Vaio Laptop - Possibly Infected [Solved]

Hello Juliet, nice to e-meet you. I've attached both reports below:

 

Nice to meet you too.


Start FRST (Please double-click on FRST/FRST64) with Administrator privileges

OR ==> Right click on the FRST icon and select Run as administrator
Highlight the below information then hit the Ctrl + C keys at the same time
beginning with Start:: and finishing with End::


Start::
EndProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
Toolbar: HKLM - FireShot - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - No File
Toolbar: HKLM-x32 - FireShot - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - No File
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter1\FirefoxAddOns\[removed] => not found
2016-12-16 15:36 - 2016-12-16 15:36 - 0032768 _____ () C:\Users\SmarterDoug2\AppData\Local\Temp\-vo_izzi.dll
2016-12-16 16:26 - 2016-12-16 16:26 - 0009216 _____ () C:\Users\SmarterDoug2\AppData\Local\Temp\a7cm1lgi.dll
2017-03-30 21:29 - 2017-03-30 21:29 - 0032768 _____ () C:\Users\SmarterDoug2\AppData\Local\Temp\le3gem2q.dll
2017-07-11 10:32 - 2017-07-11 10:32 - 0032768 _____ () C:\Users\SmarterDoug2\AppData\Local\Temp\ntkwsl-v.dll
2016-12-17 10:06 - 2017-03-01 08:55 - 21387040 _____ (Siber Systems) C:\Users\SmarterDoug2\AppData\Local\Temp\RoboForm-Setup.exe
2017-04-11 08:57 - 2017-04-11 08:57 - 22488888 _____ (Siber Systems) C:\Users\SmarterDoug2\AppData\Local\Temp\RoboForm-v8-Setup.exe
2016-12-01 12:15 - 2016-12-01 12:15 - 0005632 _____ () C:\Users\SmarterDoug2\AppData\Local\Temp\zti5ozol.dll
ContextMenuHandlers01: [BTMSentToExt] -> [CC]{0A7D34C2-E9DA-48A1-9E34-0CDFC2DE3B44} => -> No File
ContextMenuHandlers05: [ESPDesktopMenu] -> {D2F1CE69-EA7F-4E8D-A0FB-D3DC3039A444} => -> No File
ContextMenuHandlers05: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> No File
Task: {023147FB-2975-425A-9380-A5FA2487C228} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {06D1EA09-0886-412C-B414-5454061CAB84} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {094F8A15-2029-478B-A240-AA2FA96611C7} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {1822C019-CBC4-4DE1-B990-CF47C3DE6F3F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {1A577E6C-D053-4673-B668-77065CB8E07D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {1B4FE9CC-E83A-4EEC-BAA9-FEC671AC8869} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {4BF77264-ED66-4E4F-BE8A-F2DD4A2771D0} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {5F6F91B0-3084-49D6-8999-4F19CC6EA871} - \Microsoft\Windows\Setup\GWXTriggers\Logon-URT -> No File <==== ATTENTION
Task: {66C5D349-11D0-4BDD-B937-2E717CCF3B3E} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {71FF0880-DFE7-49D0-8DD5-95903716291C} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {78E594DC-CE71-4F6B-9152-E3A8B0E4DB65} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {8C7357F5-C6E3-4AA4-AD87-FC847A315EC0} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {F2911666-265C-429F-9327-2A08D55A87EA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {F8E2A49A-0C8C-4059-B2DC-CC7594DACC3D} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\SmarterDoug2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fuze Meeting\Fuze Meeting .lnk -> C:\Users\SmarterDoug2\AppData\Local\Fuze Box\Fuze Meeting\Fuze_Meeting.exe (Fuze Box Inc.) -> hxxps://www.fuzemeeting.com/fuze
AlternateDataStreams: C:\Archifects:AFP_AfpInfo [122]
AlternateDataStreams: C:\Bentley:AFP_AfpInfo [122]
AlternateDataStreams: C:\ddrd:AFP_AfpInfo [122]
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
Hosts:
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~

[external image: h3qKPnn.png]Malwarebytes AdwCleaner

• Please download Malwarebytes AdwCleaner and save the file to your Desktop
• Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click [external image: A49sxPr.png]Scan.
• Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
• Click [external image: MqHawIb.png]Clean.
• Follow the prompts and allow your computer to reboot.
• After the reboot, a log (AdwCleaner[C0].txt) will open. Copy the contents of the log and paste in your next reply.

– File, folder and registry backups are made for items removed using this programme. Should a legitimate file, folder or registry item be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[S0].txt.

~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~
please post
Fixlog.txt
AdwCleaner[C0].txt
JRT.txt

Hi Juliet, here are the results of the software you had me run:

 

Juliet,

Sounds good. Here is the new scans from my sluggish desktop ( we just worked on my laptop).

 

Sorry for the long delay, did not receive notification of your reply.

You might want to consider removing/uninstalling
Bling Toolbar v10.0 (HKLM-x32\…\{E1D95537-84E9-42D1-8FBD-5AFA905BE067}) (Version: 10.0 - Spigot, Inc.) <==== ATTENTION
http://www.shouldiremoveit.com/YTD-Toolbar-7607-program.aspx




Start FRST (Please double-click on FRST/FRST64) with Administrator privileges

or Right click on the FRST icon and select Run as administrator

Right click on the highlighted text and select Copy.[beginning with Start:: and finishing with End::]

Start::
EndProcesses:
CreateRestorePoint:
ContextMenuHandlers01: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2015-09-17] (Igor Pavlov)
ContextMenuHandlers01: [Cover Designer] -> {73FCA462-9BD5-4065-A73F-A8E5F6904EF7} => -> No File
ContextMenuHandlers05: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {182FB8B1-091C-44C3-8829-76679F2D4C26} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {699F157C-F453-457B-B209-2C39C49D0661} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {6D91119C-6460-4E90-B36A-11C574A8064D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {85D4BD7D-4167-4E99-8C0C-CCD76C0C75BA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {8D66DD1E-7324-49A9-A53F-2E21897A9E3D} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {AC3BFE79-F623-4CB1-AC91-C466705E4402} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {B7726C8D-A960-4A96-9B30-B3D41D55DF85} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {D2E2F874-D87B-4405-BEC8-B3AF4005F367} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E111CCA9-EEF6-4E73-A3F1-4348BB1EF7E3} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {E36DAF8C-3EC7-4E09-86D8-84A28C042874} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {E7D59556-93E5-4F68-92CE-F0B8507B5F37} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {EDBF0DFC-3889-403D-B3CB-BA5E7341A741} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
AlternateDataStreams: C:\Users\DougDeskTop\Desktop\Andi's 1.17 time-lapse.mov:com.dropbox.attributes [168]
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~

[external image: h3qKPnn.png]Malwarebytes AdwCleaner

• Please download Malwarebytes AdwCleaner and save the file to your Desktop
• Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click [external image: A49sxPr.png]Scan.
• Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
• Click [external image: MqHawIb.png]Clean.
• Follow the prompts and allow your computer to reboot.
• After the reboot, a log (AdwCleaner[C0].txt) will open. Copy the contents of the log and paste in your next reply.
  – File, folder and registry backups are made for items removed using this programme. Should a legitimate file, folder or registry item be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[S0].txt.
  
  ~~~~~~~~~~~~~~~~~``
  
  Please download Junkware Removal Tool
  or from here http://downloads.malwarebytes.org/file/jrt
  to your desktop.
• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.
  
  ~~~~
  
  
  Zemana AntiMalware Free
  
  download it from here:
  
  
  Double-click on the file named Zemana.AntiMalware.Portable to perform a system scan with Zemana AntiMalware Free.
  
  
  You may be presented with a User Account Control dialog asking you if you want to run this program. If this happens, you should click Yes to allow Zemana AntiMalware to run.
  
  When Zemana AntiMalware starts, click on the Scan button to perform a system scan.
  without changing any options, press Scan
  
  
  When Zemana has finished finished scanning it will show a screen that displays any malware that has been detected. To remove all the malicious files, click on the Next button.
  
  Zemana AntiMalware will now start to remove all the malicious programs from your computer.
  
  Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
• open Zemana AntiMalware again and locate the latest report
• please paste the contents into your reply
• 
  When the process is complete, you can close Zemana AntiMalware
• ~~~
  
  please post
  Fixlog.txt
  AdwCleaner[C0].txt
  JRT.txt
  Zemana AntiMalware log

Hi Juliet,

Here's the results of the scans: