Installed Malware [Solved]

Apologies for not replying to you today but unforeseen circumstances got in the way of things.

I will send the next instructions when I return home tomorrow.

Thanks for your patience

Satchfan

My apologies again for the delay.

Let’s try forcing the uninstall of those two programs and then tidy up what was found by FRST.

Download Revo Uninstaller

• double click the installation file on the desktop to run the installer
• let it install to the default location
• double click the new Revo Uninstaller Icon on the desktop to start the program.

You will now see a list of installed programs that Revo Uninstaller can remove.

• locate the program you are uninstalling, ArcadeTwist
• right-click the icon then choose Uninstall
• click Yes to the warning and choose the Uninstall Mode
• choose the Advanced option and then click Next
• this will launch the programs built in uninstaller, (be patient, it can take several seconds)
• once the uninstaller is done click Next
• Revo Uninstaller will now scan for leftover information, (again, be patient as it can take several seconds)
• once this scan is done click Next
• you will then be presented of the leftover entries found by Revo Uninstaller
• look at ALL of the entries to ensure they relate to the uninstall
• next, click Select All > Delete to remove the entries
• click Next
• if there are any program file folders left over you will be presented with a list to be removed
• again look at ALL of the entries to ensure they are related to the uninstall
• click Select All > Delete to remove the entries
• click Finish to go back to the uninstall list
• do the same for Playthru Player and when you have removed both, close the program.

================================================

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

HKLM-x32\…\Run: [] => [X]
HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\…\Run: [Playthru Player] => "C:\Program Files (x86)\PlaythruPlayer\PlaythruPlayer.exe" /autostart=1
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfVteWA0UFg1BbQpdUwxcFQYTcBRZUVxFDFcQI1pdUwoXRQ0QJR9aFQQTSEcFME0FCFwEURNNfX5dFW0ZRGdGM0xUFUo5VFc=&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfVteWA0UFg1BbQpdUwxcFQYTcBRZUVxFDFcQI1pdUwoXRQ0QJR9aFQQTSEcFME0FCFwEURNNfX5dFW0ZRGdGM0xUFUo5VFc=&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1368300876-1422003468-1987020418-1000 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1368300876-1422003468-1987020418-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
S1 BdfNdisf; \??\D:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_52e20f0ba6914be8\bdfndisf6.sys [X]
U3 idsvc; no ImagePath
2015-12-09 13:12 - 2015-12-09 13:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Playthru Player
2015-12-05 00:35 - 2015-12-05 00:41 - 00000000 ____D C:\Program Files\WebDiscoverBrowser
2015-12-05 00:35 - 2015-12-05 00:35 - 00000000 ____D C:\Users\computer\Downloads\download
2015-12-05 00:35 - 2015-12-05 00:35 - 00000000 ____D C:\Users\computer\AppData\Local\WebDiscoverBrowser
2015-12-05 00:34 - 2015-12-09 20:32 - 00000300 _____ C:\WINDOWS\Tasks\WoFl5.job
2015-12-05 00:34 - 2015-12-09 20:29 - 00000306 _____ C:\WINDOWS\Tasks\ScaDivisi380.job
2015-12-05 00:34 - 2015-12-05 00:34 - 00003220 _____ C:\WINDOWS\System32\Tasks\ScaDivisi380
2015-12-05 00:34 - 2015-12-05 00:34 - 00003200 _____ C:\WINDOWS\System32\Tasks\WoFl5
2015-12-05 00:34 - 2015-12-05 00:34 - 00000000 ____D C:\Users\computer\AppData\Local\AbundDiscove54
2015-12-05 00:34 - 2015-12-05 00:34 - 00000000 ____D C:\Users\computer\AppData\Local\AbundAnc83
2015-12-05 00:34 - 2015-08-07 15:01 - 00044136 _____ (VentureOmni Technologies) C:\WINDOWS\system32\Drivers\VOTw864.sys
Task: {0821BC30-0651-4088-9B97-E49C24EDFA5C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {11112E49-8C10-4A9D-A976-B878CE2B03B7} - System32\Tasks\WoFl5 => C:\Users\computer\AppData\Local\AbundDiscove54\Abaccumulate.exe [2015-12-05] (ArcadeTwist)
Task: {32FF2B91-F3D2-4354-98E5-E2D7050B7EFA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {34AA655B-E29E-4C28-A75D-C9FE5830CD3B} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {3DC97B11-90F3-4342-8DE3-0771D4D827B1} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {420FFACB-0DFA-40E8-8BB3-4FF538CA3DE4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {43555F93-2352-4FC8-B7BE-91268F789457} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {4C676E2E-14AD-4D07-BA16-68BDC5FD4966} - \Safer-Networking\Spybot - Search and Destroy\Scan the system -> No File <==== ATTENTION
Task: {52042A73-690B-4EAF-81BC-4F67EBA51B6C} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {5C05CC74-DC53-430D-9D43-389A4CBDA036} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {696437CE-5CE7-42B9-A6A4-6F88A77FB67A} - \Safer-Networking\Spybot - Search and Destroy\Refresh immunization -> No File <==== ATTENTION
Task: {74DFF7AE-7816-4139-8288-2FF0C18FDC4C} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {88E26182-9AA2-4A9C-A3F3-7E50518760E9} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION
Task: {B36E0278-FFE9-4886-B2C9-4EDDF44A127E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {C17B4422-C817-491E-BA8C-18D76D2D8159} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {E330BE61-8437-41C1-8B41-1146ACE3CC2B} - System32\Tasks\ScaDivisi380 => C:\Users\computer\AppData\Local\AbundDiscove54\Abreplace.exe [2015-12-05] (ArcadeTwist)
Task: C:\WINDOWS\Tasks\ScaDivisi380.job => C:\Users\computer\AppData\Local\AbundDiscove54\Abreplace.exe
Task: C:\WINDOWS\Tasks\WoFl5.job => C:\Users\computer\AppData\Local\ABUNDD~1\Abaccumulate.exe
C:\Program Files (x86)\PlaythruPlayer
C:\Users\computer\AppData\Local\AbundDiscove54
CMD: ipconfig /flushdns
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

Logs to include with next post:

Fixlog.txt
checkup.txt

Thanks

Satchfan

Okay, thank you. I won't be able to work on this until Sunday afternoon. I'll let you know how it goes.

Suzy

Satchfan,

Okay, I have a question. How do I save FRST and the fixlist in the same folder?

Suzy

Here are the results of the Security Check:

 Results of screen317's Security Check version 1.009  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 Adobe Flash Player     20.0.0.235  
 Adobe Reader XI  
 Mozilla Firefox (42.0)
 Google Chrome (47.0.2526.73)
 Google Chrome (47.0.2526.80)
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe
 Malwarebytes Anti-Exploit mbae-svc.exe   
 Malwarebytes Anti-Exploit mbae64.exe   
 Malwarebytes Anti-Exploit mbae.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````
 

Well done sorting that out.

I’m pretty sure all is OK now but we’ll run a couple more scans to be sure nothing is left and if they are clear I’ll send instructions to tidy up.


Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

• start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• once it is updated, click on “Scan” tab, select Threat Scan, then click Scan.
• when the scan is complete, if no malicious items are found you can close the program
• if malicious items are found be sure that everything is checked and click Quarantine
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or  Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan
 

• click the Run Eset online Scanner button
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

o    click on esetinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
o    double click on the Eset installer icon on your desktop.

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Enable detection of potentially unwanted applications
• click Advanced settings and select the following:

o    scan archives
o    scan for potentially unsafe applications
o    enable Anti-Stealth technology

Note: Do not check Remove found threats

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

Note - if ESET doesn't find any threats, no report will be created.

• push the back button.
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found.
 

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here.
 

Logs to include with the next post:

Mbam.txt
Eset results

Can you tell me if there are any outstanding problems.

Satchfan

 

Satchfan,

I have Malwarebytes Anti-Exploit Premium. Do I also need Malwarebytes Anti-Malware in addition? I don't see an update button for the Anti- Exploit. If so, should I do that before the others you've requested that are listed after?

Thanks, Suzy

I have Malwarebytes Anti-Exploit Premium. Do I also need Malwarebytes Anti-Malware in addition?

Yes. Please run that and then the Eset scan.

Thanks

Satchfan

I used the Anti-malware, but didn't get to save it to notepad. It is in the history, and I have taken a screen shot if there is a way to send an attachment, but other than that, I don't know how to get that information to you. The ESET program is still running.

Suzy

ESET:

C:\AdwCleaner\Quarantine\C\Users\Computer\AppData\Local\AskToolbar\Downloaded Program Files\AviraWebSecurityBrowser.dll.vir    a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\AdwCleaner\Quarantine\C\Users\Computer\AppData\LocalLow\AskToolbar\avr-4.cab.vir    a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\AdwCleaner\Quarantine\C\Users\Computer\AppData\LocalLow\AskToolbar\setup.exe.vir    a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\Firefox\[removed]\plugins\npAviraCallingID.dll    a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\FRST\Quarantine\C\Program Files\WebDiscoverBrowser\1.219.2\isa.dll    a variant of Win32/WebBar.D potentially unwanted application
C:\FRST\Quarantine\C\Users\Computer\AppData\Local\AbundAnc83\VOTCerInst.dll    a variant of Win32/Packed.Komodia.D suspicious application
C:\FRST\Quarantine\C\Users\Computer\AppData\Local\AbundAnc83\VOTInstWXP.exe    a variant of Win32/Packed.Komodia.A suspicious application
C:\FRST\Quarantine\C\Users\Computer\AppData\Local\AbundAnc83\VOTInstWXP64.exe    a variant of Win64/Packed.Komodia.D suspicious application
C:\FRST\Quarantine\C\Users\Computer\AppData\Local\AbundAnc83\VOTPrx.dll    a variant of Win32/Packed.Komodia.D suspicious application
C:\FRST\Quarantine\C\Users\Computer\AppData\Local\AbundAnc83\VOTPrx.exe    a variant of Win32/Packed.Komodia.A suspicious application
C:\FRST\Quarantine\C\Users\Computer\AppData\Local\AbundAnc83\VOTPrx64.dll    a variant of Win64/Packed.Komodia.F suspicious application
C:\Users\computer\AppData\Local\Temp\7zS2847\Optional\HP_IPG_Toolbar_installer.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\computer\AppData\Local\Temp\7zS2D8F\Optional\HP_IPG_Toolbar_installer.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\computer\AppData\Local\Temp\7zS39C4\Optional\HP_IPG_Toolbar_installer.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows\Temp\OJ8610_198.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows.old\Users\computer\AppData\Local\Microsoft\Windows\INetCache\IE\0Y6YWQQ4\OJ8610_198[1].exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows.old\Users\computer\AppData\Local\Microsoft\Windows\INetCache\IE\FDMR8JXY\OJ8610_198[1].exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows.old\Users\computer\AppData\Local\Temp\HPInstaller.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows.old\Users\computer\AppData\Local\Temp\7zS0C3B\Optional\HP_IPG_Toolbar_installer.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows.old\Users\computer\AppData\Local\Temp\7zS5777\Optional\HP_IPG_Toolbar_installer.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\zoek_backup\C_PROGRA~2_PlaythruPlayer\player.dll    Win32/Verti.R potentially unwanted application
C:\zoek_backup\C_PROGRA~2_PlaythruPlayer\PlaythruPlayer.exe    a variant of Win32/Verti.Q potentially unwanted application
 

We'll deal with what Eset found but I'd like to see the MBAM log.

In Malwarebytes, click on History > Application Logs. Open the last scan by double-clicking on it. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Click on “Export”, choose Text file (*.txt) then give it a name and save it to your desktop.

Please then post that in your next reply.

Thanks! Here it is:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/15/2015
Scan Time: 11:19 AM
Logfile: Scan Log Anti-Malware.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.12.15.04
Rootkit Database: v2015.12.07.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: computer

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 376332
Time Elapsed: 14 min, 41 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 11
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\APPID\{8a4a8b42-a270-4ad4-95c3-815ded6433fc}, Quarantined, [80e0ffa649428fa7ffba69f2c63c6997],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{8A4A8B42-A270-4AD4-95C3-815DED6433FC}, Quarantined, [80e0ffa649428fa7ffba69f2c63c6997],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{8A4A8B42-A270-4AD4-95C3-815DED6433FC}, Quarantined, [80e0ffa649428fa7ffba69f2c63c6997],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\APPID\{906d7e81-6355-4069-b02d-bcfdfe2885e7}, Quarantined, [64fc05a076152a0c71490457639f37c9],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{906D7E81-6355-4069-B02D-BCFDFE2885E7}, Quarantined, [64fc05a076152a0c71490457639f37c9],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{906D7E81-6355-4069-B02D-BCFDFE2885E7}, Quarantined, [64fc05a076152a0c71490457639f37c9],
PUP.Optional.WebDiscoverBrowser, HKLM\SOFTWARE\WebDiscoverBrowser, Quarantined, [82de2085a6e575c1ec95e8192fd57987],
PUP.Optional.ArcadeCandy.WnskRST, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SAFEBOOT\NETWORK\VOTPrx, Quarantined, [b8a8960f226954e22ef2c833ce35fb05],
PUP.Optional.InstantSupport, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\ISTab, Quarantined, [c39d9f06107be1552e64a65d9e6649b7],
PUP.Optional.WebDiscoverBrowser, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\WebDiscoverBrowser, Quarantined, [1a465e47adde0a2c56283cc5788cba46],
PUP.Optional.PCAcceleratePro, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\APTAB, Quarantined, [d68a3273d0bbb185c7731ce8a95b9967],

Registry Values: 3
PUP.Optional.Yontoo.ChrPRST, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DoNotAskAgain, searchinterneat-a.akamaihd.net, Quarantined, [213f267f8803b58153e2527a2ed5fc04]
PUP.Optional.PCAcceleratePro, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\APTAB|hb, 1, Quarantined, [d68a3273d0bbb185c7731ce8a95b9967]
PUP.Optional.Yontoo.ChrPRST, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DoNotAskAgain, searchinterneat-a.akamaihd.net, Quarantined, [49172c79a8e389ad56193d8e5ca713ed]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.Winsock.WnskRST, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VOTPrx, Quarantined, [2a36386dbbd0e74f9f559310639f7888],

Files: 2
PUP.Optional.DownLoadAdmin, C:\Users\computer\Downloads\gimpforwindows-setup.exe, Quarantined, [c19f5d4890fbcc6adb14a80ab44d7c84],
PUP.Optional.Winsock.WnskRST, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VOTPrx\VOTPrx.ini, Quarantined, [2a36386dbbd0e74f9f559310639f7888],

Physical Sectors: 0
(No malicious items detected)


(end)

OK let’s get rid of what Eset found.

Please copy all text in the code box below and paste it into Notepad:
 

@echo off
del /f /s /q "C:\Firefox\[removed]\plugins\npAviraCallingID.dll”
del /f /s /q "C:\Users\computer\AppData\Local\Temp\7zS2847\Optional\HP_IPG_Toolbar_installer.exe”
del /f /s /q "C:\Users\computer\AppData\Local\Temp\7zS2D8F\Optional\HP_IPG_Toolbar_installer.exe”
del /f /s /q "C:\Users\computer\AppData\Local\Temp\7zS39C4\Optional\HP_IPG_Toolbar_installer.exe”
del /f /s /q "C:\Windows\Temp\OJ8610_198.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application”
del /f /s /q "C:\Windows.old\Users\computer\AppData\Local\Microsoft\Windows\INetCache\IE\0Y6YWQQ4\OJ8610_198[1].exe”
del /f /s /q "C:\Windows.old\Users\computer\AppData\Local\Microsoft\Windows\INetCache\IE\FDMR8JXY\OJ8610_198[1].exe”
del /f /s /q "C:\Windows.old\Users\computer\AppData\Local\Temp\HPInstaller.exe”
del /f /s /q "C:\Windows.old\Users\computer\AppData\Local\Temp\7zS0C3B\Optional\HP_IPG_Toolbar_installer.exe”
del /f /s /q "C:\Windows.old\Users\computer\AppData\Local\Temp\7zS5777\Optional\HP_IPG_Toolbar_installer.exe”
del %0

• save the Notepad file to your desktop and name it delfiles.bat
• save type as "All Files"
• on your desktop, double-click on delfiles.bat to run it, (a black CMD window will flash, then disappear - this is normal).

The files/folders, if found, will have been deleted and the "delfile.bat" file will also be deleted.

The rest of the Online scan is only reporting what has already been quarantined: whatever is in these folders can't cause any harm and will be removed when we tidy up.

Can you tell me if there are any outstanding problems.

Satchfan