Infected PC acting weird

I snuck back early

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: No Name -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> No File
FF Plugin HKU\S-1-5-21-632860548-1775735820-415820443-1000: CouponNetwork.com/CMDUniversalCouponPrintActivator -> C:\Users\Barley\AppData\Roaming\CATALI~1\NPBCSK~1.DLL [No File]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll [2015-09-18] (Coupons, Inc.)
CHR NewTab: Profile 1 -> Not-active:"chrome-extension://bkpkokkapfiigghcbhkblnngjlcccckf/index.html", Not-active:"chrome-extension://lpdcomiegbcchfdacgnkemnicebaodne/newtab/newtab.html", Not-active:"chrome-extension://gbioooacocedmkdadhinnkjonienkfbe/stubby.html", Not-active:"chrome-extension://dpgfhhkchdfegbdmjginkcffgjncmboh/stubby.html"
CHR Extension: (Lightspeed User Agent) - C:\Users\Barley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lnidfclfgppmpldkkchcpoegjlcbaekc [2018-12-24] [UpdateUrl: hxxps://lsrelay-extensions-staging.s3.amazonaws.com/chrome_ua/1bf15dff521aff9f15e160f73e7a18ab5206eb1bfa7eb5b71b5d983899285034/UserAgent.xml] <==== ATTENTION
CHR Extension: (AVG SafePrice | Comparison, deals, coupons) - C:\Users\Barley\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\mbckjcfnjmoiinpgddefodcighgikkgn [2018-12-06]
CHR Extension: (AVG SafePrice | Comparison, deals, coupons) - C:\Users\Barley\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\mbckjcfnjmoiinpgddefodcighgikkgn [2018-12-06]
C:\Documents and Settings\user\Application Data\Catalina Print Savings
C:\Documents and Settings\user\Application Data\Catalina Print Savings\npBcsKtTcHW.dll
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Destiny Discover.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1" –app-id=bbhkckkafippkgeicobhgafkioeblebh
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\ScanQR.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1" –app-id=nihhbejdflkeingkkpakffdlmepaeaah
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Vernier Graphical Analysis.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1" –app-id=dncgedbnidfkppmdgfgidcepclnokpkb
ShortcutWithArgument: C:\Users\Barley\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Erica - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1"
FirewallRules: [{FBECA0C4-4012-4779-9914-18054013DF61}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe No File
FirewallRules: [{B51D41D8-9002-424B-96AE-995272DF678E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe No File
FirewallRules: [{FD780D56-F9B3-4CAA-9DFE-753F355A2B42}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe No File
FirewallRules: [{EF53A754-678A-4A38-A8F1-2CA43185FD29}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe No File
FirewallRules: [{37A40D7C-152E-4165-9107-66247F5ECEE8}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe No File
C:\Windows\Temp\*.*
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NEXT

Start FRST and type the following text in the Search box

 

ShopAtHome;PrintMyCouponAnywhere;DigitalCouponPrinter.exe;Catalina Savings Printer

Click the Search Files button.

When finished, a log file (Search.txt) will open and is saved where FRST was run from, on the Desktop.

Please post that log in your next reply.

Search.txt Log

Just an update - I ran the Malwarebytes malware since the last reply, and it detected 294 items, which were quarantined and I haven't had any pop-ups since! Looks like a lot of those were form those Google Chrome extensions which I had previously deleted - but I think they came back when I tried the Synch thing again, and I've since deleted them again.

 

Not sure if you need it, but I posted the Malwarebytes log below.

 

Merry Christmas!

 

Just an update - I ran the Malwarebytes malware since the last reply, and it detected 294 items, which were quarantined and I haven't had any pop-ups since! Looks like a lot of those were form those Google Chrome extensions which I had previously deleted - but I think they came back when I tried the Synch thing again, and I've since deleted them again.

Well now, this is sounding much better.

I think the whole problem has been Chrome.
I feel like we can save bookmarks and all then uninstall it then try maybe a reinstall?
 
Then if that doesn't work we can use a tool to go after it.

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.
[external image: U5NwUGc.png]Backup Chrome Bookmarks

Proceed with the reset once done.
[external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on Catalina Savings Printer to remove
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

Let's see if by resetting Google Chrome thats taken care of.

Eureka!

Was a bit nervous about doing those 2 things, but it looks like the Revo Uninstaller got rid of the Catalina thing finally - that's a pretty neat tool!

Looks like everything is working okay.

I haven't done another Adwcleaner scan to see if those things keep showing up - but let me know if anything else needs to be done.

Thanks and Merry Christmas!

 

Well, after my large glass of special Christmas juice I say, good gosh don't poke the bear!

I think, before doing or following any other instructions, reboot the computer and let's see if anything out of the ordinary happens.

Eureka!<== love that word.

Yeh, not sure where that Eureka came from - just sort of came out!

And whatever that is you're drinking, it seems to be working!

 

Have rebooted and done some surfing around and don't see any issues as of yet, and good ole Catalina is nowhere to be found!

And all the Chrome bookmarks and everything seem to be there.

 

I haven't done any scans or anything as of yet - as you said, don't want to get overly optimistic.

I guess I mainly want to make sure this doesn't happen again - I know you gave some suggestions earlier, but if you had any favorites you think I should install for good security, I'm open to any and all suggestions.

 

Thanks so very much again, and for working on Christmas!

 

 

 

I can list several things about security and preventive tips. What I say to people is they have to find or experiment with what works best for them and their computer.

Originally you had AVG\Antivirus and Norton Internet Security on the computer, both are somewhat big packages that could had brought the computer to a crawl.
My opinion is it lessened your security and allowed items in that should had been caught but wasn't.

If you should happen to install a Free antivirus make sure to keep windows Firewall enabled.

Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-Virus

• 🖼Click to load external image (sZQBUGE.png)Sophos Home
• 🖼Click to load external image (GCZb0TR.png)Bitdefender Free Antivirus
• 🖼Click to load external image (1lXc99W.png)Emsisoft Anti-Malware - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection
• 🖼Click to load external image (szLrBjg.png)Avira Free Antivirus
• 🖼Click to load external image (90ChiEw.png)avast! Free Antivirus

Anti-Malware

• 🖼Click to load external image (j1Bynr2.png)Malwarebytes - Has both a free and paid version. The Premium version of Malwarebytes also offers Exploit and Ransomware protection, for a complete package of: Malware, Web, Exploit and Ransomware protection
• 🖼Click to load external image (S2NFpNw.png)HitmanPro 3 - Free 30 day trial
• 🖼Click to load external image (ncqvIpu.png)Zemana AntiMalware - Free 30 day trial

~~~
created by Aura

~~~
Ready to remove tools and quarantine folders?

Thanks for the Anti-virus suggestions Juliet, and I agree that trial and error is the best way to go.

I'll do some research on those and pick one soon.

 

And ready to start removing things!

 

 

Thanks. 

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• – This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

******************

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
• [external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• [external image: 6YRrgUC.png]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• [external image: jv4nhMJ.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• [external image: DgW1XL2.png]Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• [external image: sHjS79L.png]Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.

Hi Juliet:

 

  Thanks again for all the suggestions and links.

I'm going to be out of town for a few days so I won't be able to work on things until the weekend.

I'll clean up those files when I return, so I'll give you a break for a few days!

 

Thanks so much again for all your help!

We're glad to help.

Happy New Year Juliet!

 

    I'm ready to start deleting things.

    I ran the DelFix file, and deleted the leftovers on my Desktop (although some I can't delete).

 

    The computer is still running fine, and I'm still looking at the various anti-virus programs to use.

Anything else left to do?

 

Thanks again!

 

    

    

Read over preventive tips and your good to go.

Sounds good Juliet.

It looks like the things that didn't delete with DelFix did delete after rebooting.

 

Thanks again for everything and have a Happy and Healthy New Year!