Infected PC acting weird

I found both AVG\Antivirus and Norton Internet Security on the computer.
Both appear to be running at the same time which is kinda bad news. Norton itself at times can be a resources hog with AVG having it's own issues over system slow downs.
Using 2 antivirus Causes conflicts, negatively impacting the effectiveness of each Anti-Virus installed.
Trigger false-positives.
Trigger false-negatives, where neither programme detects malware.
Cause system instability/performance issues. Your system may lock up or slow down due to both software attempting to access the same file at the same time.

With some of the items I found in your logs I'm surprised to see you were able to download them and they remain workable.

Make a decision which to keep and which one to uninstall,

****

Located in your Add/Remove programs list, the below needs to be deleted/uninstalled.

Catalina Savings Printer (HKLM-x32\…\{37331C16-3E97-4A20-80D8-BFB43AB0E2FB}) (Version: 1.0.0 - Catalina Marketing Corp) <==== ATTENTION
Catalina Savings Printer (HKLM-x32\…\{4956ACE3-F537-4418-BB45-FD52395275A7}) (Version: 1.0.0 - Catalina Marketing Corp) <==== ATTENTION
CouponPrinterPlugin (HKLM-x32\…\{8AC6566B-131F-4987-82DF-932CED9FCA23}) (Version: 2.0.2.0 - Hopster) <==== ATTENTION



**

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
C:\Program Files (x86)\Digital Coupon Printer\DigitalCouponPrinter.exe
C:\Program Files (x86)\Digital Coupon Printer
C:\Users\Barley\AppData\Roaming\ShopAtHome.com BrowserAppCore Service\ShopAtHome_BAC_Service.exe
C:\Users\Barley\AppData\Roaming\ShopAtHome.com BrowserAppCore Service
HKLM-x32\…\Run: [Digital Coupon Print Driver] => C:\Program Files (x86)\Digital Coupon Printer\DigitalCouponPrinter.exe [90048 2015-09-22] (Inmar, Inc.)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.coupons.com/
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM -> {F8E29CD1-3CFA-4356-AB1F-1E4764BF30F5} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-632860548-1775735820-415820443-1000 -> {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} URL = hxxps://www.amazon.com/gp/bit/amazonserp/ref=bit_bds-p10_serp_ie_us_display?ie=UTF8&tagbase=bds-p10&tbrId=v1_abb-channel-10_d088afc8_1201_1401_20160524_US_ie_ds_&tag=bds-p10-serp-us-ie-20&query={searchTerms}
SearchScopes: HKU\S-1-5-21-632860548-1775735820-415820443-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_191\bin\ssv.dll [2018-12-01] (Oracle Corporation)
BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28] (Yahoo! Inc)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
CHR HomePage: Profile 1 -> hxxp://www.search.ask.com/?gct=hp
R2 HPSLPSVC; C:\Users\Barley\AppData\Local\Temp\7zS0674\hpslpsvc64.dll [1039360 2012-08-27] (Hewlett-Packard Co.) [File not signed] <==== ATTENTION
U3 aswMBR; \??\C:\Users\Barley\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\Barley\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION
2006-10-28 00:28 - 2006-10-28 00:28 - 000145184 ____R (Microsoft Corporation) C:\Users\Barley\AppData\Local\Temp\ose00000.exe
CustomCLSID: HKU\S-1-5-21-632860548-1775735820-415820443-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Barley\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-632860548-1775735820-415820443-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Barley\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-632860548-1775735820-415820443-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Barley\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-632860548-1775735820-415820443-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Barley\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-632860548-1775735820-415820443-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Barley\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => No File
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
Task: {1820F1F2-07DE-4C3F-996F-0B89A5A39544} - System32\Tasks\Reset ShopAtHome BAC => C:\Users\Barley\AppData\Roaming\ShopAtHome.com BrowserAppCore Service\SahProcessManager.exe [2013-08-26] (ShopAtHome.com)
Task: {D71AB59B-68FD-484B-A9A0-22955D183C18} - System32\Tasks\{AC99B250-78CB-4E6E-B667-70C074C519ED} => C:\windows\system32\pcalua.exe -a "C:\Users\Barley\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QC9P1FVT\JavaSetup8u91 (1).exe" -d C:\Users\Barley\Desktop
ShortcutWithArgument: C:\Users\Barley\Desktop\Chris - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 3"
ShortcutWithArgument: C:\Users\Barley\Desktop\Erica - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\Barley\Desktop\ie11 RWW (Remote Web Workplace) Connect to Computer - Spiceworks.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –app=hxxp://community.spiceworks.com/topic/358500-ie11-rww-remote-web-workplace-connect-to-computer
ShortcutWithArgument: C:\Users\Barley\AppData\Local\Google\Chrome\User Data\Default\Web Applications\community.spiceworks.com\http_80\ie11 RWW (Remote Web Workplace) Connect to Computer - Spiceworks.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –app=hxxp://community.spiceworks.com/topic/358500-ie11-rww-remote-web-workplace-connect-to-computer
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ie11 RWW (Remote Web Workplace) Connect to Computer - Spiceworks.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –app=hxxp://community.spiceworks.com/topic/358500-ie11-rww-remote-web-workplace-connect-to-computer
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\mydlink services plugin.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1" –app-id=ldibdoepbjbkkcbgndfljnphngpglhbb
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Erica - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1"
C:\Windows\Temp\*.*
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[external image: zcMPezJ.png]AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

*******
[external image: RQKuhw1.png]RogueKiller

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply

*****
created by Aura


Please post these 3 logs when finished.

My goodness, look what those tools found.

First, let me give you some info for antivirus and anti-malware programs.

Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-Virus

• 🖼Click to load external image (sZQBUGE.png)Sophos Home
• 🖼Click to load external image (GCZb0TR.png)Bitdefender Free Antivirus
• 🖼Click to load external image (1lXc99W.png)Emsisoft Anti-Malware - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection
• 🖼Click to load external image (szLrBjg.png)Avira Free Antivirus
• 🖼Click to load external image (90ChiEw.png)avast! Free Antivirus

Anti-Malware

• 🖼Click to load external image (j1Bynr2.png)Malwarebytes - Has both a free and paid version. The Premium version of Malwarebytes also offers Exploit and Ransomware protection, for a complete package of: Malware, Web, Exploit and Ransomware protection
• 🖼Click to load external image (S2NFpNw.png)HitmanPro 3 - Free 30 day trial
• 🖼Click to load external image (ncqvIpu.png)Zemana AntiMalware - Free 30 day trial

~~~
created by Aura


~~~~~
Why the computer booted to a different screen then usually, I don't know. Could be setting were altered with something that was removed but we can try to deal with that latter.


In the RogueKiller log I can see 'Found', did you let it delete and quarantine?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let's check for remnants

If you're already running Malwarebytes 3 then open Malwarebytes and check for updates.
Then click on the Scan tab and select Threat Scan and click on Start Scan button.
If you don't have Malwarebytes 3 installed yet please download it from here Here and install it.
Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here

• Then click on POST
• Exit Malwarebytes

~~~~~~~~~~~~

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

Please post these 2 logs when finished.

Also, tell me how the computer is now.

Hi again:

 

  A few quick things first . . .

 

   Yes I did let the RogueKIller delete the Found items - just to be sure, I just ran it again and it came up clean.

   (also, another quick question - most of these scans quarantine everything when done, but I've gone the next step and deleted them as well - is that what I'm supposed to do, or is just quarantining them adequate?)

 

   (And I think that leftover Catalina Printer thing is just a remnant of the program, I've tried a couple of Uninstallers and even did regedit, but still can't get rid of it - I'd like to see it completely gone - saw something about going into Safe Mode to try something, but not sure if that will work either.)

 

   Last, the computer did boot up normally this AM, so hopefully whatever caused that is fixed - and that had happened just before I posted here, so it probably wasn't anything that was removed, but will watch that to see if it happens again.

 

    I uninstalled my Malwarebytes, and re-installed the version 3 you sent (which was the same one I had), and the Report is pasted below, along with the EEK report (it didn't ask me to re-boot when done) and I quarantined and deleted the ?Trojan that it found.

   Finally, the computer seems to be running quite cleanly now.

 

Thanks again.

 

Malwarebytes

 

 

 

  EEK

 

Emsisoft Emergency Kit 2018.6.0.8742 stable [en-us]

Quote
 
most of these scans quarantine everything when done, but I've gone the next step and deleted them as well - is that what I'm supposed to do, or is just quarantining them adequate?)

Quarantine is fine,  we'll use a tool at the end to remove tools and quarantine folders. So dont worry over that.
 

Quote
 
And I think that leftover Catalina Printer thing is just a remnant of the program, I've tried a couple of Uninstallers and even did regedit, but still can't get rid of it - I'd like to see it completely gone

We can use FRST to do a search for this.
 

Quote
 
Last, the computer did boot up normally this AM, so hopefully whatever caused that is fixed - and that had happened just before I posted here, so it probably wasn't anything that was removed, but will watch that to see if it happens again.

 I got my fingers crossed it doesn't happen again.
 

Quote
 
Finally, the computer seems to be running quite cleanly now.

 
Your my favorite person today! Music to my ears.
 
~~~~~~~~~~~~~~~~~~~~~~~~~
you have Chrome Sync enabled?
Follow the below link to reset this.
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

~~~~~~~~~~~~~~~~~~~~~~~~

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)
type the following text in the Search box
Catalina

Click the Search Files button.

When finished, a log file (Search.txt) will open and is saved where FRST was run from, on the Desktop.

Please post that log in your next reply.

Hi Juliet:

 

     I think I jinxed the good roll we were out - doesn't look like anything came up with the FRST Search for Catalina.

    I did the Chrome Synch thing the way the Belgium lady said (I think), and nothing came up on Malwarebytes (except the 2 items that keep coming up - can't get rid of those either) or the FRST Search, unless I did something wrong.

 

    Otherwise everything is still going fine.

 

I've posted both the Malwarebytes and FRST Search logs below.

 

Thanks for your time again.

 

 

Malwarebytes

 

 

FRST

 

 

On that page did you try option 2 by Aura?
Please check for me.
~~~~~~~~~~~~~~~~

Im listing a few Google extensions I'd like you to look for then try to uninstall/delete
The link below should show you how to do this
https://support.google.com/chrome_webstore/answer/2664769?hl=en

CHR Extension: (AVG SafePrice |
CHR Extension: (Savings Button: Deals + Cash Back) -
CHR Extension: (AVG SafePrice | Comparison, deals, coupons)
CHR Extension: (CouponXplorer) -

Next, look in your add/remove programs list for a few things to uninstall

Please uninstall the following programs:

Digital Coupon Printer
ShopAtHome.com Helper
Bing Bar
Catalina Savings Printer
Catalina Savings Printer
Coupon Printer for Windows
CouponPrinterPlugin
PrintMyCouponAnywhere
QponPrinter 1.0.1
QponPrinterV2 1.0.3
RevTraxPrintMyCoupon

Might not find them all, but what you do find please uninstall, then, reboot your computer.

Next
run another scan using Malwarebytes Anti-Malware and post this log for me to see.

Good morning:

 

    I'm sorry, I didn't initially try Aura's option 2, but did just try it this AM. 

   I don't think much changed with it, and I've also posted the AdwareCleaner report that I did after trying it.

 

   I deleted those Google Chrome extensions that you mentioned, and unistalled those programs you asked to be removed (except still can't remove the one Catalina thing).

   The Malwarebytes scan comes up the same - that's posted below as well.

 

   (and just to check, while deleting those Chrome Extensions, I saw one called "ViewMyPDF ads" which had a red exclamation point and said it might be corrupted - wasn't sure if I should delete/repair it or just leave it alone - wasn't sure if it's related to anything.)

 

Thanks again.

 

AdwCleaner

 

 

Malwarebytes

 

Malwarebytes

I can see the AdwCleaner scan and log but it says Not Deleted?

 

I saw one called "ViewMyPDF ads" which had a red exclamation point and said it might be corrupted - wasn't sure if I should delete/repair it or just leave it alone - wasn't sure if it's related to anything

I'd remove that as well.

 

After removing those extensions did you reboot the computer?

Run a new scan with FRST

• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  
  

am I doing something wrong with that?

Might be

Let the scan complete. Once it's done, make sure that every item listed has a checked mark next to it and click on the Clean & Repair button. This will kill all the active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it

Is that what you followed?

I'm pushed for time at the moment might be quite a while before I can get back, I'll wish you a Merry Christmas now

Yes, I've been checking the boxes - but nothing gets deleted for some reason.

I just tried stopping the AVG to see if that made a difference but it didn't.

Also reinstalled the AdwCleaner.

 

But the computer is running fine, so I'm okay for now.

Have a nice Holiday and let me know if you have any other tricks up your sleeve when you get back - but no hurry!

 

Thanks again for your time.