Solved Explorer 11 does not work after cleaning with antivirus

[smoking84]

Hi, i make the CBS.log in cmd and the sfcdetails.txt is empty..is ok?
I downloaded IE11 offline and reinstalled but unfortunately i have the same problems..
In safe mode a part of things, such as tab cronology and login, work

 

[NoelDP]

Please follow the Windows Update Posting Instructions and post the requested data - If the file is too big to upload, remove the oldest CBSPersist cab files until the total size is below 8MB, and it should then upload.

 

[smoking84]

Please follow the Windows Update Posting Instructions and post the requested data - If the file is too big to upload, remove the oldest CBSPersist cab files until the total size is below 8MB, and it should then upload.

I followed the instructions and installed the Tool (installation completed in few minutes with no errors), then I ran sfc/scannow. I add the Logs folder of windows. Thanks!

 

[cottonball]

smoking84,

After doing what NoelDP instructed, please do the following to check out whether malware is still a player...

:info: Please use the Farbar Recovery Scan Tool Download
Select the version that applies to your system.
Save it to your Desktop.
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.

At the program's console, press the Scan button.

When done, the tool produces a log, FRST.txt, on the Desktop.
:ar: Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt
:ar: Also post the Addition.txt in your reply.


:info: Next, please use the tool Zoek.exe:
Download > Download zoek.exe version 5.0.0.0

When the Zoek.exe download appears, save to the Desktop.
On the Desktop, right-click Zoek.exe and select: Run as Administrator
Give it a few seconds to appear.

Please disable your AntiVirus and AntiSpyware programs, so they don't interfere with the running of Zoek.exe.
You can find instructions how to disable your security applications here:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

At the program console, click the Options button and place a checkmark only on the following options:

Do a Deep Scan
Installed Programs

Now...
Close any open programs.
Click the Run script button, and wait.
It takes a few minutes to run.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

:ar: Please post the zoek-results.log in your reply.

 

[smoking84]

Hi cottonball I ran all the scans you suggested, i add the report. I hope to solve this problems Thanks!

 

[andrew129260]

There are a few BHO's and some other entries that look concerning, but I will wait for cottenballs reply. I only briefly looked through the logs. He is certified in malware removal, I am not. So I will let him take over this area of it.

This caught my eye though:
Based on this line made me think this is the main cause of your issues:

Task: C:\Windows\Tasks\RMSchedule.job => P:\Registry Mechanic\RegMech.exe

Do you use registry cleaners? It looks that way. Uninstall them. The only optimization program windows 7 needs is nothing. If you insist though, ccleaner is the only option I would recommend. These programs are snake oil and cause way more issues then they are worth. Did you use this program recently? This might have caused the corruption with internet explorer.

 

[cottonball]

smoking84,

Thank you for providing the reports.

Will take a look at them tomorrow (Sunday), and will get back with you on what to do next.
Just got home, and it has been a long day.

Thanks for your patience.

 

[smoking84]

@cottonball ok thank you for help!
@andrew129260 registry mechanic installed 2-3 years ago, but I've never used just because I read that creates problems especially with SO installed in SSD. So i unistalled it shortly after.
I think that Panda has recognized as malware a registry key or a file necessary for IE11..but if it were so why in Safe mode some thing work?

PS in the same day of scan with Panda few hours before i've download a file with virus. Sospicious Cloud 9 but immediately remove by Norton. So do not think has to do with the problem

 

[cottonball]

smoking84,

Thanks for your patience.

:info: Please temporarily disable your AV program (Norton AntiVirus)
Info on how to disable your security applications > How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

From past experience, have noticed sometimes Norton has a tendency to make certain repairs very difficult.


:info: Please open Notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the code box below (Do not copy the word 'code') to Notepad.
Save it to the Desktop, and name it: fixlist.txt

start
HKLM-x32\...\Run: [] => [X]
HKU\.DEFAULT\...\RunOnce: [] - [X]
HKU\S-1-5-19\...\RunOnce: [] - [X]
HKU\S-1-5-20\...\RunOnce: [] - [X]
HKU\S-1-5-21-3703924579-2982921444-2800388492-1000\...\Run: [] => [X]
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
Toolbar: HKCU - No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
SweetIM for Messenger 3.3 (HKLM-x32\...\{1D301950-EA2F-4882-9AA0-49467756842A}) (Version: 3.3.0007 - SweetIM Technologies Ltd.)
Task: {6A3BB960-A754-4DCD-A8A8-2B9812114C9C} - \AmiUpdXp No Task File
Task: {F4D81D4B-B0BD-42BF-92E1-FB600E9AFECF} - System32\Tasks\bench-S-1-5-21-3703924579-2982921444-2800388492-1000 => C:\Program Files (x86)\Bench\Updater\updater.exe
Task: C:\Windows\Tasks\RMSchedule.job => P:\Registry Mechanic\RegMech.exe
end

NOTICE: This script is written specifically for this computer!!!
Running this on another computer may cause damage to the Operating System.

Now, please run FRST, and press the Fix button, just once, and wait.

When done, the tool creates a report on the Desktop called: Fixlog.txt
:ar: Please post the Fixlog.txt in your reply.


:info: Next, on the Desktop, right-click the Zoek.exe file and select: Run as Administrator
Give it a few seconds to appear...

Copy/paste the entire script inside the code box below to the input field of Zoek:

autoclean;
emptyclsid;

Now...

• Close any open Browsers.
• Click the Run script button, and wait. It takes a few minutes to run all the script.
• When the tool finishes, the zoek-results.log is opened in Notepad.
• The log is also found on the systemdrive, normally C:\
• If a reboot is needed log is opened after the reboot.

:ar: Please post the zoek-results.log in your reply.

 

[cottonball]

smoking84,

Also, please provide some feedback as to what problems. specifically, you are still having.

Thanks!

 

[smoking84]

One question: when i run FRST and Zoek may be installed Explorer 11 or indifferent? Because in this moment i have explorer 9

 

[cottonball]

I do not quite understand your question...

You can just run either tool on whatever browser you have.

 

[smoking84]

Ok so i followed the instructions and add the report request. After scans i installed IE11 (i had IE9) but unfortunately i have the same problems for which i opened this thread

PS AN IMPROVEMENT OF PROBLEM! in IE11 still not working the cronology (is empty) and logging and not download but now the tab working (now saves in the tabs the sites i've visited)

 

[cottonball]

smoking84,

Not sure if I understand correctly what you mean about the IE11 chronology...
On the Address Bar at the top left, click the arrow for: Show Address bar AutoComplete
Does it display a list of web addresses that you have previously typed into the Address bar?
Is that what you mean?


On the ASUS AI Suite II for monitoring and controlling utilities on your motherboard.
Would prefer you address the issue at the Windows 7 Help Forums - Search Results
Or, maybe someone else here can help you with it.
I have never used nor have any knowledge of the program.

 

[andrew129260]

Ok so i followed the instructions and add the report request. After scans i installed IE11 (i had IE9) but unfortunately i have the same problems for which i opened this thread

PS AN IMPROVEMENT OF PROBLEM! in IE11 still not working the cronology (is empty) and logging and not download but now the tab working (now saves in the tabs the sites i've visited)

Please answer the following questions to receive help:

1. So what is not specifically working in internet explorer now? Same high cpu usage?
2. Did you uninstall the registry cleaners?
3. Have you done the sfc /scannow?
4. Did you use the offline installer like I asked when installing internet explorer 11?

 

[cottonball]

smoking84,

Oops, forgot the following...

Please open a Command Prompt using Option One:
http://www.sevenforums.com/tutorials/947-command-prompt.html

Next, at the Command Prompt, copy/paste (using the mouse) the command below, and press: Enter

DEL /F /S /Q /A "P:\Registry Mechanic\RegMech.exe"

The file should now be deleted.
Please close the Command Prompt.


Also, please run Zoek.exe once again, and copy/paste the following text inside the code box below to the input field of Zoek:

{D46CC82E-00AD-4927-A666-60EB15439369};c

Now...

• Close any open Browsers.
• Click the Run script button, and wait. It takes a few minutes to run all the script.

 

[smoking84]

@cottonball clicking on the small arrow on the top left of Address Bar the cronology is present and site saves. But on the right bar where the cronology is saved and sorted in folders Daily is empty (in normal mode only, in safe mode the cronology is present). I add an image for clarity:

 

[smoking84]

@andrew129260

-Now there are only one improvement: the tab are saved but only installation online (IE11 installed offline the tab still not working). Still not download (i download only the video that are open with WMP streaming), not cronology in folders. The processor when I surf on sites continues to work more than they should about 40% and more, while with Firefox <10%

-Yes Registry Mechanic is uninstalled (among other things, the location where it was installed is no longer present because I replaced the hard disk for storage because he had bad sectors)
- Run sfc/scannow and all ok

For example in IE11 Gooogle asks me if I want to set it as the default search engine, so if click Yes,
appear an error because probably it can not download the necessary files, i add the screens:

 

[Britton30]

Federico, please do this to attach images, tinypic is serving up loads of ads and the images are very small, hard to read.

This is the preferred, best way to upload an image or a file to a post.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html#post93869

Press the ALT and PrntScrn keys at the same time, this will capture only the active window to use in Paint or your preferred graphics editor.

You may also upload a photo or image you already have on your PC, as you would a file, without using the Snipping tool.

 

[NoelDP]

Sorry for the hiatus - I've been in bed most of the few days

There don't appear to be any problems in your CBSPersist logs - or the CheckSUR. (the CBS.log itself wasn't there, though??)

However, the Filterlist is interesting, and seems to indicate that you've got Symantec Endpoint Protection installed - so my first reaction is to blame Symantec for the problem.
Looking at the FRST results, the actual installation appears to be Norton Anti-Virus? Have you ever had SEP installed?