63 replies to this topic

[pastimage]

Forgive me please. I had a moment of serious frustration. However, I am now past that. Here is the log you asked for. as to the question 'how is it running?'

 

It seems to be running well. I somehow found the remote assist and turned that off. I turned off some extensions and need to delete them, but haven't yet. I have not looked into the other browsers yet. I also want to see if it will boot in safe mode and if I get the same message as before. I found a tut that shows how to make that right but I will run it by you before I get brave enough to break this computer forever. 

 

Here is the log.

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.7 (07.03.2016)

Operating System: Windows 10 Home x64 

Ran by Jerry (Administrator) on Sat 07/09/2016 at  9:50:02.35

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 16 

 

Successfully deleted: C:\Users\Jerry\AppData\Local\{30016A68-6F18-47BD-A458-A654EAD8122F} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{36DD26FD-4152-4558-9789-B48552034A66} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{48F0B09A-AD95-49DD-8294-AA0F66DB839A} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{4D3323C7-3EDC-4E70-A76F-A2429D35F35D} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{765ADD63-6199-4ED8-AECF-1D59C348AEFA} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{7D5DC019-1763-4B31-A1D0-B1C1EB7A1504} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{AAAEEE7C-194C-41B2-A918-D1AAEE091871} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{F1BC7DDC-BFAE-48FC-A601-9747E76CF2A6} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\{FC2225EA-6C23-4089-A21E-236C58F9CB15} (Empty Folder)

Successfully deleted: C:\Users\Jerry\AppData\Local\apn (Folder) 

Successfully deleted: C:\Users\Jerry\Appdata\LocalLow\televisionfanaticei (Folder) 

Successfully deleted: C:\Users\Jerry\AppData\Roaming\iwin (Folder) 

Successfully deleted: C:\Users\Jerry\Documents\add-in express (Folder) 

Successfully deleted: C:\Program Files (x86)\alot (Folder) 

Successfully deleted: C:\Program Files (x86)\GUTBC3D.tmp (File) 

Successfully deleted: C:\Program Files\safesearch (Folder) 

 

 

 

Registry: 0 

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sat 07/09/2016 at  9:53:36.84

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[pastimage]

Chrome seems to be shutting down incorrectly constantly 

[Juliet]

Alright
If he wants to continue using Google Chrome fine, we need to uninstall it then reinstall.
I think, and I'm not sure but, he might have had to many corrupt extensions for it to work correctly.

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

Backup Chrome Bookmarks

Sign into Google Sync:

• Click on the 3 bars in the top right hand corner and select Settings.
• In the list of Settings click on Disconnect your Google Account.
• In the text of the next window click on Google Dashboard, Chrome sync screen, click on Stop and Clear at the bottom.
• A box will open and ask for confirmation, click on OK (wait for this to complete before doing the next step).
• When confirmation appears, close that page and then click on Disconnect account and close Google Chrome.
• 
  
• Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on Google Chrome
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.
• Then, it can be reinstalled from
  http://www.google.com/chrome/
  
  
  

[Juliet]

Glad you turned remote assistant off.....



Boot into Safe Mode

• Restart your PC.
• As soon as the BIOS is loaded, begin repeatedly tapping the F8 key until the Advanced Options menu appears.
• Using the arrow keys, select Safe Mode.
• Press the Enter key.

[Juliet]

Let me go ahead and give the next instructions

What we can do now is run an online scan with Eset, a good trusted scanner, reliable and thorough.
The settings I suggest will also show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.

Ensure your external and/or USB drives are inserted during the scan.


Please run this Free Online Virus Scanner from ESET

• Please be patient.
• Turn off the real-time scanner of any existing antivirus program before performing the online scan. Here's how
• You want the Online One-Time Scan
• Note: It will run using Internet Explorer, Firefox or Chome.
• Tick the box next to YES, I accept the Terms of Use.
• When/if prompted by UAC, 'Do you want to allow this app to make changes to your PC?', please choose Yes
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is NOT TICKED, and the option Scan unwanted applications is checked
• Click Scan
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[pastimage]

With win + R I was able to use msconfig to boot into safe mode but I cannot get there via F8. Once there I had the same problem. Im locked out. Could this really work to fix my problem? remove the spaces before .com

 

https://www.youtube.  com/watch?v=zRPIDuSUhk0&app=desktop

 

 

Oh, and I am running the latest thing now as I would outside of safe mode as I couldn't any other way.

Edited by pastimage, 09 July 2016 - 10:46 AM.

[Juliet]

 

With win + R I was able to use msconfig to boot into safe mode

You'll have to use this option to undo safe mode options first, reboot,  then after that in theory,   start tapping the F8 key until the Advanced Options menu appears.

 

Did that make sense?

[pastimage]

yes it did. however, I had done that and still no F8.

 

 

Running the online deal in regular mode it came up with at least 8 infections. I did tell it to look for pups. However, the screen told me some problem occurred and had to shut down. Not what I wanted to read. so the chrome window still open and the other closed, oh boy. Ill give the F8 a try again but Im clueless at this point. 

[Juliet]

yes it did. however, I had done that and still no F8.

 

 

Running the online deal in regular mode it came up with at least 8 infections. I did tell it to look for pups. However, the screen told me some problem occurred and had to shut down. Not what I wanted to read. so the chrome window still open and the other closed, oh boy. Ill give the F8 a try again but Im clueless at this point. 

Finding infections was expected but it doesn't mean their active,  hoping their already in quarantine folders.

 

Can the scan be run in normal mode?

 

have you rebooted at all?

[pastimage]

Yep, I did. Just now to double my double check. Tried F8 again too to no avail. 

 

Did you look at that video? What did you think about it helping in an honest way?

[Juliet]

What are doing now, waiting for an online scan and then see what we can do about going into safe mode?

• 
  
• Download RogueKiller to your desktop.
  http://www.adlice.co...iller/#download
  Goes at the bottom of the page, right in front of the links.
• Quit all running programs.
• For Windows XP, double-click to start.
• For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
• Read and accept the EULA (End User Licene Agreement)
• Click Scan to scan the system.
• When the scan completes Close the program > Don't Fix anything!
• Don't run any other options, they're not all bad!!
• Post back the report which should be located on your desktop.
• ****
  NEXT
  Please download Farbar Service Scanner and run it on the computer.
  
  Make sure the following options are checked:
• Internet Services
  Windows Firewall
  System Restore
  Security Center
  Windows Update
• 
  Press "Scan".
  It will create a log (FSS.txt) in the same directory the tool is run.
  Please copy and paste the log to your reply.

[pastimage]

So here is the RKiller log. I have to do the other one. The storm dropped a tree on us last night. Thank God little damage. In the big scheme of things none at all, but clean up, mowing, dog shaving and such. Plus someone on the phone all the time for me. I don't mean to be so hit and miss. 

 

RogueKiller V12.3.7.0 (x64) [Jul  4 2016] (Free) by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.co...ad/roguekiller/

Blog : http://www.adlice.com

 

Operating System : Windows 10 (10.0.10586) 64 bits version

Started in : Normal mode

User : Jerry [Administrator]

Started from : C:\Users\Jerry\Downloads\RogueKillerX64.exe

Mode : Scan -- Date : 07/09/2016 15:51:53

 

¤¤¤ Processes : 0 ¤¤¤

 

¤¤¤ Registry : 0 ¤¤¤

 

¤¤¤ Tasks : 1 ¤¤¤

[Suspicious.Path] \Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan -- c:\Program Files\Microsoft Security Client\MpCmdRun.exe (Scan -ScheduleJob -RestrictPrivileges) -> Found

 

¤¤¤ Files : 0 ¤¤¤

 

¤¤¤ Hosts File : 0 ¤¤¤

 

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: ST332041 8AS SATA Disk Device +++++

--- User ---

[MBR] 86c1c596ac9bd03f521494e18b50b7bc

[BSP] 3c6c41254eeb894616dfde80dfc37d08 : HP MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB

1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 80325 | Size: 15000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 30800325 | Size: 290205 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 ... OK

User = LL2 ... OK

 

 

Here is the other log:

 

 

Farbar Service Scanner Version: 27-01-2016

Ran by Jerry (administrator) on 09-07-2016 at 16:35:02

Running from "C:\Users\Jerry\Desktop"

Microsoft Windows 10 Home  (X64)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

 

 

Windows Firewall:

=============

 

Firewall Disabled Policy: 

==================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall"=DWORD:0

 

 

System Restore:

============

 

System Restore Policy: 

========================

 

 

Security Center:

============

 

 

Windows Update:

============

wuauserv Service is not running. Checking service configuration:

The start type of wuauserv service is set to Demand. The default start type is Auto.

The ImagePath of wuauserv service is OK.

The ServiceDll of wuauserv service is OK.

 

 

Windows Autoupdate Disabled Policy: 

============================

 

 

Other Services:

==============

 

 

File Check:

========

C:\Windows\System32\nsisvc.dll => File is digitally signed

C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed

C:\Windows\System32\drivers\afd.sys => File is digitally signed

C:\Windows\System32\drivers\tdx.sys => File is digitally signed

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed

C:\Windows\System32\dnsrslvr.dll => File is digitally signed

C:\Windows\System32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\System32\mpssvc.dll => File is digitally signed

C:\Windows\System32\bfe.dll => File is digitally signed

C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed

C:\Windows\System32\SDRSVC.dll => File is digitally signed

C:\Windows\System32\vssvc.exe => File is digitally signed

C:\Windows\System32\wscsvc.dll => File is digitally signed

C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed

C:\Windows\System32\wuaueng.dll => File is digitally signed

C:\Windows\System32\qmgr.dll => File is digitally signed

C:\Windows\System32\es.dll => File is digitally signed

C:\Windows\System32\cryptsvc.dll => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

 

 

**** End of log ****

Edited by pastimage, 09 July 2016 - 02:37 PM.

[Juliet]

Those came back ok

let's try this:

Look in add/remove programs list, look for anything related to Eset (if found) and delete.

Emsisoft Emergency Kit (Portable)

• Please download Emsisoft Emergency Kit and save the file to a your Desktop.
• Double-click EmsisoftEmergencyKit.exe.
• Click Extract.
• Upon completion, double-click the Emsisoft Emergency Kit shortcut on your Desktop to start the programme.
• Click Yes to update the programme definitions.
• Click Yes to detect Potentially Unwanted Programs (PUP's).
• Click Scan now.
• Select Full Scan and click Scan.
• Close any High Risk notification screen that may appear.
• When the scan is finished click Quarantine selected objects if malicious objects were found.
• Click View Report, and open the most recent log.
• Copy the contents of the log and paste in your next reply.

[pastimage]

I can only hope that at this time of night you are able to sleep a bit. However, I am still at it. 

 

I noticed something, could be a windows issue, When the computer sleeps or goes black screen it doesn't want to connect to any wi fi and this latest time it told me there were no wifi networks available. So all the neighbors and myself shut off our wifi at the same time? I know mine was on! ideas? 

 

Your directions versus what I saw was a bit different. Heads up on that one. For example I had no option for full scan or to click yes to pups. just a few things like that. 

 

Emsisoft Emergency Kit - Version 11.0

Last update: 7/9/2016 10:04:23 PM

User account: Jerry-PC\Jerry

 

Scan settings:

 

Scan type: Custom Scan

Objects: Rootkits, Memory, Traces, C:\, Q:\

 

Detect PUPs: On

Scan archives: On

ADS Scan: On

File extension filter: Off

Advanced caching: On

Direct disk access: Off

 

Scan start: 7/9/2016 10:06:43 PM

Key: HKEY_USERS\S-1-5-21-2248493896-8109280-2460336663-1001\SOFTWARE\YAHOOPARTNERTOOLBAR detected: Application.Win32.YTool (A)

Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9} detected: Application.AdReg (A)

C:\Users\Jerry\AppData\Local\Google\Chrome\User Data\Default\Default\aagdgggbdadhgfgedggddbdcdegcdbdg\ContentScript.js detected: Trojan.Script.623508 (

 

Scanned 237851

Found 3

 

Scan end: 7/9/2016 10:57:45 PM

Scan time: 0:51:02

Edited by pastimage, 09 July 2016 - 09:40 PM.

[Juliet]

Those left over entries should had been picked up by previous scanners run.
Not surprising tho since this machine was so heavy with infections.

AdwCleaner <-- still on desktop?, if so open the tool and look for the uninstall button.
Click on uninstall.

I want you to download it again and let's scan one more time.

• Please download AdwCleaner and save the file to your Desktop.
• Right-click AdwCleaner.exe and select Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
• Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
• Click Clean.
• Follow the prompts and allow your computer to reboot.
• After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~

Now, with Junkware Removal Tool

Please download Junkware Removal Tool
or from here http://downloads.mal...es.org/file/jrt
to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~~~~~~~~~~~~~

• Open Malwarebytes Anti-Malware
• On the Dashboard click on Update Now
• Go to the Setting Tab
• Under Setting go to Detection and Protection
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
• Then on the Dashboard click on Scan
• Make sure to select THREAT SCAN
• Then click on Scan
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
• If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs, followed by the first Scan Log.
• Click Export, followed by Copy to Clipboard. Paste the log in your next reply.
  
  

please post
AdwCleaner[C1].txt
JRT.txt
Malwarebytes Anti-Malware


*****
Now, for issues with the wifi

Often laptops have a wifi switch on them (generally at the front edge somewhere), you haven't flicked that off by mistake? (I've done that before ha).



Reboot Your Computer and Your Wireless Router
try unplugging the router for 5 to 10 seconds and then plugging it back in, wait for all lights to stop blinking then try connection again.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
Try these tweaks....

Start, control panel, device manager. Click on Network and then right click on your wireless adapter, left click properties, power management. Uncheck the box, allow computer to turn off this device to save power.

Go to the power options, and changed the Wireless Adapter Setting, from Maximum Power Setting to Maximum Performance.

~~~~~~~~~~~~~~~~~~~~~~~~~~
netsh int ip reset
scroll down to Update the network adapter driver
then Run the Network troubleshooter followed by networking commands
https://support.micr...nnection-issues


~~~~~~~~~~~~~`
Let me know how you make out and if those issues are fixed.