search.ask.com will not go away [Solved]

Hello teeps, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.  [image unavailable: xsmile.png.pagespeed.ic.CwSpBGGvqN.png]
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
• Please backup important documents before proceeding with my instructions.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
• Topics are locked if no response is made after 5 days. Please inform me if you will require additional time to complete my instructions.
   

======================================================
 

I've used Malwarebytes

Did Malwarebytes detect anything? If so, please include the log in your next reply. 
 

[…] and HitmanPro to no avail.

HitmanPro has a reputation for causing unbootable computers. I would recommend you stay clear of the software. 
 

It feels like there is a proxy in the way or possibly issues with LSP but nothing is indicated by HijackThis or LSPFix.

Both HijackThis and LSPFix are outdated, and do not support Windows 8.1. 
 
Please run the following diagnostic scans so I can ascertain the state of your computer.
 
STEP 1
[external image: xlK5Hdb.png.pagespeed.ce.J4MzrrPAEo.png] Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x64) and save the file to your desktop.
• Right-Click FRST64.exe and select [external image: xAVOiBNU.jpg.pagespeed.ic.H5HC6LkiJX.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
[external image: aA7bkRO.png.pagespeed.ce.OIlgGSNBU0.png] aswMBR

• Please download aswMBR and save the file to your desktop. 
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click aswMBR.exe and select [external image: xAVOiBNU.jpg.pagespeed.ic.H5HC6LkiJX.jpg] Run as administrator to run the programme.
• Click Yes when prompted to download avast! virus definitions. Wait until AVAST engine defs: ### appears appears. 
• If you are prompted to enable the use of "Virtualization Technology", click Yes.
• Click the AV Scan: drop down box and click C:\.
• Click Scan. 
• Upon completion, you will see Scan finished successfully. Click Save log. Save the log to your Desktop. 
• Copy the contents of the log and paste in your next reply.

Note: Do NOT click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your desktop. Do NOT click or delete it.
 
======================================================
 
STEP 3
[external image: xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• aswMBR log
• MBAM log (if applicable) 

• Please go to VirusTotal.com.
• Click Choose File and locate the following file:
  • C:\Users\Schela\Desktop\_TeepsToolBox\MBR.dat
• ​Click Scan it!.
• If you receive the following notification: File already analysed click Reanalyse.
• Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply. 

Looks like the MBR came back clean:

https://www.virustotal.com/en/file/8d4c7374a93835e0d78abef543318a50766cc274971aef1998e9a8cb6bbeb559/analysis/1408677507/

You said to answer "the question above" in addition to the VirusTotal scan.  I didn't see any question in your post.  I'm guessing that is an inadvertent cut and paste? Have a great night.

Hello teeps, 
 

Looks like the MBR came back clean:
https://www.virustotal.com/en/file/8d4c7374a93835e0d78abef543318a50766cc274971aef1998e9a8cb6bbeb559/analysis/1408677507/

Indeed it does. 
 
From your aswMBR log, "Disk 0 unknown MBR code" can either indicate an infected MBR or OEM (Original Equipment Manufacturer) MBR. Yours is the later, which is perfectly fine. 
 

You said to answer "the question above" in addition to the VirusTotal scan.  I didn't see any question in your post.  I'm guessing that is an inadvertent cut and paste? Have a great night.

Yes, you are absolutely right. Sorry about that.
 
Before we proceed, I must ask - Are you the owner of this computer? Or does it belong to a University?

It belongs to a neighbor.  It's a personal computer that she uses for student advising of college students but I don't believe she is employed by the university.  I work at a university so you may see some campus network stuff on there since that is where some of my time is spent.

BTW.. the aswMBR scan finally finished and didn't have any additional lines than what the previously posted log had.

OK, no problem. Thank you for checking aswMBR.
 
Lets begin. Please start by considering the following warning. 
 

[external image: xgoGMWSt.gif.pagespeed.ic.T3xMEQZT0d.png]P2P WARNING

——————————

I see you have peer-to-peer (P2P) file sharing software installed on your computer (BearShare). I advise you avoid P2P file sharing programmes; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infected and infested with malware -worms, backdoor Trojans, IRCBots, and rootkits propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. The best way to reduce the risk of infection is to avoid these types of web sites and not use P2P applications.

- Risks of File-Sharing Technology
- P2P Software User Advisories
- More malware is traveling on P2P networks these days

Instructions on removing the software can be found in STEP 1. If you would prefer not to, please ensure you do not use the programme during this process. 

 
Please confirm your Anti-Virus and Firewall (Norton Internet Security) are currently enabled. 
 
I can see you have thrown a lot of security software at this computer. I wouldn't advise doing this. Some of the "security" software you've installed are, at the very least, questionable. IObit Advanced SystemCare is a good example. Programmes that purport to optimization are snake oil at best, and should be avoided. 
 
STEP 1
[external image: x6JO0hXH.png.pagespeed.ic.PEMzZKYEz_.png] Revo Uninstaller

• Please download and install Revo Uninstaller Free.
• Double-click Revo Uninstaller to run the programme. 
• From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.
  • Advanced SystemCare 7
  • BearShare
  • Smart Defrag 3
  • Surfing Protection 
• ​Double-click the programme. 
• When prompted if you want to uninstall click Yes.
• Ensure the Moderate option is selected and click Next.
• The programme will run. If prompted again click Yes.
• Once the built-in uninstaller is finished click Next.
• Once the programme has searched for leftovers click Next.
• Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
• When prompted click Yes, followed by Next.
• Click Select all, followed by Delete.
• When prompted click Yes, followed by Next.
• Once done click Finish.
   

(!) Your logs indicate you are running tools from the following location (Running from C:\Users\[removed]\Desktop\_TeepsToolBox). All tools must be downloaded directly to and run from your Desktop, and not a folder located on your Desktop. Please navigate to the folder mentioned, right-click FRST64.exe and click Cut. Navigate back to your Desktop, right-click your Desktop and click Paste.
 
STEP 2
[external image: xlK5Hdb.png.pagespeed.ce.J4MzrrPAEo.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: xpdKOQKY.png.pagespeed.ic.tmAgS1-k6q.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
  ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
  ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
  ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
  ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
  ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
  HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.22searche…4-03-04&hpa=yes
  HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.22searche…4-03-04&hpa=yes
  CHR StartupUrls: "hxxp://www.search.ask.com/?o=APN10641A&gct=hp&d=2-1123&v=n11465-252&t=4", "hxxp://www.search.ask.com/?o=APN10641A&gct=hp&d=2-1123&v=a13337-252&t=4"
  CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
  2014-08-19 20:42 - 2014-08-19 20:42 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Schela\Downloads\SpyHunter-Installer.exe
  FF Plugin HKCU: BearSharePlugin -> C:\Program Files (x86)\BearShare Applications\BearShare\npBearSharePlugin.dll No File
  AlternateDataStreams: C:\ProgramData\Temp:5C321E34
  Folder: C:\8a8281279c159cbeb30c37
  Folder: C:\ProgramData\2F25
  Folder: C:\Users\Schela\SecurityScans
  CMD: ipconfig /flushdns
  CMD: netsh winsock reset all
  Hosts:
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select [external image: xAVOiBNU.jpg.pagespeed.ic.H5HC6LkiJX.jpg] Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
• Open SpywareBlaster. You may see a notice indicating protection is partially enabled. If so, please click the relevant button to enable all protection.
   

======================================================

STEP 3
[external image: 16x16xpfNZP4A.png.pagespeed.ic.bp5cRl1pJ] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Is Norton Internet Security enabled?
• Did the programmes uninstall OK in Revo?
• Fixlog.txt
• Did you check SpywareBlaster?

Thanks for the info on Advance System Care and Smart Defrag.  I've been using these for years and I "thought" they were doing good, but I guess I never objectively tested them.  My intentions were to make sure that my temp files were cleared, the registry was cleaned, etc.  ASC seemed like a good one stop shop to maintain those things.  Would you say that CCleaner suffices for those types of tasks?  I also thought it was good that a defragging tool would keep of with keeping my drive defragged while the system was idle rather than scheduling the windows defrag tool on a regular basis.  What do you recommend there, or is defragging not that important?

I do see that chrome has lost the search.ask.com tabs on start up.  That's great to see.  Why didn't AdwCleaner and MalwareBytes work for this?  Normally those work pretty well.

Back to the tasks at hand:

1) Norton Security is enabled.

2) All but BearShare was uninstalled with Revo.  BearShare did not show up in the list in Revo.  It also did not show in the windows program list.

3) I did check and enable the protection in SpywareBlaster.

4) Here is the fix log

Hi teeps, 
 

Things are feeling more normal now. I'm not noticing any other issues at this point.

Good. Lets completely remove the BearShare programme, and check for any remnants.  
 

My only remaining question is what you prefer for a defrag tool.

I will provide a list of suggestions after the following steps have been completed. 

STEP 1
[external image: xMgeHyNE.png.pagespeed.ic.49_rDPUa_4.png] Batch File

• Press the Windows Key [external image: xpdKOQKY.png.pagespeed.ic.tmAgS1-k6q.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  @echo off
  rd /s /q "C:\Users\Schela\AppData\Local\BearShare"
  rd /s /q "C:\Users\Schela\AppData\LocalLow\bearsharemusicboxtoolbar181"
  rd /s /q "C:\Users\Schela\Music\BearShare"
  del %0

• Click Format. Ensure Wordwrap is unchecked. 
• Click File, Save As and name the file batchfile.bat. 
• Select All Files as the Save as type.
• Save the file to your Desktop. 
• Locate batchfile.bat [external image: xlmRDSkT.png.pagespeed.ic.UByFR5z3ld.jpg] (W8/7/Vista) or [external image: xtDIfEhH.png.pagespeed.ic.hUvF_Da3dc.png] (XP) on your Desktop. Right-click the icon and click [external image: xAVOiBNU.jpg.pagespeed.ic.H5HC6LkiJX.jpg] Run as administrator.
   

STEP 2
[external image: xAFZxnZc.jpg.pagespeed.ic.8db6OVtjOI.png] DelFix

• Please download DelFix and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Create registry backup
• Click the Run button.
   

STEP 3
[external image: xGIRjHjL.png.pagespeed.ic.UlTFY2Ulbn.jpg] Reg Fix 

• Press the Windows Key [external image: xpdKOQKY.png.pagespeed.ic.tmAgS1-k6q.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  Windows Registry Editor Version 5.00
  
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4603BD00-7E08-4CC3-90D9-F5BC1EAA9A4E}]
  [-HKEY_CURRENT_USER\Software\BearShare]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.AIF\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.AIFC\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.AIFF\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ASF\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.AU\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.CDA\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.divx\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.IVF\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.M1V\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MID\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MIDI\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MOD\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MP2\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MP2V\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp4\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpa\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MPE\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MPEG\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MPG\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.MPV2\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.qt\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.RMI\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.SND\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vob\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wav\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wm\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WMD\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmv\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WMX\OpenWithList\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\BearShareSetup-r1123-w-bi.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\PlayWithBearShare]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BearShare]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BearShare.file]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{87E8D7F8-7052-42A2-B48B-674C1F700A0B}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{87E8D7F8-7052-42A2-B48B-674C1F700A0B}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSMediaPlayerOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSPlayCDAudioOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSRipCDAudioOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSShowCDAudioOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSShowVolumeOnArrival]
  [HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications]
  "BearShare"=-
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BearShare]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSMediaPlayerOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSPlayCDAudioOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\BSShowVolumeOnArrival]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BearShare]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\BearShare.exe]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{87E8D7F8-7052-42A2-B48B-674C1F700A0B}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\RegisteredApplications]
  "BearShare"=-
  [-HKEY_USERS\S-1-5-21-1610046111-1447223094-1531952853-1002\Software\BearShare]

• Click Format. Ensure Wordwrap is unchecked. 
• Click File, Save As and name the file regfix.reg.
• Select All Files as the Save as type.
• Save the file to your Desktop. 
• Locate regfix.reg [external image: xGIRjHjL.png.pagespeed.ic.UlTFY2Ulbn.jpg] on your Desktop. Right-click the file and click Merge with the Registry. 
• Accept any prompts. 
• Reboot your computer for the changes to take effect.
   

STEP 4
[external image: xGfiJrQ9.png.pagespeed.ic.HjgFxjvw2Z.jpg] Malwarebytes Anti-Malware (MBAM)

• Open Malwarebytes Anti-Malware and click Update Now.
• Once updated, click the Settings tab and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply. 
   

STEP 5
[external image: GzlsbnV.png.pagespeed.ce.SLxxSJVib_.png] ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Hide advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click [external image: esetListThreats.png]. If no threats were found, skip the next two bullet points. 
• Click [external image: esetExport.png] and save the file to your Desktop, naming it something unique such as MyEsetScan.
• Push the Back button.
• Place a checkmark next to [external image: xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png] and click [external image: SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png].
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 6
[external image: xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Did the bat file/reg fix run successfully?
• MBAM log
• ESET log

OK.  The batch file and the registry stuff ran well.  Rebooted as requested.

Here is the MalwareBytes and eSet logs:

==========================================================================

==========================================================================

Hello, 
 
Those logs look good. The last two files identified by ESET are installers that bundle additional software. They pose no harm, but can be deleted. Navigate to their folder, right-click and click Delete. 
 
Regarding a defrag tool, I recommend you take a look at [external image: 2Jjs9Hv.png] Defraggler. 
 
From your logs I can see you are currently using MSCONFIG as a startup manager. I do not advise this. MSCONFIG is a system troubleshooting utility, designed to diagnose various issues such as slow boot ups. Using the tool as a startup manager means it cannot be used as diagnostic tool. Furthermore, there is a known issue where changes left permanently in MSCONFIG are irreversible using the tool. For these reasons, I recommend you look at one of the following (free) tools to use as a startup manager.

• [external image: 1Vc5ho7.png] WinPatrol
• [external image: 6gkmKHQ.png] Autoruns

WinPatrol in particular may be confusing at first. I suggest reading the documentation on either programme should you choose to install one. Reverse any changes made in MSCONFIG to your startup programmes before using either programme. 
 

STEP 1
[external image: xCXrghb6.png.pagespeed.ic.GoiQhwxA2B.png] Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

• [external image: x3bWY3LP.png.pagespeed.ic.8KpyVVMYY3.jpg] Adobe Shockwave Player
• [external image: xu9DsAVv.png.pagespeed.ic.jOTvbGK8JJ.jpg] Follow these instructions to check for download the latest Windows Updates.
   

STEP 2
[external image: xEtQetiM.png.pagespeed.ic.6601abWTTy.jpg] Remove Outdated Software

• Press the Windows Key [external image: xpdKOQKY.png.pagespeed.ic.tmAgS1-k6q.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall one at a time.
  • Adobe Shockwave Player 11.6 
• Follow the prompts and reboot if necessary.
   

STEP 3
[external image: oxliOQk.png.pagespeed.ce.C25V2YBM3k.png] Security Check

• Please download SecurityCheck and save the file to your Desktop.
• Double-click SecurityCheck.exe and follow the onscreen instructions inside the black box.
• A log (checkup.txt) will automatically open on your Desktop.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 4
[external image: xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• checkup.txt
• How is your computer performing? Any outstanding issues?