Steve wrote:
On 5/22/2018 1:03 AM, Steve wrote:
On 5/18/2018 9:42 AM, Steve wrote:
On 5/18/2018 12:28 AM, Steve wrote:
Not sure the computer will let me send this, but here goes.

About 2 weeks ago, it started. I first saw it using a little program
called Mail Washer. It started trying to log in to the mail server
over and over, multiple times a second. The "process" button
wouldn't function to let me delete the ones selected.
I quickly discovered it wasn't a mail washer problem. Firefox,
windows explorer, and Thunderbird weren't good either. In a browser,
the open tab flashes back and forth between the circle arrow(reload
page) and the X (stop). Again multiple times a second. Most web
pages eventually go white.
While this is going on, the desktop icons don't function. Double
click does nothing and right click opens up the menu that should
come up when I right click and empty spot on the desktop.
I "fixed it" once by bringing up troubleshooting. Troubleshoot
windows update, it found something and fixed it. Good for over a week.
Last night, it prompted me to install an update by restarting. It's
set to install updates automatically, so I don't see these requests
often. I shut it down overnight. Today I turned it back on. It took
maybe half an hour installing an update. I tried undoing that update
but it couldn't do it. Troubleshooting is no help this time.
Where do I start now?

Well, after I wrote all the above last night, I maximized Firefox
which had been opened the whole time, but minimized. Everything was
normal again. I checked the mail washer program and it was all normal
too. It was bed time and I decided to shut the computer off over
night. Today everything is normal so far. I feel like it's working a
little slow, but I'm not even sure.


Still mostly good, but... Today I was on Facebook and the page would
refresh itself for no reason. Could be a Facebook problem, but...
Tonight I was on Facebook and trying to write a long answer to
something on a group and it would refresh, making my writing
disappear. I had to open notepad and type it there. Even notepad would
jump, blink out and come back. When it did this, it would insert the
date into what I was typing. I got it done and I copied it into Facebook.
As I'm typing this, here with Thunderbird, everything is normal. While
I was fighting with Facebook, a message popped up saying a "security
and stability" update had been downloaded and I needed to restart.
I'll now shut off the computer and go to bed. Tomorrow, I'll start it
up and it will finish the install. Now I'll wait to see if my computer
becomes a mess again, or, do I dare to hope it will fix things this
time? I'll let you know.


I was kind of hoping I wouldn't have to come back here for a while. Last
night, I ran my malware program 3 times because there were 2 things it
failed to fix. I'm using spybot and I know some of you will tell me it's
no good. (Go ahead and say it, if it's true.) The 2 problem ones were
listed as registry changes. It had them checked to be fixed, but they
are still there. Today I ran it 2 or 3 times while in safe mode. Same
results.
Then I did the most detailed virus scan and it says nothing was found.
My thanks for doing all that is that my computer is all jumpy again.
Firefox works but jumps from one part of a web page to another, then
back where it was supposed to be.
I tried Microsoft Edge and it's completely worthless. I'm going to start
a new subject, but I have to leave right now. Later. Most likely, the
computer will be running fine when I get back, because that's what it
does. Steve.

Windows Defender has an "offline scan" capability now.

You could give that a try for fun.

https://support.microsoft.com/en-ca/...-protect-my-pc

I gather by the description of the Win7/Win8 version, the initial
time spent in the Windows 10 version, is making a boot environment
for itself to run the offline scan from. So the initial 15 minutes,
it's just making boot materials, then it reboots, then the scan runs
(in relative quiet).

*******

The Registry is a file system.

It also has permissions and ownership, and some registry
entries are owned by TrustedInstaller.

To delete registry entries, you could use the Registry
editor on a Kaspersky rescue disk. (I use a disc that is
about a year old, as some recent Kaspersky discs weren't
behaving properly.)

Or, you can use registry commands launched from Task Scheduler.

Or, you can use psexec to launch a Command Prompt window
owned by the SYSTEM account.

https://docs.microsoft.com/en-us/sys...nloads/pstools

From an administrator command prompt (so you have impersonate
privileges):

cd /d %userprofile%\Downloads === where psexec is unpacked

psexec -hsi cmd === pick one as a function of
psexec64 -hsi cmd whether this is a 32 bit
or 64 bit system

The Command Prompt window that opens, will be
owned by SYSTEM account. If you run

whoami

in the window that opens, it will confirm the
account information. Launching

regedit

from there, should give you the ability to modify
registry keys you wouldn't normally be able to
modify.

And obviously, if a registry key puts itself back,
a malware can do that.

Paul