Malware– possible trojan_ owner fell for scam

Quote:netsh int ip reset

scroll down to Update the network adapter driver
then Run the Network troubleshooter followed by networking commands:End Quote

 

​Do Huh? Tell me like I'm 5 because ya confused me a bit 

BTW, from the last couple of things, if Im not mistaken you said post logs. I recall a trojan but not fixing it, or did that happen with another program and I missed it?

There was quite a bit of things that needed to be removed, going back over the logs I see where MBAM took them out and this last AdwCleaner log shows

 

[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9}
[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}
[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
[x] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
[x] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}

Those items say not deleted.

I don't know why. Could be the runs got mixed up and there were posted in incorrect order…thats just a guess…..

 

 

It's gets confusing I know….but hang in there.

If I can't get internet connection restored I can send you to another sub forum and ask tech's to  help us out there.

 

We can try this

Go to the Start screen

On the Start screen, type CMD. In the search results, right-click Command Prompt, and then click Run as administrator.
At the command prompt, enter the following command, and then press Enter:
netsh int ip reset

Restart the computer.
~~~~~~~~~~~~~~~~~~

 

I'd like to see a fresh Farbar log

 

 

•  

   

• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
   

 

resetting failed in all as elevation is needed. (run as admin)

 

just what the C:> said

OK,  see if you can run a new FRST scan and post those logs.

 

Will be gone to a birthday party for a while,  will be back later

i am on wifi again. I had to reboot. I think it is caused by these issues. at the same time I am online.

 
wowssa!  you got wifi to work again?
 
Have seen people who upgraded from Windows 7/8 to Windows 10 and these similar issues come up.

~~~
Go to the start button, type in services.msc and in that console scroll to and search for
Net.Tcp Port Sharing Service
Make sure this isn't set to disabled. If it is, change this startup type to "Automatic" then reboot.

~~~~~~~~~~~~~~~~~~~

Go to add remove programs and delete/uninstall
Yahoo! Detect (HKLM-x32\…\YTdetect) (Version: - )

~~~~~~~~~~~~~~~`

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


[external image: FRSTfix.JPG]

 

start
CreateRestorePoint:
CloseProcesses:
Task: {7A2C67F8-42B2-4B3C-B4D3-137F3A2F6E17} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {E9AEE43A-B9DD-45C8-B3D0-8418AB2B9F7E} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
CHR HomePage: Default -> hxxp://www.safesearch.net/?utm_medium=ie&utm_campaign=31&utm_source=sm&utm_content=1&utm_term=C13F577B970240D5
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.106\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.106\pdf.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
CHR Plugin: (Java Platform SE 7 U17) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
CHR Plugin: (TelevisionFanatic Plugin Stub) - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\NP64Stub.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => No File
CHR Plugin: (Java Deployment Toolkit 7.0.170.2) - C:\Windows\SysWOW64\npDeployJava1.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
C:\Users\Jerry\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Jerry\AppData\Local\Temp\libeay32.dll
C:\Users\Jerry\AppData\Local\Temp\msvcr120.dll
C:\Users\Jerry\AppData\Local\Temp\sqlite3.dll
EmptyTemp:
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Working on all this. Wanted to let you know that The Net.Tcp Port Sharing Service was disabled. 

Trying to do the Yahoo detect since we started and constantly told unavailable. Cannot delete at all. Tried many times.

OK
Million dollar question….How is the computer now?

That is a hard on for me to answer. It seems as if it is doing well, but in my gut I don't trust it. I wouldn't put my cc # in through it. 

Way back when, LD Tate would lend a hand and I could actually see things improving and changing. I was also a windows person working with him on my computer. Now I am a mac person working on a windows with an OS I am clueless about and it isn't intuitive at all, to me.

 

To clear some things up:

WhenI started this log all I had to go on was the info on the front of the computer. I thought it was a 7. The OS had been updated to a 10 already by the time I got it so we don't have that fight. We just have all the windows 10 issues.

 

The wifi issue. Not sure about it. Weird. Yes it gave me no wifi and after reboot I had it. This was before I mentioned it to you. I was able to get something to work somehow. Don't know how that will do down the road. I hope the owner only connects via hardline.

 

Chrome, still has an issue at least 1 time everyday where it says closed wrong, want to reload pages? but never reloads the pages. Eh could be a chrome issues, no clue. 

 

I hate that the one shot online software didn't work because I know there was a lot of yuck on here. Like to know that it is all gone. I felt like that was a powerful software. 

 

So these are my thoughts. Is it better? I don't know really. I am sure it is, it has to be. What in the world do we even do next?? Run it all over again just to be sure?

That is a hard on for me to answer. It seems as if it is doing well, but in my gut I don't trust it. I wouldn't put my cc # in through it. 
Way back when, LD Tate would lend a hand and I could actually see things improving and changing. I was also a windows person working with him on my computer. Now I am a mac person working on a windows with an OS I am clueless about and it isn't intuitive at all, to me.
 
To clear some things up:
WhenI started this log all I had to go on was the info on the front of the computer. I thought it was a 7. The OS had been updated to a 10 already by the time I got it so we don't have that fight. We just have all the windows 10 issues.
 
The wifi issue. Not sure about it. Weird. Yes it gave me no wifi and after reboot I had it. This was before I mentioned it to you. I was able to get something to work somehow. Don't know how that will do down the road. I hope the owner only connects via hardline.
 
Chrome, still has an issue at least 1 time everyday where it says closed wrong, want to reload pages? but never reloads the pages. Eh could be a chrome issues, no clue. 
 
I hate that the one shot online software didn't work because I know there was a lot of yuck on here. Like to know that it is all gone. I felt like that was a powerful software. 
 
So these are my thoughts. Is it better? I don't know really. I am sure it is, it has to be. What in the world do we even do next?? Run it all over again just to be sure?

LD Tate is fantastic isn't he.

 

The wifi issues has been mysterious I know….

 

We'll take it a step at a time because I don't want you confused.
Yes, the machine was Windows 7 and evidently windows update was set to auto, thus, you now have Windows 10.
Now, if the system readiness tool was run, we'll never know…Microsoft is pushing windows 10 many people have it now who didn't particularly want it.

Did you ever completely uninstall/remove Google Chrome?

 

If you would,  let's run AdwCleaner once more to see if it finds any remnants,  and if it does,  click on the CLEAN button and allow it to remove the entries found.

 

post that log when you can.

See, I am so bad I can't even seem to get the quote to work as I want it to!  AHH

 

Ok, Yes, he is awesome. YOU ARE TOO! 

 

Wifi–  Right! Just weirdness 

 

Chrome. I used the tool Revo you told me to use. I did it a second time as was explained earlier. I also for fun did it a third time to triple chaco what I did was correct. I followed your instructions each time.

 

I tried to remove yahoo via uninstall and Revo. Revo couldn't see it and add remove said its unavailable. 

 

As for the windows 7 /10 issue. I don't know how long it has had 10 on it but I presume a while. It didn't do an update to it since I had it. 

 

Thanks for holding my hand in this and being so longsuffering and patient! 

Ok! from the other part of the conversation, I think I understand the auto update part, now. Hit me with a brick next time, faster!

 

I think I have the 7 discs if that would help. I know on a mac I can run an old software and not harm any of my data. Not sure if windows is that way or not.