problem with embedit.exe outlook.exe, etc [Solved]

I've been the victim of a virus or what ever.  Suddenly this morning when I click to have my outlook open, I get a pop up box to make changes to my outlook, I click yet.  I go to open gogle chrome, and I get the same pop up box except for google.com.

I try to pen my embroudery sofware and I get the Embedit.com pop up box.

once google is up, I cannot type in the address bar or the box to search in.  I cannot right click anywhere.  Please help me.

I ran malaware it found 24 bad things and i put them in quarentine.  Webroot had no problems.  I give up.

I need my pc this morning, and I'm stuck!

Thank you guys!!

darlene

Hello peachy_dar and welcome back to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan Now
• when it has finished, leave everything that was found checked, (ticked), then click on Quarantine
• if it asks to reboot, allow the reboot
• on reboot, click on View Log File; please attach the content of the log to your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator, (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to the disclaimer.
• press the Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with your next post:

AdwCleaner log
Frst.txt
Addition.txt

Thanks

Satchfan

hi

thanks

here is t he first run

dar

There are no infections in those logs but we’ll have to look further.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth9.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth8.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth7.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth6.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth5.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth4.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth3.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth2.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth12.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth11.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth10.bin
2020-04-15 06:04 - 2020-04-15 06:04 - 000000315 _____ C:\Windows\system32\DrtmAuth1.bin
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.451 - Google LLC) Hidden
CustomCLSID: HKU\S-1-5-21-2269535815-1833988599-3816905546-1002_Classes\CLSID\{46406D82-6EC0-47CC-8A75-1F33C6DEDBBE}\InprocServer32 -> C:\Users\dpiro\AppData\Local\Google\Update\1.3.35.442\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2269535815-1833988599-3816905546-1002_Classes\CLSID\{540C17A8-04F2-4B66-95D7-B2FEF9A19B54}\InprocServer32 -> C:\Users\dpiro\AppData\Local\Google\Update\1.3.35.422\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2269535815-1833988599-3816905546-1002_Classes\CLSID\{84EB3779-151B-4C71-AEF0-A0FEE9481401}\InprocServer32 -> C:\Users\dpiro\AppData\Local\Google\Update\1.3.35.342\psuser_64.dll => No File
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run Farbar Recovery Scan Tool

Please run it again:

• double click on FRST.exe on the Desktop to launch the tool
• type the following in the ‘Search’ box:
  

  
  47094115.r.msn.com; pennhillssoccer.org
  
   

• click the Search Registry button and post the resulting log, (Search.txt), in your reply.

Logs to include with next post:

Fixlog.txt
Search.txt

Thanks

Satchfan

hi…..

Farbar recovery scan has been running for over an hour, and I think it may be stuck on "scanning system errors: 18198"

I am going to include the search.txt file…

What do I do with Farbar?  Is it stuck?

dar

Close FRST for now and do the following:

Run RogueKiller Portable

The ‘Portable’ version can be used on a machine without installation.

IMPORTANT: Please remove any usb or external drives from the computer and close all running programs before you run this scan!

Download RogueKiller Portable to your desktop, (you’ll need to scroll to the bottom of the page)

• for Windows Vista/7/8/10, right click -> run as administrator, for XP simply double-click on RogueKiller Portable.exe
• when it opens, click on Scan
• if a Windows opens to explain what [PUM's] are, read about it
• click the RoguKiller icon on your taksbar to return to the report
• when it has finished, click on Open Report
• click on Export Txt and save the file on your Desktop as RKreport.txt
• copy/paste the content in your next post
• click on the ‘Remove’ button to delete the items in RED
• click Finish and close the program
• locate the RKreport.txt file on your Desktop and copy/paste the contents in your next reply.

Thanks

When I came back to this laptop, it was done. so i tried to get to wtt and everything disappeared.  so i could not fun fix.  so I guess we carry on!

I will try to do the next direction.  this has to be a virus…has to be.

dar

Can you also post the results of the Malwarebytes scan that you did.

hi oh my god, I can type here!!  Rogue killer is running. I'm about to cry.  I just got this pc December 5th.  Asus makes a good laptop.  I need this laptop to run.  I do machine embroidery and genealogy - lots of data on here.  Mostly moved to my external memory - I don't have much on this hard drive, but I need this laptop to access my software, legacy and pallet.  Both important software.  Please, please, please help me to get rid of this problem!

So far it has found 7 problems.  I can't always type here, "the problem" will soon take over and I can't say much more.  I appreciate the time you are giving me.!!

It is done.

Can you tell me if anything is wrong?  is it a trojan? or what ever they are calling them these days.  I'm beginning to hate this problem.

I have attached the file.  Please let me know what you are finding.

Oh, one thing, I see that Incredimail is the culpret here.  It is an email program I use. I have had no problem with it.  I have since stopped using it.  Do what you need to do to make this laptop run like a corvet!!!

dar

did you want me to remove those 17 incredimail items?  So far I have not.  Your call.

I was able to export the report.  i  put  MB in the front of the name.

dar

hi

Why would every software I open have a pop up to allow permission?

Why would my keyboard be ignored and I can't type in the address bar or the search box?

Why would I not be able to use right click on my mouse?

Why?  Could it be a global setting within Microsoft?

There have been quite a few updates of late….could one update be responsible for this?

Could it possibly be a hardware problem?

what do ya think?

dar

Well done finding that: it was helpful.

Incredimail is not your main problem but we'll remove it shortly if you are willing.

First, you need to reset Chrome back to defaults.

Please follow the instructions here.

When you've done that, reboot, run AdwCleaner again and post the new log please.
 

Sorry, I missed your second reply. We'll deal with these issues a bit at a time. Please be patient.

It's past midnight here in the UK so I won't reply until the morning, (GMT).