com has mind of its own [Solved]

Hello kitzie and welcome to WTT.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please complete these tasks in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan Now
• when it has finished, leave everything that was found checked, (ticked), then click on Clean and Repair
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Malwarebytes Anti-Malware

Please download and run the installer for Malwarebytes 3.0.

• follow the prompts to install the program, (Malwarebytes 3.0 will automatically upgrade Malwarebytes Anti-Malware 2.x to Malwarebytes 3.0)
  • Launch Malwarebytes Anti-Malware
  • a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
• click Finish.
• on the Dashboard, click Update Now
• after the update completes, click the Scan Now' button.
• if an update is available, clicking the Update Now button will update it
• a Threat Scan will begin.
• when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
• when the prompt to restart the computer appears, click Yes.
• after the restart once you are back at your desktop, open MBAM once more
• click on the ‘History’ tab, the ‘Application Logs’
• double-click on the scan log which shows the date and time of the scan just performed.
• click Copy to Clipboard
• please paste the contents of the clipboard into your reply.

Logs to include with the next post:

AdwCleaner log
Mbam.txt

Thanks

Satchfan

here are the logs 

   Malwarebytes

Thanks for the logs.

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer and close all running programs before you run this scan!

Download RogueKiller to your desktop

• for Windows Vista/7/8/10, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• click on Scan then Start under ‘Standard Scan (recommended)’
• when it has finished, click on Results
• click on Report
• click Open and then select text file
• save the file to your Desktop as RKreport.txt
• copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

Satchfan

RogueKiller Anti-Malware V13.3.2.0 (x64) [Jul 15 2019] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits
Started in : Normal mode
User : richard [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Signatures : 20190718_182943, Driver : Loaded
Mode : Standard Scan, Scan – Date : 2019/07/19 19:14:21 (Duration : 00:23:20)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
>>>>>> O4 - Run
  [Tr.Kovter (Malicious)] (X64) HKEY_USERS\S-1-5-21-441904776-594677368-125994074-1001\Software\Microsoft\Windows\CurrentVersion

\Run||ayjqynct – "C:\Windows\system32\mshta.exe" javascript:uTw1jYvh="6qNcFP";Yb67=new%20ActiveXObject

("WScript.Shell");i6QpJFt="5KP1uU";xE2hY0=Yb67.RegRead("HKCU\\software\\lwtp\\lvheg");q42IEnR="s";eval(xE2hY0);Wjuje12="RB";

(missing) -> Found
  [Tr.Kovter (Malicious)] (X64) HKEY_USERS\S-1-5-21-441904776-594677368-125994074-1001\Software\Microsoft\Windows\CurrentVersion

\Run||xfhb – "C:\Users\richard\AppData\Local\2b9a\f2dc.54bc6" -> Found

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[Tr.Kovter (Malicious)] (file) c721.5fa43 – C:\Users\richard\AppData\Roaming\ed4b\c721.5fa43 -> Found
[Tr.Kovter (Malicious)] (file) f2dc.54bc6 – C:\Users\richard\AppData\Local\2b9a\f2dc.54bc6 -> Found
[Tr.Kovter (Malicious)] (file) 896c.bat – C:\Users\richard\AppData\Local\d3e1\896c.bat -> Found
[Tr.Kovter (Malicious)] (file) 51bf.5fa43 – C:\Users\richard\AppData\Local\d3e1\51bf.5fa43 -> Found

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
>>>>>> Firefox Config
  [PUM.SearchEngine (Potentially Malicious)] browser.search.selectedEngine (C:\Users\richard\AppData\Roaming\Mozilla\Firefox

\Profiles\rhtphmuc.default\prefs.js) – Ask Web Search -> Found
 

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

• close all programs
• double-click RogueKiller.exe - Windows 7/8//10: right-click the program and select Run as Administrator'
• click on Start Scan
• when the scan is finished press Remove Selected and post the log it produces.

Please then run it again and send the new log

================================================

Run Malwarebytes AntiRootkit

Please download Malwarebytes Anti-Rootkit (MBAR) from here and save it to your desktop.

• double-click Mbar and choose to extract it also to your desktop
• Next, and then on the Update button to let it update its database. Once the database has been successfully updated, click on Next
• click on the Scan button
• jf malware is found, do NOT press the ‘Cleanup’ button when the scan completes, click EXIT.
• please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt
• if there is no malware found, please let me know as well.

Satchfan

found 4 malware.

I think we’re getting there.

Malwarebytes Anti-Rootkit Beta

• run Malwarebytes Anti-Rootkit Beta again
• once the scan is finished, make sure that every item is checked, and click on the Cleanup button (a reboot might be required)
• after that (and the reboot, if one was required), go back in the mbar folder and look for a text file called mbar-log-TODAY'S-DATE.txt
• copy/paste the content of that log in your next reply.

================================================

Run Malwarebytes Anti-Malware

Please reboot in Safe Mode and run Malwarebytes Anti-Malware again.
run the program

• click on the ‘Dashboard’ to make sure everything is up to date, (it is not necessary to upgrade to the premium version of MBAM)
• click on the ‘Scan’ tab, (directly below the Dashboard tab)
• select the Threat Scan option
• slick the Scan Now button
• Threat Scan will begin
• when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
• if prompted to restart the computer, close all other programs and click Yes to restart your computer
• once you are back at your desktop, open MBAM once more
• click on the ‘Reports’ tab
• double-click on the most recent Scan Report
• click on Export, then Copy to Clipboard

Please paste the contents of the clipboard into your next reply to me together with the mbar-log-TODAY'S-DATE.txt log.

Satchfan

I did not see the part about running the RogueKiller again    I just did the malware anti*rootkit.   So do I need to go back and do that whole step again?

No, just run RogueKiller again to remove what was found and then post the three logs:

Malwarebytes log

Anti-Rootkit log

RogueKiller log.

Satchfan

here are the logs

Unfortunately, the RogueKiller log was one that was run prior to both of the Malwarebytes programmes. I don't think anything will be left but to be sure, please could you run Roguekiller again and post the new log.

Thanks

Satchfan

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

• close all programs
• double-click RogueKiller.exe - Windows 7/8/10: right-click the program and select Run as Administrator'
• click on Start Scan
• when the scan is finished, click on Remove Selected:

Please then run it again and send the new log

================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

New RogueKiller log
New Frst.txt
New Addition.txt

Thanks

Satchfan