Slow laptop, Malware removal needed [Closed]

Hi

I believe my Windows 8 laptop is highly infected with virus and has malware issues. Your assistance in addressing my concerns will be greatly appreciated.

Thanks

Hello BJ2011 and welcome to WTT.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please complete these tasks in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan Now
• when it has finished, leave everything that was found checked, (ticked), then click on Clean and Repair
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Malwarebytes Anti-Malware

You may have Malwarebytes Anti-Malware installed but if not, you can download it from here:
run the program.

• click on the ‘Dashboard’ to make sure everything is up to date, (it is not necessary to upgrade to the premium version of MBAM)
• click on the ‘Scan’ tab, (directly below the Dashboard tab)
• select the Threat Scan option
• slick the Scan Now button
• Threat Scan will begin
• when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
• if prompted to restart the computer, close all other programs and click Yes to restart your computer
• once you are back at your desktop, open MBAM once more
• click on the ‘Reports’ tab
• double-click on the most recent Scan Report
• click on Export, then Copy to Clipboard

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
Mbam.txt
Frst.txt
Addition.txt

Thanks

Satchfan

Here is a log that came up.

Here is malware report

There are no logs. Please try again to post the AdwCleaner log, Mbam.txt, Frst.txt and Addition.txt.

Here is the Adware log

Thank you but I still need Mbam.txt, Frst.txt and Addition.txt.

Thanks. Now just Frst.txt and Addition.txt.

Percentage of memory in use: 91%

You need to close all unnecessary tabs/programmes and/or get more ram. This, apart from infections, is why your computer is slow.

We can disable some unnecessary startups later but meanwhile, avoid using the Internet except to answer these logs as Windows Defender and Firewall are both disabled at the moment.

===================================================

Uninstall programs

Uninstall the following programs:

Driver Support (HKLM-x32

===================================================

Remove Chrome Extensions

Remove the following extensions:

AVG Secure Search
Search Encrypt

• type chrome://extensions in the address bar and press Enter
• click the trash can icon by the extension you'd like to completely remove
• a confirmation dialog appears, click Remove.

===================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle America, Inc. -> Oracle Corporation)
HKU\S-1-5-21-1409944621-189731363-133459071-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08092019050213346\…\MountPoints2: {e1d9e33d-70cc-11e4-825e-3863bb8eae0e} - "F:\AutoRun.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005\…\MountPoints2: {0971029e-8ae2-11e8-830f-3863bb8eae0e} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005\…\MountPoints2: {097102d7-8ae2-11e8-830f-3863bb8eae0e} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005\…\MountPoints2: {803e9b84-3b72-11e8-8302-3863bb8eae0e} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005\…\MountPoints2: {ed76fc77-6b0a-11e5-8270-3863bb8eae0e} - "F:\AutoRun.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08092019050214551\…\MountPoints2: {0971029e-8ae2-11e8-830f-3863bb8eae0e} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08092019050214551\…\MountPoints2: {097102d7-8ae2-11e8-830f-3863bb8eae0e} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08092019050214551\…\MountPoints2: {803e9b84-3b72-11e8-8302-3863bb8eae0e} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1409944621-189731363-133459071-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08092019050214551\…\MountPoints2: {ed76fc77-6b0a-11e5-8270-3863bb8eae0e} - "F:\AutoRun.exe"
Task: {468B13AD-B541-4A27-B004-9B018EEA3275} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle America, Inc. -> Oracle Corporation)
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1409944621-189731363-133459071-1005.job => C:\Users\Annette\AppData\Local\GoToMeeting\13761\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1409944621-189731363-133459071-1005.job => C:\Users\Annette\AppData\Local\GoToMeeting\13761\g2mupload.exe
BHO-x32: No Name -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> No File
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [No File]
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [No File]
CHR HomePage: Profile 1 -> mysearch.avg.com
CHR Extension: (AVG Secure Search) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chfdnecihphmhljaaejmgoiahnihplgn [2019-08-04]
CHR Extension: (Search Encrypt) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oodblefojaocanejnikhhjcglbaelpbp [2019-08-08]
S2 DSAO; "C:\Program Files (x86)\driver support\svc\DriverSupportAOsvc.exe" [X]
S3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [X]
S1 epp; \??\C:\Program Files\Emsisoft Anti-Malware\epp.sys [X]
2019-08-07 21:27 - 2019-04-09 23:58 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2019-08-07 21:24 - 2017-03-11 09:31 - 000000000 ____D C:\ProgramData\Emsisoft
HKU\S-1-5-21-1409944621-189731363-133459071-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08092019050213346\…\ChromeHTML: ->  <==== ATTENTION
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
FirewallRules: [{BAB834BF-B807-4BB0-9914-BEB323488AC5}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe No File
FirewallRules: [{B4EC793D-9BBE-49AF-B2AF-C979A6135B15}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe No File
FirewallRules: [{A58108F8-825B-42DE-A8B0-03908ED19304}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe No File
FirewallRules: [{37B0BF0A-6A5B-4084-8C13-81F803B4FF7C}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe No File
FirewallRules: [{7281462C-F67B-4492-905D-4C4B321E723A}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe No File
FirewallRules: [{3B61AE1B-6103-477A-8F0D-4BAE585A8645}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe No File
FirewallRules: [{C767F0A0-DC9F-430D-81AC-BA6847226F1E}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe No File
FirewallRules: [{7F0BE56E-50CB-4D65-BA66-69B59B4E5837}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe No File
FirewallRules: [{BD129EA8-910D-4761-95EF-F4BD429148F1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe No File
Available physical RAM: 311.27 MB
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

===================================================

Download and run Tweaking.com - Windows Repair

Download Windows Repair from here and save it to your desktop.

• install and then run the programme
• when it starts, it will check that all its files are present
• when the next window opens,click on the middle tab, ‘Jump to Repairs’
• in the next window click on ‘Open Repairs’, (the programme will make a backup of your registry)
• place a checkmark next to 05, Repair WMI
• click Start
• leave the default selected items as they are and check Restart System When Finished
• now press Start Repairs.

================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

Fixlog.txt
New Frst.txt
New Addition.txt

Thanks

Satchfan

Hi Satchfan,

I didn't see you message regarding not to avoid using the Internet except to answer these logs as Windows Defender and Firewall are both disabled at the moment. I had left home yesterday, shortly after 9am not returning until 9pm. I didn't see your message until 4:30am. With that said, my computer had been on the entire time. My question is do you still want me to follow your above instructions? Or will I need to run other tests due to having my computer on and being on the internet all that time?

Thanks,

Annette

Thank you for explaining Annette. Please continue with the instructions.

Nina