PC apparently infected [Solved]

PC is showing signing on with new device. Not so, been sighing on to a regular site for years. Something is not right with my PC. Thanks! 

Hello Lewg and welcome to WTT.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programmes unless asked to.
Please DO NOT run any scans other than those requested

===================================================

I would suggest that you immediately change your password for the site you had the problem with. Make sure that you use a mixture of letters, numbers and characters, (if the website allows them).

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator, (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

Frst.txt
Addition.txt

Thanks

Satchfan

I also need the Addition.txt log please.

It's 12:50am here in the UK so I won't reply again tonight.

Satchfan

There is no sign of malware but a few things need attention.

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate FRST64
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {E804A8B0-6BC9-451C-BDA9-02A7BED3A3F3} - System32\Tasks\AdwCleaner_onReboot => C:\Users\Lew Gresham\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\AdwCleaner (2).exe
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 18.0.0\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 18.0.0\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\FFExt\light_plugin_firefox\addon.xpi => not found
2020-12-09 18:33 - 2020-12-09 18:33 - 000002498 _____ C:\WINDOWS\system32\Tasks\AdwCleaner_onReboot
2020-12-12 12:36 - 2018-04-29 11:33 - 000000572 __RSH C:\ProgramData\ntuser.pol
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} =>  -> No File
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} =>  -> No File
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =>  -> No File
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =>  -> No File
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =>  -> No File
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =>  -> No File
Toolbar: HKU\S-1-5-21-564737261-2307367983-4277817321-1002 -> No Name - {C500C267-63BF-451F-8797-4D720C9A2ED9} -  No File
HKLM\…\StartupApproved\Run32: => "SecurityHealth"
FirewallRules: [{E0966554-6F3B-49CA-ABE9-5081B643B90E}] => (Allow) C:\Users\Lew Gresham\AppData\Local\Temp\7zS3944\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{96ED0AAC-6CA8-493A-9588-96B738972CFD}] => (Allow) C:\Users\Lew Gresham\AppData\Local\Temp\7zS3944\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{D5B16DF4-B2C4-4656-98F4-A81783141E07}] => (Allow) C:\Users\Lew Gresham\AppData\Local\Temp\7zS4F6B\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{6BF02BD8-4FC2-4F4F-85E8-070DFD583508}] => (Allow) C:\Users\Lew Gresham\AppData\Local\Temp\7zS4F6B\HPDiagnosticCoreUI.exe => No File
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Caan you tell me if there are any noticable problems.

Satchfan

OK, I have done as you requested. The Farbar Icon is now pasted on my desktop. Also the Farbar scan text is on my desktop. Does this need to be removed before anything else is done.  Also my cursor freezes at times and I have to reboot my PC. 

The Farbar Icon is now pasted on my desktop. Also the Farbar scan text is on my desktop. Does this need to be removed before anything else is done.

You need FRST on the desktop and Fixlist.txt should also be there.

When they are both there, run FRST64, then click Fix just once and wait. A log, Fixlog.txt will appear on your desktop. Please copy/paste it in your reply.

 What creates the Fixlist.txt file?

You create it in Notepad following the instructions in this post.

Both fixlist.txt and Frst are on my Desktop and when I run Frst it does not create a fixlog.txt. 

When you you open FRST, click on Fix.

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

New Frst.txt
New Addition.txt

Satchfan