Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 hangs sometimes. Suspicious...


  • Please log in to reply
11 replies to this topic

#1 Hedgehog83

Hedgehog83

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 20 October 2016 - 04:03 PM

Hello,

I recently started to experience a hanging problem that happens intermittently. I didn't experience this problem before. However, on the previous install of Windows Vista, I had experienced this problem as well. The computer would almost freeze during normal use. This happened during web browsing. I was using Firefox on Vista and 7. The Task Manager showed the CPU usage at anywhere from 50-90%. Sometimes, for both OSs, the "unresponsive plugin" message would appear. I suspect, it has something to do with Firefox. However, this time(Windows 7), I am getting a message occasionally during normal web browsing. A Firefox tab fills up with a "Urgent Firefox Patch" and a download file(some script file) requests to be downloaded. Of course, I don't click on the "download" button. I just close the whole window, and it disappears. I am suspecting that my computer is infected.

 

Any ideas would be greatly appreciated. Malwarebytes is installed and didn't find anything. Avast Free version didn't find anything, except for PUPs. By the way, Avast presented me with a message that some plugin was giving a problem and I uninstalled it, as per Avast's recommendations. I have a screenshot, if needed.

 

I did start a topic about the same drive-by attack some time before, a few months back I think. I am just concerned that it happens frequently now and that it happened before as well.

 

I do have all the OS patches, AV is running. My OS is WIndows 7 SP1.

 

Thanks in advance.



BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:09:55 PM

Posted 23 October 2016 - 04:24 AM

Let's try looking at these 2 sets of reports:

Report Set #1)  Please run this report collecting tool (even though you may not be experiencing BSOD's) so that we can provide a complete analysis: (from the pinned topic at the top of the forum)   http://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/
FYI - I don't often use the Perfmon report, so if it doesn't work please just let me know.

NOTE:
Please zip up the (.ZIP) files - do not use .RAR or other compression utilities. 
.ZIP is the type file that can be uploaded to the forums.

Report Set #2)  Please do the following:
- open Event Viewer (run eventvwr.msc from the "Run" dialog)
- expand the Custom Views category (left click on the > next to the words "Custom Views")
- right click on the "Administrative Events" heading
- select "Save all Events in Custom View as..."
- save the file as Admin.evtx
- zip up the file (right click on it, select "Send to", select "Compressed (zipped) folder")
- upload it with your next post (if it's too big, then upload it to a free file-hosting service and post a link here).

FYI - If we're looking for Event ID 41 errors (unexplained shutdowns), there's more info on that here:  http://support.microsoft.com/kb/2028504

While waiting for a reply, please monitor your temps with this free utility: 

SpeedFan v. 4.5.1 and later (free from here:  http://www.almico.com/sfdownload.php ) can log temperatures in a CSV file:
You may not need to log temps - if uncertain, please ask.

To make it work (log the temps to a file) you have to do BOTH of the below:

1. Enable logging in general: Configure...Log...check "Enabled" then click on OK to save.

2. Enable logging for specific checks: Configure...Temperatures..left click on each sensor, then click on "Logged" at the bottom of the Window (for our purposes we want them all) then once you've selected "Logged" for all sensors, then click on OK to save.

The log will be located at C:\Program Files (x86)\SpeedFan

Naming: log files are named SFLogYYYYMMDD.csv, where YYYY is the year (four digits), MM is the month (2 digits, zero padded) and DD is the day (2 digits, zero padded). If a file already exists by that name, the file that already exists is renamed according to the following naming scheme: SFLogYYYYMMDD-CCCC.csv, where CCCC is a increasing number. The new file is then created with the standard file name scheme.

Notes: whenever you change the options related with logging, SpeedFan starts a new log file.

NOTE:You may want to turn logging off when we're done - as I don't know it's impact on performance or on the system.



 
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 Hedgehog83

Hedgehog83
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 24 October 2016 - 09:09 AM

Thanks for replying.

Here are the two attached reports.

Attached Files



#4 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:09:55 PM

Posted 27 October 2016 - 04:59 AM

Only 262 Windows Update hotfixes installed.  Most systems with SP1 have 350-400 or more.  Please visit Windows Update and get ALL available updates (it may take several trips to get them all).
The actual number is not important.  Rather it's important that you checked manually, installed any available updates, and didn't experience any errors when checking or updating.

Other than that, I don't see any problems with the system in the reports.
As such, I suspect a hardware problem.

Please start with these free hardware diagnostics:  http://www.carrona.org/hwdiag/html

Please run ALL of the reports and let us know the results.


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#5 Hedgehog83

Hedgehog83
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 30 October 2016 - 02:18 PM

Hi,
I checked Windows Updated and it doesn't seem like it gives me any other updates, except a few optional updates. I installed them and now have 270 updates installed. No other Updates are available for me at the moment. Not sure about the 300-400 number you talked about. The computer stopped hanging most of the time and I haven't received the "Firefox patch" screen for more than a week.

 

In your opinion, do you think my system is infected?

 

I will run the reports and let you know. Which hardware piece would you like me to test for possible issues?

 

Thanks.


Edited by Hedgehog83, 30 October 2016 - 02:22 PM.


#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:09:55 PM

Posted 01 November 2016 - 06:13 AM

Do not worry about the actual number of updates.  That's the number that I see most often and I use it to decide if I should ask you to check for more updates.

Also, it's the number of hotfixes installed - not the number of updates (I get that number from the systeminfo.txt report).  This will vary depending on if/how many roll-up updates you've applied (and I suspect it'll also change with the new method of distributing Windows Updates).

As long as you've checked (and haven't had any errors), then that's all that's needed.

 

In many cases, if Windows doesn't see a problem (when there's nothing in the reports) then we figure that the problem is beneath the threshold that Windows can see.

This is, most often, at the level of hardware, compatibility, or even some very low-level drivers.

As such, when we don't see errors in a system that's having problems, the most likely cause is a hardware problem/compatibility issue/ or low-level driver involvement.

The hardware diagnostics let us get a start on this - and if they all pass, then we move on to other things.

 

The hardware diagnostics (to include the malware scans) are designed to track down the most common problems that we see, and that there are diagnostic tests for.

Please run all of them and let us know the results.


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#7 Hedgehog83

Hedgehog83
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 03 November 2016 - 01:02 PM

Okay. I ran the extended test for the internal HDD. I also ran a quick test for an attached HDD. Both passed.

 

Then, I ran the CPU test, which passed as well.

 

As I do the other tests, I will update the status...



#8 Hedgehog83

Hedgehog83
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 03 November 2016 - 06:10 PM

Okay. I ran MemTest for 1 pass. It didn't find any errors.

Also, ran the Prime95 for 3 hours. It didn't find any errors.

 

I think that my hardware is fine.



#9 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:09:55 PM

Posted 04 November 2016 - 04:40 AM

If you don't think it's hardware, then the next step is a clean install of Windows:  http://www.carrona.org/canned.html#clean

 

If you want to try other things, here's my canned speech for some repair options:

 

NOTE:  Try a clean boot to see if the problem clears up that way:  http://www.thewindowsclub.com/what-is-clean-boot-state-in-windows
If it does, then different troubleshooting steps are called for.

Here's some repair/recovery/restore options (in this order):

1 - Startup Repair.  Run it 3 times, rebooting in between tries.

2 - System Restore to a point before this started happening.

3 - DISM/SFC repair (DISM doesn't work with W7, although SFC does)  - doesn't work if you're not able to boot to Windows (let me know and I'll post a way to do it from Startup Repair)
    

Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt).  Press Enter after typing it:
   
Dism /Online /Cleanup-Image /RestoreHealth

    FYI - I have repaired systems using the last command even though problems weren't found with the first 2 - so I suggest running them all.

    From this article: http://technet.microsoft.com/en-us/library/hh824869.aspx

    You can also run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption. Include the CBS log (located at C:\Windows\Logs\CBS\CBS.log) if you'd like to have a Windows Update expert check it (I don't check them because I can't read them)


4 - RESET using the "Keep My Files" option (W8 calls this a REFRESH; W7 and earlier doesn't have this function)

5 - Repair install of the OS (Thanks to FreeBooter!):
   

"How To Perform a Repair Installation For Windows 8, 8.1 and 10"
    https://www.winhelp.us/non-destructive-reinstall-of-windows-8-and-8-1.html

    "How to Do a Repair Install to Fix Windows 7"
    http://www.sevenforums.com/tutorials/3413-repair-install.html

    "How To Perform a Repair Installation For Vista"
    http://www.vistax64.com/tutorials/88236-repair-install-vista.html

    "Non-destructive reinstall of Windows XP"
    https://www.winhelp.us/non-destructive-reinstall-of-windows-xp.html


6 - RESET using the "Remove Everything" option (W8 calls this a RESET; W7 and earlier doesn't have this function)

If using W7 or earlier, this can be accomplished by resetting the system by use of the recovery partition/recovery disks/recovery drive.
If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here:  http://www.carrona.org/recdisc.html )

7 - Wipe and reinstall from the Recovery Partition (if so equipped)

8 - Wipe and reinstall from Recovery Media - to include deleting all partitions.
If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here:  http://www.carrona.org/recdisc.html )

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#10 Hedgehog83

Hedgehog83
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 04 November 2016 - 03:32 PM

I think that I will keep the system as it is for now. I just was concerned about the drive-by attack. It doesn't happen anymore. However, I don't know why it happened in the first place.

Do you think my software was not patched enough?

Or was it something above my control?

 

Anyway thank you for your help everyone.



#11 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:09:55 PM

Posted 05 November 2016 - 05:15 AM

I'd post over in the Security forums for advice about the possibility of an attack.

My advice is mostly centerd around this stuff:

 

Beyond this I have these 5 suggestions:
1.  Get ALL available Windows Updates.  It may take several trips to get them all
2.  Get ALL available, compatible updates for your system from the manufacturer's website (to include BIOS/UEFI).
3.  Get ALL available, compatible updates for the programs and any additional hardware installed on your computer from the developer's website
4.  Start with these free hardware diagnostics:  http://www.carrona.org/hwdiag.html
5.  If ALL of the hardware tests pass, then run Driver Verifier according to these instructions:  http://www.carrona.org/verifier.html - ONLY NEEDED if having BSOD's

 


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#12 Hedgehog83

Hedgehog83
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 06 November 2016 - 10:53 AM

Yes. Thank you.

 

I appreciate your help.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users