Infected after installing what I thought was a programme.

📎FRST.txtI installed what I thought was a noise reducing programme for video, anyway it seems it was a trojan and some sort of marketing programme called edlin.exe, it has corrupted some windows files, which I hope someone here can help me restore. I think I've got rid of most of it, but I ran a copy of Hijackthis that I had on my computer and this is the log that it's come up with. 

Hope someone can help so I don't have to do a reinstall. Says I cannot upload the hijackthis log file type.

Just downloaded rogue killer and its found a copy of edlin and a file called racetrack.exe, both have the letters atb after them.

I couldn't attach the MBR log file because when I try to run it it gives me the blue screen of death.

I would like to see the RogueKiller log please

see if you can locate it here
C:\ProgramData\RogueKiller\Logs\RKreport_DEL_mmddyyyy_hhmmss.log

~~

Did you at one time have or still have on the computer Trend Micro
I see several entries for this and I can see that you have Adaware antivirus.

This could pose a problem with resources ….not sure what type of service the Trend Micro package you have provides at this time.

~~~~~~~~~~~~~~~~`

racetracks.exe ,– I see several entries for this located in the task folder, little to no info on the net as to what it can be.
I have those items listed to be removed in the script below.  If this is a game you have downloaded,  probably will have a few function errors.

~~~

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
CustomCLSID: HKU\S-1-5-21-1528506052-2099023066-864732213-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-1BA683D7399C}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
ContextMenuHandlers1: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => -> No File
ContextMenuHandlers2: [Auslogics Disk Defrag Shell Context Menu 7.x] -> {CC89327D-D094-5D27-82CB-F989EE26FC51} => -> No File
ContextMenuHandlers2: [Auslogics Disk Defrag Shell Context Menu 8.x] -> {CC89327D-D094-89B3-82CB-F989EE26FC51} => -> No File
ContextMenuHandlers2: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => -> No File
ContextMenuHandlers3: [Auslogics Disk Defrag Shell Context Menu 7.x] -> {CC89327D-D094-5D27-82CB-F989EE26FC51} => -> No File
ContextMenuHandlers3: [Auslogics Disk Defrag Shell Context Menu 8.x] -> {CC89327D-D094-89B3-82CB-F989EE26FC51} => -> No File
ContextMenuHandlers4: [Auslogics Disk Defrag Shell Context Menu 8.x] -> {CC89327D-D094-89B3-82CB-F989EE26FC51} => -> No File
ContextMenuHandlers6: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => -> No File
Task: {07525F32-AD20-405F-924D-14A06838A840} - System32\Tasks\gaskeptical_bessskeptical_bess => C:\Users\PC\AppData\Local\racetracks.exe
Task: {22E33CAA-F98D-44AC-AD06-48F4191C379B} - System32\Tasks\tecum-brownian => C:\Program Files (x86)\propulsive\racetracks.exe
Task: {3B682A38-8A27-4D0E-8AC0-168BED4C9A38} - System32\Tasks\skeptical_bess => C:\Users\PC\AppData\Local\racetracks.exe
Task: {44AD686E-B7D8-4D33-AAA5-290708B3B572} - System32\Tasks\gathree slurrythree slurry => C:\Program Files (x86)\Hutchins\racetracks.exe
Task: {5971A6FC-8292-4B02-AF06-2A6A6D54E109} - System32\Tasks\gatecum-browniantecum-brownian => C:\Program Files (x86)\propulsive\racetracks.exe
Task: {6EF69D73-D5E3-4FDB-88F7-06AE13338C71} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {6F26B55A-7F5A-4547-A207-AB991E78A737} - \Auslogics\Disk Defrag\Scheduled Defragmentation -> No File <==== ATTENTION
Task: {A86E6E9B-78EC-4792-AFF0-D08114C03DD3} - System32\Tasks\0615pizUpdateInfo => C:\ProgramData\Avg_Update_0615piz\0615piz_AVG-Secure-Search-Update.exe
Task: {D9D1FA35-8AE8-4752-A222-61A4D9A0F78E} - System32\Tasks\1215avzUpdateInfo => C:\ProgramData\Avg_Update_1215avz\1215avz_AVG-Secure-Search-Update.exe [2015-11-22] ()
Task: {E362C12A-3959-4390-A671-750EBFF72366} - System32\Tasks\three slurry => C:\Program Files (x86)\Hutchins\racetracks.exe
Task: {FCF8F712-D860-4BF9-AF38-56745B8D4EB4} - \Auslogics\Disk Defrag\Start Disk Defrag On PC Logon -> No File <==== ATTENTION
C:\Program Files (x86)\foldershare\uninstaller.exe
C:\Users\PC\AppData\Local\Temp\is-R8J51.tmp\jfk0021.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
GroupPolicyScripts: Restriction <==== ATTENTION
SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1528506052-2099023066-864732213-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-1528506052-2099023066-864732213-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-1528506052-2099023066-864732213-1001 -> {76DEFAE6-09B2-40B2-8F8A-5A6A5D5CE4EB} URL = hxxps://search.yahoo.com/search/?toggle=1&cop=mss&ei=UTF-8&fr=vmn&type=auslog_yaapp1_ch&p={searchTerms}
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO-x32: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
FF user.js: detected! => C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\h30rp1gg.default\user.js [2017-06-30]
S3 esihdrv; C:\Users\PC\AppData\Local\Temp\esihdrv.sys [191664 2018-03-29] (ESET) <==== ATTENTION
2018-03-31 00:10 - 2018-03-13 08:02 - 001954048 _____ (Microsoft Corporation) C:\Users\PC\AppData\Local\Temp\dllnt_dump.dll
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.



******

Let's update and run a scan with MalwareBytes

• Open Malwarebytes is installed, launch it and let it update his database. You might have to click on the little arrow by Scan Status in the middle right pane for it to do so
• Once the database update is complete, click on the Scan tab, then select the Threat Scan button and click on Start Scan
• Let the scan run, the time required to complete the scan depends of your system and computer specs
• Once the scan is complete, make sure that the first checkbox at the top is checked (which will automatically check every detected item), then click on the Quarantine Selected button
  • If it asks you to restart your computer to complete the removal, do so
• Click on Export Summary after the deletion (in the bottom-left corner) and select Copy to Clipboard.
  🖼Click to load external image (1CtdZ26.png)
• Paste the content in your next reply

Here's the Rogue killer report, I'll follow your instructions and paste the reports next.

 

If it's playing some type of advertisement you need to get rid of that.

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
Task: {0F249BFA-E397-4A75-808C-7EAC6DFC78A0} - System32\Tasks\ebrahim fleisch playground => C:\Users\PC\AppData\Local\Edlin.exe
Task: {2A8AC6BA-AF93-419B-B4D0-57BE6172981C} - System32\Tasks\gaebrahim fleisch playgroundebrahim fleisch playground => C:\Users\PC\AppData\Local\Edlin.exe
Task: {9B9857A6-54A0-4081-BD64-FFB86A20B6E5} - System32\Tasks\ganutrianutria => C:\Program Files (x86)\Indefinitely\Edlin.exe
Task: {9FB56627-67DA-40EB-8BB7-944228730C63} - System32\Tasks\fisher_goldfield => C:\Program Files (x86)\Hutchins\Edlin.exe
Task: {C5EDF496-36CF-4ADC-B5FC-96A222815574} - System32\Tasks\gafisher_goldfieldfisher_goldfield => C:\Program Files (x86)\Hutchins\Edlin.exe
Task: {D8BFD21F-1E9F-4F86-AF36-743B0967B6A4} - System32\Tasks\nutria => C:\Program Files (x86)\Indefinitely\Edlin.exe
C:\Users\PC\AppData\Local\Edlin.exe
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~
The RogueKiller log was pretty much unreadable.

Please open RogueKiller and let's get a new scan.

• Please make sure that RogueKiller is located on your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply

~~~~~~~~~~~~~~~~~~~~~~~~~~~

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

created by Aura
~~~

Please post these 3 logs when finished.

Whats the computer doing now?

Use the computer today and let's see if it acts normal.

Then I'll give the all clear and we'll remove tools and quarantine folders.