Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Constant clicking like a page is reloading.


  • This topic is locked This topic is locked
5 replies to this topic

#1 MGFJR1

MGFJR1

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 07 October 2017 - 07:25 PM

there is constant clicking, like a page is reloading over and over again. Not physical clicking as it disappears when I mute the speakers. Whenever I'm working on a window or or page, it takes the the cursor off of what im working on. IE I'm typing this, but eventually the cursor will disappear and I'll have to click on the page again to continue typing. I feel like it slows my computer down a bit. It is getting so annoying lol. I've run malwarebytes 3 times. Last one was clear. So I am here. Logs are attatched per the rules lol. Ty in advance

P.S. I just realized that in my Task Manager, application tab, I have received hundreds of "6086" applications

Attached Files


Edited by MGFJR1, 07 October 2017 - 07:38 PM.


BC AdBot (Login to Remove)

 


#2 Jo*

Jo*

  • Malware Response Team
  • 3,410 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:03:09 AM

Posted 08 October 2017 - 07:48 AM

:welcome: to BleepingComputer.

Hi there,

my name is Jo and I will help you with your computer problems.


Please follow these guidelines:
  • Read and follow the instructions in the sequence they are posted.
  • print or copy & save instructions.
  • back up all your private data / music / important files on another (external) drive before using our tools.
  • Do not install / uninstall any applications, unless otherwise instructed.
  • Use only that tools you have been instructed to use.
  • Copy and Paste the log files inside your post, unless otherwise instructed.
  • Ask for clarification, if you have any questions.
  • Stay with this topic til you get the all clean post.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

***


:step1: Please download Security Analysis by Rocket Grannie from here
  • Save it to your Desktop.
  • Close your security software to avoid potential conflicts.
  • Double click RGSA.exe
  • Click OK on the copyright-disclaimer
  • When finished, a Notepad window will open with the results of the scan.
  • The log named SALog.txt can also be found on the Desktop or in the same folder from where the tool is run if installed elsewhere.
  • Please copy and paste the contents of that log in this topic.
  • Note:
If you get a Warning from Windows about running the program, click on More info and then click Run Anyway to run it even though Windows says it might put your PC at risk.
 

***


:step2: Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  • Double click on downloaded file. OK self extracting prompt.
  • MBAR will start. Click in the introduction screen "next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
With some infections, you may see two messages boxes.
  • 'Could not load protection driver'. Click 'OK'.
  • 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
  • If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  • If there is no malware found, please let me know as well.

***


:step3: Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8/10 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Logfile button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
    If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#3 MGFJR1

MGFJR1
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 08 October 2017 - 01:18 PM

I do have to add some information. After I posted, I thought of finding the location of the 6086 and deleting it. It wouldn't let me, so I deleted the files in the folder, then the folder. The files were created by something called "Rangy.exe". Then when I stopped that process, it started coming up under "Bringgs.exe". I deleted every location I could find and the 6086's stopped popping up. I'm thinking it's just laying dormant so I'm definitely doing all the steps you have given me...

Step 1 

 

Result of Security Analysis by Rocket Grannie (x86) Updated: 06 October, 2017
Running from:C:\Users\PC\Desktop (14:00:27 - 10/08/2017)
***---------------------------------------------------------***
Microsoft Windows 7 Ultimate X64 Service Pack 1
UAC is Enabled
Internet Explorer 11
Default Browser: Google Chrome
***------------Antivirus - Antispyware - Firewall-----------***
Malwarebytes (Disabled - up to Date)
Malwarebytes (Disabled - up to Date)
Windows Defender (Disabled - up to Date)
Windows Firewall (Disabled)
No other Firewall Installed
***-------Security Programs - Browsers - Miscellaneous------***
Adobe Flash Player NPAPI is not installed
CCleaner (4.15) ==> is out of Date
Google Chrome (61.0.3163.100)
Java (8.0.1440.1)
Malwarebytes (3.2.2.2029)
Mozilla Firefox (56.0)
Opera (48.0.2685.35)
 
***----------------Analysis Complete-------------------------***
 
STEP 2
 
No Malware Found
 
Step 3
 
# AdwCleaner 7.0.3.1 - Logfile created on Sun Oct 08 18:17:20 2017
# Updated on 2017/29/09 by Malwarebytes 
# Database: 10-04-2017.1
# Running on Windows 7 Ultimate (X64)
# Mode: scan
 
***** [ Services ] *****
 
No malicious services found.
 
***** [ Folders ] *****
 
PUP.Optional.Legacy, C:\Users\PC\AppData\Local\torch
PUP.Optional.Legacy, C:\ProgramData\torchcrashhandler
PUP.Optional.Legacy, C:\ProgramData\Application Data\torchcrashhandler
PUP.Optional.Legacy, C:\Users\All Users\torchcrashhandler
 
 
***** [ Files ] *****
 
PUP.Optional.Legacy, C:\END
PUP.Optional.Legacy, C:\Users\PC\Desktop\Facebook.lnk
PUP.Optional.Legacy, C:\Users\PC\Desktop\Free Games.lnk
PUP.Optional.Legacy, C:\Users\PC\Desktop\Youtube.lnk
PUP.Optional.Torch, C:\Users\PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Torch.lnk
PUP.Optional.Torch, C:\Users\PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Torch.lnk
PUP.Optional.Torch, C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torch.lnk
PUP.Optional.Torch, C:\Users\PC\Desktop\Torch.lnk
 
 
***** [ DLL ] *****
 
No malicious DLLs found.
 
***** [ WMI ] *****
 
No malicious WMI found.
 
***** [ Shortcuts ] *****
 
No malicious shortcuts found.
 
***** [ Tasks ] *****
 
No malicious tasks found.
 
***** [ Registry ] *****
 
PUP.Optional.Legacy, [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {0251E282-5CF8-41CF-B783-C4E5A6B01A3A}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\torch
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-3919306709-814264073-2542757446-1000\Software\torch
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-3919306709-814264073-2542757446-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\torch
PUP.Optional.Legacy, [Key] - HKCU\Software\torch
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\torch
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Applications\Torch.exe
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Clients\StartMenuInternet\Torch
PUP.Optional.WindowService, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MeOptimum_x86
PUP.Optional.WindowService, [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application
PUP.Optional.WindowService, [Key] - HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application
PUP.Optional.Torch, [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {00935F84-6FF9-4B54-9CBD-51514499A9E6}
 
 
***** [ Firefox (and derivatives) ] *****
 
No malicious Firefox entries.
 
***** [ Chromium (and derivatives) ] *****
 
PUP.Optional.Legacy, SearchProvider found: Search - search
 
/!\ Please Reset the Chrome Synchronization before cleaning the Chrome Preferences: https://support.google.com/chrome/answer/3097271 
 
 
*************************
 
 
 
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########


#4 Jo*

Jo*

  • Malware Response Team
  • 3,410 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:03:09 AM

Posted 08 October 2017 - 01:42 PM

Hello,

:step1: Run Malwarebytes Anti-Rootkit again: Double click mbar.exe to run the tool.
Vista / Windows 7/8/10 users right-click and select Run As Administrator.
  • Scan your system for malware
  • If malware is found, click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • then please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  • If there is no malware found, please let me know as well.

***


:step2: Double click on AdwCleaner.exe to run the tool again.
Vista / Windows 7/8/10 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.

***


:step3: Please download Junkware Removal Tool from HERE and save it to your desktop.
Shutdown your antivirus to avoid any potential conflicts.
Double click JRT.exe to run the tool.
Vista / Windows 7/8/10 users right-click and select Run As Administrator.
  • JRT will begin to backup your registry and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, the log JRT.txt is saved on your desktop and will automatically open.
Enable your antivirus!
Post the contents of JRT.txt into your next reply.


***


:step4: How the computer is running now?


***


:step5: FRST / FSRT64: run it again.
  • Right-click FRST / FSRT64 then click "Run as administrator" (XP users: click run after receipt of Windows Security Warning - Open File).
  • When the tool opens, click Yes to disclaimer.
  • Put a check into the boxes next to Addition.txt and Shortcut.txt. Then press the Scan button.
  • When finished, it will produce logs called FRST.txt, Shortcut.txt and Addition.txt in the same directory the tool was run from.
  • Please copy and paste both logs in your next reply.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#5 Jo*

Jo*

  • Malware Response Team
  • 3,410 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:03:09 AM

Posted 11 October 2017 - 02:08 AM

Hi,

it has been several days since I sent my last set of instructions to help with your computer problem.

Please let me know if you are having problems and still need help.

Note: Thread will be closed if no response after 3 days.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#6 Jo*

Jo*

  • Malware Response Team
  • 3,410 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:03:09 AM

Posted 14 October 2017 - 10:49 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users