No malware but some adware and programmes that need to go.
Uninstall programmes
Please uninstall these programmes:
Ad-Aware Antivirus
AdAwareInstaller
AdAwareUpdater
AntimalwareEngine
ESET Online Scanner v3
Java, (any version present)
Popcorn Time
===================================================
You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.
- go to C:\Users\Phil\Desktop\Temp\What the Tech and locate Farbar Recovery Scan Tool
- right click and select Cut
- go to an empty spot on your desktop, right click and select Paste
Farbar Recovery Scan Tool should now be on your desktop.
================================================
Run Farbar Recovery Scan Tool
- right-click FRST/FRST64 and select ‘Run as administrator’
- highlight the contents of the code box below, then press Ctrl+c):
Start::
CloseProcesses:
SearchScopes: HKU\S-1-5-21-2352554253-1179582315-1634381772-1001 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&o=APN11913&l=dis&prt=NSBU&chn=1000&geo=US&ver=22.11.0.41&locale=en_US&guid=25E71708-1921-404C-BB29-AF65E142FC2F&doi=2016-09-01&gct=kwd&qsrc=2869
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security with Backup\Engine\22.11.2.7\Exts\Chrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [jeaohhlajejodfjadcponpnjgkiikocn] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <not found>
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security with Backup\Engine\22.11.2.7\Exts\Chrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
S2 HPSLPSVC; C:\Users\Phil\AppData\Local\Temp\7zS2CDA\7zS7B5D\hpslpsvc64.dll [X] <==== ATTENTION
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security with Backup\NortonData\22.5.5.15\Definitions\SDSDefs\20160713.021\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security with Backup\NortonData\22.5.5.15\Definitions\SDSDefs\20160713.021\EX64.SYS [X]
S3 semav6msr64; \??\C:\WINDOWS\system32\drivers\semav6msr64.sys [X]
S3 semav6thermal64ro; \??\C:\WINDOWS\system32\drivers\semav6thermal64ro.sys [X]
2013-01-09 23:46 - 2014-07-26 13:48 - 000139264 _____ () C:\Users\Phil\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-22 21:10 - 2015-02-22 12:07 - 000000600 _____ () C:\Users\Phil\AppData\Local\PUTTY.RND
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ContextMenuHandlers2: [AdAwareContextMenu] -> {5B64240D-5B36-4B9F-A75F-4925B6A53D5B} => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareShellExtension.dll [2015-08-27] ()
ContextMenuHandlers3: [AdAwareContextMenu] -> {5B64240D-5B36-4B9F-A75F-4925B6A53D5B} => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareShellExtension.dll [2015-08-27] ()
2015-08-27 14:57 - 2015-08-27 14:57 - 009558752 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareTray.exe
2015-08-27 14:57 - 2015-08-27 14:57 - 003549904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\RCF.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000123656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\boost_filesystem-vc120-mt-1_57.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000025856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\boost_system-vc120-mt-1_57.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000057096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\boost_date_time-vc120-mt-1_57.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000107776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\boost_thread-vc120-mt-1_57.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000492288 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\boost_locale-vc120-mt-1_57.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000035072 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\boost_chrono-vc120-mt-1_57.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 002266344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\HtmlFramework.dll
2015-08-27 14:57 - 2015-08-27 14:57 - 000868600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareTrayDefaultSkin.dll
FirewallRules: [{17195728-65BA-42F9-8299-936B29B3FC95}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{3CAB3B7D-F73D-4C73-86FA-534BD828502D}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{E97C30FF-BFE5-4124-A9BA-3CD1F37A4489}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{A816A32D-EAFA-4BFF-AA6F-E12BD9774CA9}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{59E3ACD3-4E7E-437A-A7AC-07646AF9BD98}] => (Allow) C:\Users\Phil\AppData\Local\Temp\7zS2CDA\7zS7B5D\hppiw.exe
FirewallRules: [{63424CF4-5122-4ACF-BF08-DD12D4D7A6FE}] => (Allow) C:\Users\Phil\AppData\Local\Temp\7zS2CDA\7zS7B5D\hppiw.exe
C:\Users\Phil\AppData\Local\Temp\7zS2CDA\7zS7B5D\hpslpsvc64.dll
C:\Program Files\Lavasoft
C:\Program Files (x86)\Popcorn Time
C:\Users\Phil\AppData\Local\Temp\7zS2CDA\7zS7B5D\hppiw.exe
EmptyTemp:
End::
NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
- in the FRST window, press the ‘Fix’ button once and wait
- please reboot the computer if requested
- it will create a log on your desktop, (Fixlog.txt); please post it to your reply.
===================================================
Download and run AdwCleaner
Download AdwCleaner from here and save it to your desktop.
- run AdwCleaner by clicking on Scan
- when it has finished, leave everything that was found checked, (ticked), then click on Clean
- if it asks to reboot, allow the reboot
- on reboot a log will be produced; please attach the content of the log to your next reply.
===================================================
Download and run Junkware Removal Tool
Please download Junkware Removal Tool to your desktop.
- shut down your protection software now to avoid potential conflicts.
- run the tool by double-clicking it. If you are using Windows Vista/7/8/10, instead of double-clicking, right-mouse click JRT.exe and select ‘Run as Administrator’
- the tool will open and start scanning your system
- please be patient as this can take a while to complete depending on your system's specifications
- on completion, a log (JRT.txt) is saved to your desktop and will automatically open
- post the contents of JRT.txt into your next message.
===================================================
Run Malwarebytes Anti-Malware
Please download and run the installer for Malwarebytes 3.0.
- follow the prompts to install the program, (Malwarebytes 3.0 will automatically upgrade Malwarebytes Anti-Malware 2.x to Malwarebytes 3.0)
- at the end, be sure a checkmark is placed next to the following
- Launch Malwarebytes Anti-Malware
- a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
- click Finish.
- on the Dashboard, click Update Now
- after the update completes, click the Scan Now' button.
- if an update is available, clicking the Update Now button will update it
- a Threat Scan will begin.
- when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
- when the prompt to restart the computer appears, click Yes.
- after the restart once you are back at your desktop, open MBAM once more
- click on the ‘History’ tab, the ‘Application Logs’
- double-click on the scan log which shows the date and time of the scan just performed.
- click Copy to Clipboard
- please paste the contents of the clipboard into your reply.
Logs to include with the next post:
Fixlog.txt
AdwCleaner log
JRT.txt
Mbam.txt
Thanks
Satchfan
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
This topic is locked
aswMBR.txt 1.78KB
375 downloads
