A Dad Needs Help Please [Solved]

My 8 year old son must have downloaded something to my computer and there was some "Computer Assistant" thing came up with the Minecraft game launcher.

What I did so far:

- I went to Chrome and saw that things had been added to the browser.  I used advanced settings and reset to default settings.

- I saw that there were about three new programs or so that had been added.  Went to uninstall programs to try and remove them.  That is when the uninstaller started trying to install other problems.  What a big mess!

- Got to your website (thank you for being there) and started the process as directed

- Got the aswMBR program downloaded and ran scan (aswMBR.txt attached)

- Tried to download FRST but there is an error on the Geekstogo page that it cannot be found (Alternate location available maybe?)

- Now all the browsers on the main computer shut down as soon as I try to launch them.  I am typing to you on my laptop which is working fine now.

I assume that I will need to get a hold of a version FRST or something like it before you can begin to help me.  Thank you in advance for being willing to help.  I appreciate you.

Troy "Dad"

Edit:  Forgot to post the asw file:

Hello TroyBoy777, welcome to WhatTheTech's Malware Removal forum!
 
My name is Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.   
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean". 

======================================================
 

I assume that I will need to get a hold of a version FRST or something like it before you can begin to help me.

I've provided a working link below.
 
It looks as if we're dealing with ShopperZ:

14:45:17.677    Service bsdriver C:\Windows\system32\drivers\bsdriver.sys **LOCKED**

 
STEP 1
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

======================================================
 
STEP 2
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt

Sorry about that. I figured out what went wrong.  I didn't hit the Finish button last time, which is why it didn't produce a scan log.  I copy and pasted into wordpad all of the Quarantined items (that took a while, lol) but the file size is 779 MB, which is too large to post here.  Sorry!

I scanned again, but it only caught two:

Hi Troy,
 
Please do the following:

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy and paste the contents of the large MBAM scan log into the Notepad document (you can select all items by pressing Ctrl + a on your keyboard at the same time).
• Save the file to your Desktop. Right-click the file and click Send to followed by Compressed (zipped) folder.
• Upload the .zip file to SendSpace and provide a direct download link in your next reply.
   

Once done, please run a fresh scan with FRST:
 
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 

Hi Troy, 
 
Thank you for the file. Let's script out the remnants. 
 
STEP 1
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  HKU\S-1-5-21-1438833293-3375907864-2725770995-1000\…\MountPoints2: {0f296f25-a658-11e4-b382-806e6f6e6963} - D:\install.EXE id= ver=1.0.0.0
  HKU\S-1-5-21-1438833293-3375907864-2725770995-1000\…\MountPoints2: {bd1d8f9f-4c25-11e5-b74a-844bf54c6a98} - E:\LaunchU3.exe -a
  GroupPolicyUsers\S-1-5-21-1438833293-3375907864-2725770995-1004\User: Restriction <======= ATTENTION
  GroupPolicyUsers\S-1-5-21-1438833293-3375907864-2725770995-1003\User: Restriction <======= ATTENTION
  HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
  S1 MPCKpt; system32\DRIVERS\MPCKpt.sys [X]
  Folder: C:\Windows\system32\bons
  Folder: C:\Users\User\AppData\Local\Tempfolder
  2016-02-14 14:30 - 2016-02-14 17:02 - 00000000 ____D C:\Users\User\AppData\Roaming\NogpatUcotce
  2016-02-14 14:30 - 2016-02-14 14:30 - 00003338 _____ C:\Windows\System32\Tasks\Dajiehi
  2016-02-14 14:30 - 2016-02-14 14:30 - 00000000 ___HD C:\Users\User\AppData\Local\SatakMalwareBusterSetup
  2016-02-14 14:30 - 2016-02-14 14:30 - 00000000 ____D C:\uninst
  2016-02-14 13:42 - 2016-02-14 13:42 - 01951744 _____ C:\Users\Jeremiah\Downloads\FindingDiscountUninstaller.exe
  2016-02-14 12:29 - 2016-02-14 12:29 - 00000000 ____D C:\Users\User\AppData\Roaming\Open Download Manager
  2016-02-14 12:27 - 2016-02-14 17:02 - 00000000 ____D C:\Program Files (x86)\OpenSupport
  2016-02-14 12:27 - 2016-02-14 16:28 - 00000000 ____D C:\Users\User\AppData\Local\{C174F728-E5DC-9B90-8844-BE78AC2C42E0}
  2016-02-14 12:27 - 2016-02-14 12:27 - 00000000 ____D C:\Users\User\AppData\Local\291308217
  2016-02-14 12:26 - 2016-02-14 13:33 - 00000000 ____D C:\Program Files (x86)\OpenDownloaderManager
  2016-01-23 21:17 - 2015-09-29 20:38 - 00000000 ____D C:\ProgramData\boost_interprocess
  Task: {012054BA-2F7A-48ED-A75C-3536DCCF38AC} - \Tny_Cassiopesa -> No File <==== ATTENTION
  Task: {155D84A6-8C76-41D1-97B8-EBAE13A58BA9} - \CIMT_S-1-5-21-1438833293-3375907864-2725770995-1004 -> No File <==== ATTENTION
  Task: {228BF211-F813-40A0-BC6B-7CEC6CD73DB1} - \Selection Tools Update -> No File <==== ATTENTION
  Task: {4B59D156-A261-4572-BCCB-84E222855095} - \RSPro -> No File <==== ATTENTION
  Task: {4B5C5567-CE54-4963-A5DD-7FA147FB6204} - \WindApp Update -> No File <==== ATTENTION
  Task: {4BF1CD3B-D048-4221-8BF5-C926609D187F} - \ConsumerInputUpdateTaskMachineCore -> No File <==== ATTENTION
  Task: {55B5F090-E84D-4F09-9F35-3FE3DB91A933} - \SecurityApps2 -> No File <==== ATTENTION
  Task: {58D805C3-4E96-4770-8E47-F9B546F049DA} - \Cassiopesa nodi -> No File <==== ATTENTION
  Task: {6521665B-2F49-48FE-BA68-D7DE7F068D52} - \MAXDriverUpdaterRunAtStartup -> No File <==== ATTENTION
  Task: {73C11260-04DD-403D-B052-A74390BB99F4} - \ConsumerInputUpdateTaskMachineUA -> No File <==== ATTENTION
  Task: {7EFCDA0A-D26C-44C4-BDBC-2996A9D0934C} - System32\Tasks\{47ABD206-5AE0-42F8-8848-AF257F47714E} => pcalua.exe -a C:\Users\User\Downloads\forge-1.7.10-10.13.2.1291-installer-win.exe -d C:\Users\User\Downloads
  Task: {CDDCA7A4-3E4E-46B8-9698-09A2B7A77B6D} - \MAXDriverUpdater_UPDATES -> No File <==== ATTENTION
  Task: {DD6B07CC-4CD4-41B6-974D-119DF5D6851E} - System32\Tasks\Dajiehi => C:\PROGRA~1\SHOPPE~1\Usibmyj.bat
  C:\PROGRA~1\SHOPPE~1
  Task: {E37807A1-1755-4786-8C85-591F7D78D62A} - \CIMT_daily_S-1-5-21-1438833293-3375907864-2725770995-1004 -> No File <==== ATTENTION
  ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www%2dmysearch.com/?prd=set_epc&s=G2Ezftptn095001,503f9254-60eb-4a06-9251-c0aa19fe6d32,
  ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www%2dmysearch.com/?prd=set_epc&s=G2Ezftptn095001,503f9254-60eb-4a06-9251-c0aa19fe6d32,
  ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www%2dmysearch.com/?prd=set_epc&s=G2Ezftptn095001,503f9254-60eb-4a06-9251-c0aa19fe6d32,
  ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www%2dmysearch.com/?prd=set_epc&s=G2Ezftptn095001,503f9254-60eb-4a06-9251-c0aa19fe6d32, –disable-quic
  ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www%2dmysearch.com/?prd=set_epc&s=G2Ezftptn095001,503f9254-60eb-4a06-9251-c0aa19fe6d32, –disable-quic
  CMD: ipconfig /flushdns
  Hosts:
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 2
[external image: EtQetiM.png] Uninstall Software

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall.
  • KNCTR
• Follow the prompts.
• Note: If you are offered the choice to install additional software, ensure you decline.
• Reboot if necessary.
   

STEP 3
[external image: mlEX1wH.png] RogueKiller Scan

• Please download RogueKiller and save the file to your Desktop.
• Close any running programmes.
• Right-Click RogueKiller.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
• A browser window may open. Close the browser window.
• Click [external image: jpgUwzp.png]. Upon completion, click [external image: phPvmc6.png].
• Close the programme. Do not fix anything!
• A log (RKreport.txt) will be open. Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 4
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Fixlog.txt
• Did the programme uninstall OK?
• RKreport.txt

Hi Troy, 
 

A message came up that said that the KNCTR Program was already deleted; I looked on uninstall programs and confirmed that was true.

OK, that's fine. 
 
Please let me know how your computer is functioning after running these final two scans. 
 
STEP 1
[external image: 7D2ig3K.png] Emsisoft Emergency Kit (Portable)

• Please download Emsisoft Emergency Kit and save the file to a your Desktop.
• Double-click EmsisoftEmergencyKit.exe.
• Click Extract.
• Upon completion, double-click the Emsisoft Emergency Kit shortcut on your Desktop to start the programme.
• Click Yes to update the programme definitions.
• Click Yes to detect Potentially Unwanted Programs (PUP's).
• Click Scan now.
• Select Full Scan and click Scan.
• Close any High Risk notification screen that may appear.
• When the scan is finished click Quarantine selected objects if malicious objects were found.
• Click View Report, and open the most recent log. 
• Copy the contents of the log and paste in your next reply.
   

STEP 2
[external image: GzlsbnV.png] ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click [external image: esetListThreats.png]. If no threats were found, skip the next two bullet points. 
• Click [external image: esetExport.png] and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to [external image: KN1w2nv.png] and click [external image: SzOC1p0.png].
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 3
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Emsisoft Scan log
• ESET Online Scan log

Emisoft Emergency Kit Scanlog - 

Hello Troy, 
 
The two items detected by ESET have already been dealt with, and are not of concern. 

C:\AdwCleaner\Quarantine\C\Program Files\SpaceSoundPro\idscservice.exe.vir a variant of MSIL/Agent.AGE trojan
C:\FRST\Quarantine\C\Users\User\AppData\Local\291308217\nodi.dll a variant of Win32/DealPly.AP potentially unwanted application

 
How is your computer functioning now?