Believe my computer is infected with a trojan

1.  Computer is running slow. Ie when opening programs, folders, etc

2. I recently ran Malwarebytes Anti Malware which resulted in it quarantining 10-20 pups; After removing these I now have a taskeng.exe box that pops up at random with an error box that says: Windows cannot find ’C:\Users\Admin\AppData\Local\GeniusBox\client.exe’. Make sure you typed the name correctly, and then try again.

3. I also received an alert today from AVG with the following: AVG blocked and removed this threat. Threat name: IDP.Trojan.D0668352 Object name: C:\USERS\ADMIN\APPDATA\LOCAL\GENIUSBOX\CLIENT.EXE.PENDINGOVERWRITE

 

AVAST:

 

let me point out that you are using BitTorrent, any form of P2P (File Sharing ) is very dangerous, you will have a ton of bogus toolbars and what not installed, using the torrents is most likely how you infected your computer. Not all but most of what is downloaded via the torrents have some sort of malicious code inserted into them, its like playing Russian Roulette malwarewise. If I spend time helping you clean your system and you continue to use the torrents its most likely that you will infect yourself all over again and basically wasting our time.

~~~~
Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on Browser Extensions and then
  GeniusBox 2.0
  (If found, if not follow the next step of instructions)
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

~~~~
Running from C:\Users\[removed]\Downloads
We need to move this to desktop

Please go to this folder
C:\Users\Admin\Downloads locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.

Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
[external image: FRSTfix.JPG]
 

start
CloseProcesses:
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
Toolbar: HKU\S-1-5-21-2018453859-392006133-861611250-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> No File
2015-01-08 21:36 - 2015-01-09 22:42 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Search Protection
2015-01-08 21:36 - 2015-01-08 21:36 - 00004468 _____ () C:\Windows\System32\Tasks\Validate Installation
2015-01-08 21:36 - 2015-01-08 21:36 - 00004260 _____ () C:\Windows\System32\Tasks\Check Updates
2015-01-08 21:36 - 2015-01-08 21:36 - 00003864 _____ () C:\Windows\System32\Tasks\GeniusBox
2015-01-08 21:35 - 2015-01-18 19:45 - 00000000 ____D () C:\Users\Admin\AppData\Local\GeniusBox
C:\Users\Admin\AppData\Local\Temp\14-4-mobility-win7-win8-win8.1-64-dd-ccc-whql.exe
C:\Users\Admin\AppData\Local\Temp\bitool.dll
C:\Users\Admin\AppData\Local\Temp\devcon.exe
C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
C:\Users\Admin\AppData\Local\Temp\install_temp.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\ose00000.exe
C:\Users\Admin\AppData\Local\Temp\raptrpatch.exe
C:\Users\Admin\AppData\Local\Temp\raptr_stub.exe
C:\Users\Admin\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite72449.dll
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite90956.dll
C:\Users\Janelle\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
Browser Extensions (HKU\S-1-5-21-2018453859-392006133-861611250-1004\…\{3A787631-66A2-4634-B928-A37E73B58FB6}) (Version: 2.5 - Spigot, Inc.) <==== ATTENTION
GeniusBox 2.0 (HKLM-x32\…\GeniusBox) (Version: 2.0 - GeniusBox 2.0)
EmptyTemp:
Hosts:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~`

[external image: BY4dvz9.png]AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

– File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


[external image: thisisujrt.gif]
Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~
please post
Fixlog.txt
C:\AdwCleaner.txt
JRT.txt

Thank you for such the quick reply! Here are the following logs:

 

Fixlog.txt: