Busy server at PC startup Solved

Question

Hello,

For several weeks now, I have been getting this message when starting my PC: "server busy - unable to complete this action because another program is busy. Choose Switch To to activate the busy program and correct the problem."

The only issue is that "Switch To" doesn’t work... I think (from some information I've gathered online) that my PC has been infected, but I can't identify the malicious program... and since this problem, whether by coincidence or not, my internet access is no longer working (message "no connection is available")

While digging into the task manager, I see a line "System Idle Process" that is using almost all resources (between 95 and 99), but I'm hesitant to touch it too much

Does anyone have any idea how to help me?

Thanks in advance,

Malekal_morte- · Answer

Hello,

It's normal for the inactive process, to see:

Follow the FRST tutorial. ( take the time to read carefully - everything is well explained there ).

Download and run the FRST scan, 3 FRST reports will be generated:

FRST.txt
Shortcut.txt
Additionnal.txt

Send these 3 reports to the site http://pjjoint.malekal.com/ and in return provide the 3 pjjoint links leading to the reports here in a new response so that we can review them.

--
Please press any key to continue the disinfection...

B&eacute;n&eacute;dicte de Sallmard de Ressis · Answer

Thank you for your quick response

Here are the links for the 3 diagnostics:
http://pjjoint.malekal.com/files.php?id=20170521_y11p12w7l13i12

http://pjjoint.malekal.com/files.php?id=FRST_20170521_6v11l14f15i14

http://pjjoint.malekal.com/files.php?id=20170521_o15j1313e10c6

Malekal_morte- · Answer

You have installed adware and others likely following the download of a crack.
I don't know if your system will be repairable.

Here is the correction to be made with FRST. You can use this explanatory note with screenshots as help.

Open Notepad: Windows Key + R,
In the "Run" field, type notepad and OK.
Copy/Paste what follows into it:

CreateRestorePoint:
CloseProcesses:
Shortcut: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\3f46ba89e3e9f3c7\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.)
ShortcutWithArgument: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\f88477af608e84c0\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.) -> --profile-directory=tazoygroulychabch
ShortcutWithArgument: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\d52bf4de05df6a5b\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.) -> --profile-directory=tazoygroulychabch
ShortcutWithArgument: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\9cbac72b1915d1e4\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.) -> --profile-directory=tazoygroulychabch
ShortcutWithArgument: C:\Users\Ben\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\2ef8a18a9f0d801f\Google Chrome.lnk -> C:\Program Files (x86)\Coldone\Application\chrome.exe (Google Inc.) -> --profile-directory=tazoygroulychabch
Task: {FDDF06E4-A1B7-4B58-B4EE-ADA0BA03503B} - System32\Tasks\ChelfNotify Task => C:\ProgramData\ChelfNotify\BrowserUpdate.exe <==== ATTENTION
C:\ProgramData\ChelfNotify
Task: {CCB3EF48-7F65-42E8-AFCB-074F0DE1556F} - System32\Tasks\ZootonyUpdateTaskMachineUA => C:\Program Files (x86)\Zootony\Update\ZootonyUpdate.exe <==== ATTENTION
 C:\Program Files (x86)\Zootony
 2016-07-20 14:49 - 2016-07-20 14:49 - 7102976 _____ () C:\Users\Ben\AppData\Roaming\agent.dat 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0054272 _____ () C:\Users\Ben\AppData\Roaming\ApplicationHosting.dat 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0070320 _____ () C:\Users\Ben\AppData\Roaming\Config.xml 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0072804 _____ () C:\Users\Ben\AppData\Roaming\Greenkix.tst 
 2016-07-20 14:48 - 2016-07-20 14:49 - 0018432 _____ () C:\Users\Ben\AppData\Roaming\InstallationConfiguration.xml 
 2016-07-20 14:48 - 2016-07-20 14:48 - 0129024 _____ () C:\Users\Ben\AppData\Roaming\Installer.dat 
 2016-07-20 14:49 - 2016-07-20 14:49 - 1880585 _____ () C:\Users\Ben\AppData\Roaming\Lasoft.tst 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0126464 _____ () C:\Users\Ben\AppData\Roaming\lobby.dat 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0018432 _____ () C:\Users\Ben\AppData\Roaming\Main.dat 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0005568 _____ () C:\Users\Ben\AppData\Roaming\md.xml 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0126464 _____ () C:\Users\Ben\AppData\Roaming\noah.dat 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0848437 _____ () C:\Users\Ben\AppData\Roaming\SaoSolfan.bin 
 2016-07-20 14:49 - 2016-07-20 14:49 - 0032038 _____ () C:\Users\Ben\AppData\Roaming\uninstall_temp.ico 
 2014-09-07 13:10 - 2014-11-02 16:10 - 0000100 _____ () C:\Users\Ben\AppData\Roaming\WB.CFG 
 S4 iedvutils; C:\Program Files (x86)\Explorer\iedvutils.exe [64184 2017-01-22] () 
 S2 IlS; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) 
 S2 IlS; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
C:\Users\Ben\AppData\Roaming\Kyubey 
 S4 Kyubey; C:\Users\Ben\AppData\Roaming\Kyubey\Kyubey.exe [114688 2017-03-01] () [Unsigned file] <==== ATTENTION 
 R2 WinSnare; C:\Users\Ben\AppData\Roaming\WinSnare\WinSnare.dll [778752 2017-03-02] (InterSect Alliance Pty Ltd) [Unsigned file] <==== ATTENTION 
 S2 ed2kidle; C:\Program Files (x86)\amuleC\ed2k.exe -downloadwhenidle [X] <==== ATTENTION 
C:\Program Files (x86)\amuleC
 C:\Users\Ben\AppData\Roaming\WinSnare
 S2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [X] 
 S2 UvConverter; C:\Program Files (x86)\UvConverter\UvConverter.exe {2C8E8C85-942B-451C-8243-97A089265577} [X] 
 S2 winsaber; C:\Program Files (x86)\WinSaber\WinSaber.exe [X] 
 C:\Program Files (x86)\WinSaber
 S2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [X] <==== ATTENTION 
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2016-05-19] (Elex do Brasil Participações Ltda) <==== ATTENTION 
S1 iSafeKrnl; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [X] <==== ATTENTION 
S1 iSafeKrnlKit; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [X] <==== ATTENTION 
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X] <==== ATTENTION 
S1 iSafeKrnlR3; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [X] <==== ATTENTION 
S1 p1483972038am; \??\C:\Users\Ben\AppData\Local\Temp\bkBF49.tmp\p1483972038am.sys [X] <==== ATTENTION 
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:

Once the text is pasted into Notepad,
Go to "File" then "Save As",
On the left, navigate to the Desktop,
In the lower field, file name enter: fixlist.txt
Click "Save", this will create fixlist.txt on the Desktop.

Restart FRST and click the "Fix" button
A reboot may be necessary (not mandatory)
A text file will appear, copy/paste the content here in a new message.

Restart the computer.

2°)
Reset/Repair the affected web browsers:

Repair Mozilla Firefox (first paragraph)
Repair Google Chrome (only the first paragraph).
Reset and repair Internet Explorer

3°)
Finish with a cleanup using Malwarebytes - Tutorial for Malwarebytes Anti-Malware free version

4°)
See what happens and if there are any improvements.
If not, if you still have popup ads, specify which web browser.
Do another FRST scan and send the new reports via file attachment.

--
Please press any key to continue the disinfection...

B&eacute;n&eacute;dicte de Sallmard de Ressis · Answer

Hello

once again, thank you for your very detailed response

I did everything you indicated except that:
- for MBAM: I couldn't start it at all, I have a message saying "unable to connect to the service"
- I went further thanks to your tutorials, I went into services.msc and tried to start it there, I have another message saying "windows could not start the service on the local computer - error 1068: the service or group of dependencies failed to start" ...
- I am on Windows 7, I couldn’t start Windows in safe mode to force the start of MBAM

I indeed think my PC is well infected and it seems very unlikely that I can repair it ...

I am resending the new FRST analyses just in case, but since I couldn’t get MBAM to work, I think it won’t bring much:

http://pjjoint.malekal.com/files.php?id=20170522_c15t6y9e7j7

http://pjjoint.malekal.com/files.php?id=20170522_s12k12c13b12i14

http://pjjoint.malekal.com/files.php?id=FRST_20170522_h12j15j12l14k15

Malekal_morte- · Answer

great =)  have a nice end of your vacation :)  -- Please press a key to continue the disinfection...

Busy server at PC startup

5 answers

Unable to open xsl and xslx files

How to create an imail

Self-invoking js function

Access to google internet tab blocked

Very slow computer

Unusable screen

Print a page in the right orientation under windows 11

Crowdstrike block

Invisible text boxes or word forms on pdf

How to access apps under open with windows 10