Infected? Computer loads slow

Task: {44D20CDC-9193-4FCF-A597-62B18DD8B9F7} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe
Is the above a left over tool from an uninstalled application?

~~~~~~~~~
Remove/uninstall all versions of Java 8 Update => EXCEPT Java 8 Update 221

~~~~~~~~~~~~~~~~~~~~~~~~~
TeamViewer 14 (HKLM-x32\…\TeamViewer) (Version: 14.4.2669 - TeamViewer) <==Always make sure this app is closed when not in use.


~~~~~~~~~~~~~~~~~~~~~~~~~~
I see you have peer-to-peer (P2P) file sharing software installed on your computer (uTorrent). I advise you avoid P2P file sharing programmes; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infected and infested with malware - worms, backdoor Trojans, IRCBots, and rootkits propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. The best way to reduce the risk of infection is to avoid these types of web sites and not use P2P applications. Please read the following articles for more information.

• Risks of File-Sharing Technology
• P2P Software User Advisories
• More malware is traveling on P2P networks these days

~~~~~~~~~~~~~~~~~~~~~~~~~`

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-2a387757
HKU\S-1-5-21-1826707760-3927084271-1880221454-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-2a387757
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> No File
BHO-x32: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> No File
FirewallRules: [UDP Query User{66ED37AD-15CC-4E5E-829B-FCFAEAA717B0}C:\program files\firestormos-releasex64\slvoice.exe] => (Block) C:\program files\firestormos-releasex64\slvoice.exe No File
FirewallRules: [TCP Query User{5F37C2FE-BBF6-4A4D-A68D-0D2FDCEC6C50}C:\program files\firestormos-releasex64\slvoice.exe] => (Block) C:\program files\firestormos-releasex64\slvoice.exe No File
EmptyTemp:
C:\Windows\Temp\*.*
End::

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[external image: zcMPezJ.png]AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
  [external image: RQKuhw1.png]RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply
  created by Aura
  
  
  Please post these 3 logs when finished.

If you're already running Malwarebytes 3 then open Malwarebytes and check for updates.

Then click on the Scan tab and select Threat Scan and click on Start Scan button.
If you don't have Malwarebytes 3 installed yet please download it from here and install it.
Here


If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the Reports tab.
Double-click the Scan Log.
At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here.

~~~~~~~~~~~~~~~`

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

Please post these 2 logs when finished.

Also, tell me how the computer is now.

Below are the two logs you requested, thank you for your assistance so far. The boot up speed is quicker then it was and the system running more smoothly now

 

 

The boot up speed is quicker then it was and the system running more smoothly now

This is good.
 

OK

kuwo <== popular video streaming?, has not been good for your machine by the standards we use for scanning for malware/adware.
If you would like to remove all files/folders connected to this let me know and we can attempt to remove all.

What other issues is the computer having now?

yes it is and I would like to remove all the files/folders connected. The computer seems to be running fine now as far as I can comprehend. 

The computer seems to be running fine now as far as I can comprehend

good

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
ShellIconOverlayIdentifiers: [.Akcreed5151] -> {36bc62b1-1ddc-4580-98c0-97ccc3b9f7bd} => C:\Users\user name\AppData\Roaming\kcreed5151\kcreed5151.dll [2016-07-08] (BEIJING KUWO TECHNOLOGY CO.,LTD. -> )
C:\Program Files (x86)\kuwo
C:\Program Files (x86)\kuwo\KWMUSIC2013\bin\KwService.exe
C:\Program Files (x86)\kuwo\KWMUSIC2013\bin\KwMusic.exe
C:\ProgramData\kuwodata\kwmusic2013
C:\PROGRAMDATA\KUWODATA\kwmusic2013
C:\Program Files (x86)\kuwo\KWMUSIC2013\bin\KwMusic.exe
C:\Program Files (x86)\kuwo\KWMUSIC2013\bin\IESandBox.exe
C:\Program Files (x86)\kuwo\KWMUSIC2013\bin\KwService.exe
HKLM-x32\…\Run: [kwmusic] => C:\Program Files (x86)\kuwo\KWMUSIC2013\Kwmusic.exe
EmptyTemp:
C:\Windows\Temp\*.*
End::

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Computer still good?

Still seeing anything related to kuwo\KWMUSIC2013?

Computer is still loading good at bootup/startup. I don't see anything  related to kuwo any longer. Can we remove the Norton that was leftover which was posted in your original reply now?

 

Task: {44D20CDC-9193-4FCF-A597-62B18DD8B9F7} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe

Computer is still loading good at bootup/startup. I don't see anything  related to kuwo any longer. Can we remove the Norton that was leftover which was posted in your original reply now?
 
Task: {44D20CDC-9193-4FCF-A597-62B18DD8B9F7} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe

I forgot

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
Task: {44D20CDC-9193-4FCF-A597-62B18DD8B9F7} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe
EmptyTemp:
C:\Windows\Temp\*.*
End::

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.

That should be it.

Next step is to remove tools with quarantine folders.

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• – This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

**********

Now let's remove tools and quarantine folders.

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• – This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

******

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
• [external image: EG85Vjt.png] Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• [external image: 6YRrgUC.png] Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• [external image: jv4nhMJ.png] NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• [external image: DgW1XL2.png] Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• [external image: j1OLIec.png] SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• [external image: sHjS79L.png] Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.

I have run the Delfix and it removed all the files on Desktop. I am unable to delete the EEK folder as it tells me the epp.sys is in use in the bin64 folder. This was from the Emisoft Emergency Kit and I decided to keep MBAM