Hello,
Bitdefender Antivirus Free Edition, Kaspersky, McAfee & Norton Security Scans downloaded, but would not install when clicking the application and gave errors. I downloaded all programs again, and I got the same issues.
So I need some expert help please!
Hello mstein66 and welcome to the WTT Satchfan and I would be glad to help you with your computer problem.Please read the following guidelines which will help to make cleaning your machine easier:
please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad . Please ensure that word wrap is un checked . In Notepad click Format , uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT DO NOT DO NOT Note Download and run AdwCleaner here
run AdwCleaner by clicking on Scan
when it has finished, leave everything that was found checked, (ticked), then click on Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.
===================================================Download and run Junkware Removal Tool Junkware Removal Tool
shut down your protection software now to avoid potential conflicts. run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
the tool will open and start scanning your system
please be patient as this can take a while to complete depending on your system's specifications
on completion, a log (JRT.txt) is saved to your desktop and will automatically open
post the contents of JRT.txt into your next message.
===================================================Run RogueKiller IMPORTANT : Please remove any usb or external drives from the computer before you run this scan!RogueKiller
close all running programs
for Windows Vista/Seven, right click -> run as administrator , for XP simply double-click on RogueKiller.exe when the pre-scan is finished, click on Scan
click on Report and copy/paste the content in your next post
NOTE : DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily badIf the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe .RKreport.txt in your next reply.Logs to include with next post :AdwCleaner log
Satchfan,
Tks for replying and providing assistance; please see attached!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
RogueKiller V12.10.8.0 (x64) [May 8 2017] (Free) by Adlice Softwarehttp://www.adlice.com/contact/ https://forum.adlice.com http://www.adlice.com/download/roguekiller/ http://www.adlice.com
Thanks for the logs.Run RogueKiller IMPORTANT : Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again
close all programs
double-click RogueKiller.exe - Windows 7/8//10: right-click the program and select Run as Administrator'
after it has completed it's prescan, click on Scan
when the scan is finished press the Delete button and post the log it produces.
Please then run it again and send the new logRun Farbar Recovery Scan Tool Farbar Recovery Scan Tool Note : You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
press Scan button
it will produce a log called Frst.txt in the same directory the tool is run from
please copy and paste log back here.
the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.
Logs to include with next post :RogueKiller fix log
So after the first sets of scan; the PC froze up again, but it is running way longer. See attached!
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-05-2017
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-05-2017
There’s no sign of infection but you may have some problems since your Windows upgrade.
go to your Downloads folder and locate Farbar Recovery Scan Tool
right click and select Cut
go to an empty spot on your desktop, right click and select Paste
Farbar Recovery Scan Tool should now be on your desktop.Run Farbar Recovery Scan Tool
CloseProcesses:
SearchScopes: HKU\S-1-5-21-3182437592-1732908174-1219014245-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
2017-05-14 11:08 - 2017-05-14 12:11 - 00000000 ____D C:\ProgramData\F-Secure
2017-05-14 11:08 - 2017-05-14 11:08 - 00000000 ____D C:\Users\Dennis\AppData\Local\F-Secure
2017-05-14 11:07 - 2017-05-14 11:07 - 00000476 ____H C:\WINDOWS\Tasks\Norton Security Scan for Dennis.job
2017-05-14 11:07 - 2017-05-14 11:07 - 00000000 ____D C:\ProgramData\NortonInstaller
2017-05-14 11:07 - 2017-05-14 11:07 - 00000000 ____D C:\ProgramData\Norton
2017-05-14 11:06 - 2017-05-14 11:06 - 00028827 _____ C:\ProgramData\agent.1494774388.bdinstall.bin
2017-05-14 11:01 - 2017-05-14 11:01 - 00000322 _____ C:\WINDOWS\Tasks\BDAntiCryptoWallTask.job
2017-05-14 10:46 - 2017-05-14 10:46 - 00000000 ____D C:\ProgramData\McAfee
2017-05-14 10:30 - 2017-05-14 10:30 - 00028415 _____ C:\ProgramData\agent.1494772255.bdinstall.bin
2017-05-14 10:27 - 2017-05-14 10:27 - 00028417 _____ C:\ProgramData\agent.1494772040.bdinstall.bin
2017-05-14 10:13 - 2017-05-14 10:13 - 00028418 _____ C:\ProgramData\agent.1494771180.bdinstall.bin
2017-05-14 10:12 - 2017-05-14 10:12 - 00028417 _____ C:\ProgramData\agent.1494771147.bdinstall.bin
2017-05-14 10:04 - 2017-05-14 12:43 - 00000000 ____D C:\Users\Dennis\AppData\Local\ESET
2017-05-14 10:03 - 2017-05-14 10:03 - 00047183 _____ C:\ProgramData\agent.1494770617.bdinstall.bin
2017-05-14 10:03 - 2017-05-14 10:03 - 00000000 ____D C:\ProgramData\Bitdefender Agent
2017-05-14 10:02 - 2017-05-14 10:02 - 00465252 _____ C:\Users\Dennis\AppData\Local\census.cache
2017-05-14 10:02 - 2017-05-14 10:02 - 00221868 _____ C:\Users\Dennis\AppData\Local\ars.cache
2017-05-14 09:55 - 2017-05-14 09:55 - 00000010 _____ C:\Users\Dennis\AppData\Local\sponge.last.runtime.cache
2017-05-14 09:50 - 2017-05-14 09:50 - 00000000 ____D C:\WINDOWS\Trend Micro
2017-05-14 09:47 - 2017-05-14 09:47 - 00000036 _____ C:\Users\Dennis\AppData\Local\housecall.guid.cache
2017-05-14 09:33 - 2017-05-14 09:47 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2017-05-12 13:28 - 2017-05-12 13:28 - 00002240 ____T C:\ash6CE3.tmp
2017-05-12 13:18 - 2017-05-12 13:18 - 00002240 ____T C:\ash65FD.tmp
2017-05-12 13:02 - 2017-05-12 13:02 - 00002240 ____T C:\ash6E3A.tmp
2017-05-12 12:35 - 2017-05-12 12:35 - 00002240 ____T C:\ash5776.tmp
2017-05-12 11:43 - 2017-05-12 11:43 - 00002240 ____T C:\ash7D0F.tmp
2017-04-21 13:35 - 2012-11-26 16:10 - 00000000 ____D C:\Users\Dennis\.epaysol
C:\Users\Dennis\AppData\Local\ars.cache
C:\Users\Dennis\AppData\Local\census.cache
C:\Users\Dennis\AppData\Local\housecall.guid.cache
C:\Users\Dennis\AppData\Local\sponge.last.runtime.cache
C:\ProgramData\agent.1494770617.bdinstall.bin
C:\ProgramData\agent.1494771147.bdinstall.bin
C:\ProgramData\agent.1494771180.bdinstall.bin
C:\ProgramData\agent.1494772040.bdinstall.bin
C:\ProgramData\agent.1494772255.bdinstall.bin
C:\ProgramData\agent.1494774388.bdinstall.bin
C:\ProgramData\Coinstaller.log
C:\ProgramData\DP45977C.lfl
C:\ProgramData\lxecscan.log
C:\Users\Dennis\AdobeAIRInstaller.exe
C:\Users\Dennis\avast_internet_security_setup.exe
C:\Users\Dennis\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Dennis\AppData\Local\Temp\nssSetup.exe
CustomCLSID: HKU\S-1-5-21-3182437592-1732908174-1219014245-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Dennis\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3182437592-1732908174-1219014245-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Dennis\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3182437592-1732908174-1219014245-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Dennis\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => No File
AlternateDataStreams: C:\Users\Dennis\Downloads\Setup.x86.en-US_ProfessionalRetail_FNQGH-HFH4F-PTD37-XBQ9T-8TWQD_TX_PR_.exe:BDU [0]
EmptyTemp:
NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
save the files as fixlist.txt in the same folder as FRST – NOTE : It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
run FRST64 then click Fix just once and wait
it will create a log on your desktop, (Fixlog.txt) ; please post it to your reply.
================================================Run Security Check Security Check by screen317 from here
save it to your Desktop.
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
a Notepad document should open automatically called checkup.txt ; please post the contents of that document.
NOTE: UNSUPPORTED OPERATING SYSTEM! ABORTED! , try rebooting the system and then run SecurityCheck again.Logs to include with next post :Fixlog.txt
Fix result of Farbar Recovery Scan Tool (x64) Version: 14-05-2017
Results of screen317's Security Check version 1.014 — 12/23/15 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` ````````````````````End of Log``````````````````````
There are a few entries in your FRST log that I appear to have left out of the 'fix' so we'll deal with those first but I still feel that it may be system, (possibly driver-related). However, we’ll make sure that there are no remnants of Norton left on the machine and run a final scan with Malwarebytes again.Run Farbar Recovery Scan Tool
CloseProcesses:
( ) C:\Windows\System32\lxeccoms.exe
R2 lxec_device; C:\WINDOWS\system32\lxeccoms.exe [1052328 2010-04-14] ( )
2017-05-14 11:08 - 2017-05-14 12:43 - 00000000 ____D C:\Users\Dennis\AppData\Local\FSDART
Task: C:\WINDOWS\Tasks\BDAntiCryptoWallTask.job => C:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDAntiRansomware.exe
Task: C:\WINDOWS\Tasks\Norton Security Scan for Dennis.job =>
Task: C:\WINDOWS\Tasks\User_Feed_Synchronization-{DF000058-8DF0-4234-9440-25E0153AAB85}.job => C:\WINDOWS\system32\msfeedssync.exe
2017-05-12 14:03 - 2009-11-04 08:17 - 00189440 _____ () C:\WINDOWS\system32\spool\PRTPROCS\x64\lxecdrpp.dll
EmptyTemp:
NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
save the files as fixlist.txt in the same folder as FRST – NOTE : It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
run FRST64 then click Fix just once and wait
it will create a log on your desktop, (Fixlog.txt) ; please post it to your reply.
===================================================Run Norton Removal Tool this Run Malwarebytes’ Anti-Malware
You said that you had run Malwarebytes but it doesn’t appear to be installed. Please download Malwarebytes Anti-Malware
double-click mbam-setup- mb3-setup-consumer-3.0.4.exe and follow the prompts to install the program
at the end, be sure a checkmark is placed next to the following
Launch Malwarebytes Anti-Malware a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
click Finish .
on the Dashboard, click Update Now
after the update completes, click the Scan Now ' button.
if an update is available, clicking the Update Now button will update it
a Threat Scan will begin.
when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
when the prompt to restart the computer appears, click Yes .
after the restart once you are back at your desktop, open MBAM once more
click on the “History” tab, the “Application Logs”
double-click on the scan log which shows the date and time of the scan just performed.
click Copy to Clipboard
please paste the contents of the clipboard into your reply.
Logs to include with next post :Fixlog.txt
Fix result of Farbar Recovery Scan Tool (x64) Version: 14-05-2017
Malwarebytes
I'd say that if you still have a problem, this is a likely to be Windows-related as I have seen no indication of anything malicious in your logs.
Can you tell me how the computer is behaving now, both in normal mode and safe mode because it will help me to decide the best forum to direct you to for further help.
So, I'll just be working within the PC and it will just freeze up where nothing works, such as the mice and keyboard, and I have to reboot. Sometimes it works longer than other times, but the end results is the same. I have not worked in Safe Mode since I have been working with you, but in Safe Mode, it doesn't freeze up – so far.
I should include that in your opening post and include the fact that there was no sigh of malware on your computer.Here
2017-04-20 16:50 - 2016-10-10 15:58 - 08201755 ____R C:\Users\Dennis\Downloads\Ccleaner v5.22.5724 Professional + All Edition Keys [4realtorrentz].zip
ALL illegal downloads are unsafe even though '4realtorrentz' states otherwise. Please let me know if you're happy to close this and if so, I'll send instructions to tidy up.
Yes, those were never installed, but I have removed them and thanks for the help. I will try the link and you may close this ticket out!
