-d6ec3f16059f
PID esteso: 00359-00174-034-289321-02-1040-7600.0000-1052011
ID di installazione: 000700488711523720077894629534501481838793823905359220
URL certificato processore: http://go.microsoft.com/fwlink/?LinkID=88338
URL certificato computer: http://go.microsoft.com/fwlink/?LinkID=88339
URL licenza d'uso: http://go.microsoft.com/fwlink/?LinkID=88341
URL certificato codice "Product Key": http://go.microsoft.com/fwlink/?LinkID=88340
Codice "Product Key" parziale: M8VG2
Stato licenza: concesso in licenza
Numero di ripristini Windows rimanenti: 4
Ora attendibile: 01/05/2014 18:53:35

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 4:4:2014 21:01
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAln2SALCReBkaXayLVL8Y4W7gZKKtCC5z

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            AMICPU        PROC

 

[NoelDP]

The report looks fine to me - although the Office install shows up, my skills don't extend to divining much about it, since Office 2010 isn't supported by MGADiag

 

[andrew129260]

The only entry seen in the log that is concerning (and not by much) is a small piece of adware that is flagged.

File path:         c:\program files (x86)\utilitychest_49ei\installr\1.bin\np49eisb.dll
Publisher:         Utility Chest
Signer:         Mindspark Interactive Network
MD5:             99b04a82a63642d25b63fb8975e319e2
SHA-1:             e4de943602500da7802a214b4cf75a354db409d1
Created:         14/04/2013 15:26:00
Detections:         16
Determination:         Adware
            - avast! as Win32:Mindspark-A [PUP] (Adware)
            - Kaspersky as not-a-virus:WebToolbar.Win32.MyWebSearch (Adware)
            - VIPRE Antivirus as MyWebSearch.J (Adware)
            - Antiy Labs AVL as WebToolbar/Win32.MyWebSearch.gen (Adware)
            - AhnLab V3 Security as Adware/Win32.MyWebSearch (Adware)
            - ESET NOD32 as Win32/Toolbar.MyWebSearch (Adware)
            - Fortinet FortiGate as Riskware/MyWebSearch (Adware)
            - AVG as Skodna.Generic (Undefined malware)
            - Reason Heuristics as PUP.MozillaPlugin.MindsparkInteractiveNetwork.I (Adware)
            - Trend Micro House Call as TROJ_GEN.F47V0913 (Undefined malware)
            - Dr.Web as Adware.MyWebSearch.44 (Adware)
            - Kingsoft AntiVirus as Win32.Troj.MyWebSearch.(kcloud) (Adware)
            - NANO AntiVirus as Trojan.Win32.WebToolbar.cruvcz (Undefined malware)
            - Rising Antivirus as PE:Malware.MyWebSearch!6.3F3 (Adware)
            - Baidu Antivirus as Adware.Win32.MyWebSearch (Adware)
            - herdProtect (fuzzy) as a variant of 947a12b42b2a8765a0814b6e6e5157b2167680d7 (Ignore)

I would delete this entry unless you determine that software to be safe. I do not think it is, its a common bothersome toolbar. I would recommend removal. Otherwise, you look good on the malware side of things.

Since per noel states that your windows installation is genuine, lets proceed.

I want to confirm you have done steps 3 and 4 as stated in post 10:

3.) Run sfc /scan now using option 2 in this tutorial: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

4.) Most people that run the offline installer seems to fix their internet explorer issues with version 11.

See here:

Download Internet Explorer 11 - Microsoft Windows

Download using firefox or internet explorer 9. Install and then restart.