Installed Malware [Solved]

Satchfan,

The crazy popups are all gone. Thank you! One time several days ago, I had that Share Button for Pinterest show up, while we were working on the popup problem. It claimed to be from barisderin.com/?p=2598 This would show p on a weekly basis, asking if I'd like to download it. Is it now one also? One other thing, which I posted to another board here yesterday, my Microsoft Office stopped connecting to the printer during all of this. It was working as we began, but stopped several days ago. I can use office and save, but not communicate with the printer. Other programs print - Adobe Reader and Paint without difficulties. I uninstalled and reinstalled the HP printer to see if that helped and repaired MS Office from the MS website. None of those helped. I'm not sue if any of that is related to what we were doing?

Suzy

Oh, I just had Anti-Malware pop up and notify me that I had malware. I can't get it to copy to clipboard or save in file for some reason. Here is what it said was on the computer:

PUP.Optional.PlaythruPlayer Registry Key

PUP.Optional.PCAcceleratePro Registry Value

The printer problem is not related to anything we’ve done here.


Let’s have a look for those two that were flagged.

Please download SystemLook from one of the links below and save it to your Desktop.

SystemLook (32-bit)
SystemLook (64-bit)

• double-click SystemLook.exe to run it.
• copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning:
  

  :filefind
  *PlaythruPlayer*
  *PCAcceleratePro*
  
  :folderfind
  *PlaythruPlayer*
  *PCAcceleratePro*
  
  :regfind
  PlaythruPlayer
  PCAcceleratePro
  

• click the Look button to start the scan.
• when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

I won't be able to check in for a few hours by will reply asap

Satchan

Thank you. Here is the information:

SystemLook 04.09.10 by jpshortstuff
Log created at 16:54 on 16/12/2015 by computer
Administrator - Elevation successful

========== filefind ==========

Searching for "*PlaythruPlayer*"
C:\Windows\Prefetch\PLAYTHRUPLAYERBROWSER.EXE-46CA5896.pf    –a—- 33556 bytes    [19:11 07/12/2015]    [14:40 09/12/2015] 40C800223BFAD9D2A465C6815061D87B
C:\zoek_backup\C_PROGRA~2_PlaythruPlayer\PlaythruPlayer.exe    –a—- 412080 bytes    [18:31 09/12/2015]    [18:43 04/08/2015] E911DF0B1588DE56834FFA5BB715AD0A

Searching for "*PCAcceleratePro*"
C:\Windows\Prefetch\PCACCELERATEPRO.EXE-C3002A1B.pf    –a—- 17607 bytes    [05:34 05/12/2015]    [05:34 05/12/2015] 71F29D26A6B73E00FC6696FBF51B4914

========== folderfind ==========

Searching for "*PlaythruPlayer*"
C:\zoek_backup\C_PROGRA~2_PlaythruPlayer    d-a—-    [18:31 09/12/2015]

Searching for "*PCAcceleratePro*"
No folders found.

========== regfind ==========

Searching for "PlaythruPlayer"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\playthruplayer.com]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ui.playthruplayer.com]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9b25a585_0]
@="{2}.\\?\hdaudio#func_01&ven_10ec&dev_0892&subsys_18498892&rev_1003#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume2\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe.FriendlyAppName"="PlaythruPlayerBrowser"
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\playthruplayer.com]
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ui.playthruplayer.com]
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9b25a585_0]
@="{2}.\\?\hdaudio#func_01&ven_10ec&dev_0892&subsys_18498892&rev_1003#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume2\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe.FriendlyAppName"="PlaythruPlayerBrowser"
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe.FriendlyAppName"="PlaythruPlayerBrowser"

Searching for "PCAcceleratePro"
No data found.

-= EOF =-

Sorry Suzy but had a long day today and won't send a reply until tomorrow, (Christmas+family is a time-consuming thing).

The good thing is that these can be removed and I'll send instructions as soon as I can.

Satchfan

Let’s get rid of what was found then have another scan.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

C:\Windows\Prefetch\PLAYTHRUPLAYERBROWSER.EXE-46CA5896.pf
C:\Windows\Prefetch\PCACCELERATEPRO.EXE-C3002A1B.pf
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\playthruplayer.com
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ui.playthruplayer.com
HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\playthruplayer.com
HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ui.playthruplayer.com
reg: reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9b25a585_0" /v "@" /f
reg: reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "@" /f
reg: reg delete "HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9b25a585_0" /v "@" /f
reg: reg delete "HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "@" /f
reg: reg delete "HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "@" /f
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Please run Malwarebytes again and send the new log.

Logs to include with next post:

Fixlog.txt
Mbam.txt

Thanks

Satchfan

I'm running the Mbam now. I ran the fix on the FRST and then the computer restarted. I can't seem to find the fixlog.txt to send to you. It's not on the desktop.

Mbam:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/17/2015
Scan Time: 12:27 PM
Logfile: Mbam.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.12.17.04
Rootkit Database: v2015.12.16.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: computer

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 376627
Time Elapsed: 13 min, 53 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.PlayThruPlayer, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\playthruplayer.com, , [87a1812588034beb9e4fca3ecb394fb1],

Registry Values: 1
PUP.Optional.PCAcceleratePro, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|PCAcceleratePro.exe, 8888, , [fe2a9016c0cb95a1dc1a0ff96c985da3]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted Windows Registry Editor Version 5.00 below to it. Don't forget to include Windows Registry Editor Version 5.00 :
 

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\playthruplayer.com]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ui.playthruplayer.com]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9b25a585_0]
[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe.FriendlyAppName"=-
[-HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\playthruplayer.com]
[-HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ui.playthruplayer.com]
[-HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Microsoft\Internet
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe.FriendlyAppName"=-
[HKEY_USERS\S-1-5-21-1368300876-1422003468-1987020418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\computer\AppData\Local\PlaythruPlayer\PlaythruPlayerBrowser.exe.FriendlyAppName"=-

• "Save in": Desktop
• "File Name": delete.reg
• "Save as Type": All files
• click: Save

On the desktop, double-click delete.reg and allow it to run. Let it merge and then reboot.

Please run Malwarebytes again and send a new log.

Satchfan

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/17/2015
Scan Time: 6:19 PM
Logfile: mbam3.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.12.17.05
Rootkit Database: v2015.12.16.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: computer

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 376647
Time Elapsed: 14 min, 29 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 1
PUP.Optional.PCAcceleratePro, HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|PCAcceleratePro.exe, 8888, , [58d18e18e9a2ec4ae15f13f6e12347b9]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Please delete the delete.reg file from your desktop.

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted Windows Registry Editor Version 5.00 below to it. Don't forget to include Windows Registry Editor Version 5.00 :
 

Windows Registry Editor Version 5.00

[HKEY_USERS\Software\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Browser_Emulation]
PCAcceleratePro.exe=-

• "Save in": Desktop
• "File Name": delete.reg
• "Save as Type": All files
• click: Save

On the desktop, double-click delete.reg and allow it to run. Let it merge and then reboot.

Please run Malwarebytes again and remember to put a checkmark next to anything found before you click Quarantine.

Are there any remaining problems?

Satchfan

I did everything you said, but get this message. Cannot import C:\Users\computer\Desktop\delete.reg Error accessing the registry.

I will be at work all day, so I will look at this later today, thank you.

Please also delete the new delete.reg file from your desktop.

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted Windows Registry Editor Version 5.00 below to it. Don't forget to include Windows Registry Editor Version 5.00 :
 

Windows Registry Editor Version 5.00

[HKU\S-1-5-21-1368300876-1422003468-1987020418-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Browser_Emulation]
PCAcceleratePro.exe=-

• "Save in": Desktop
• "File Name": delete.reg
• "Save as Type": All files
• click: Save

On the desktop, double-click delete.reg and allow it to run. Let it merge and then reboot.

Whether this works or not, please run Malwarebytes again and remember to put a checkmark next to anything found before you click Quarantine. That should deal with the issue if the reg fix doesn’t work.

Are there any remaining problems?

Satchfan

Hi, I have not disappeared. Just celebrating our family Christmas today and had to work 12 hours a day for the last 2 days. I will try to get on tonight or tomorrow night. Thank you for your patience. Suzy