willhansen9

Thanks so much for your help! everything is much better now.

sorry about the wait but here it is 2017-03-06 05:35:42.587 Sophos Virus Removal Tool version 2.5.6 2017-03-06 05:35:42.587 Copyright (c) 2009-2016 Sophos Limited. All rights reserved. 2017-03-06 05:35:42.587 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them. 2017-03-06 05:35:42.587 Windows version 6.2 SP 0.0 build 9200 SM=0x100 PT=0x1 WOW64 2017-03-06 05:35:42.587 Checking for updates... 2017-03-06 05:35:42.600 Update progress: proxy server not available 2017-03-06 05:35:50.319 Option all = no 2017-03-06 05:35:50.319 Option recurse = yes 2017-03-06 05:35:50.319 Option archive = no 2017-03-06 05:35:50.319 Option service = yes 2017-03-06 05:35:50.319 Option confirm = yes 2017-03-06 05:35:50.319 Option sxl = yes 2017-03-06 05:35:50.320 Option max-data-age = 35 2017-03-06 05:35:50.320 Option vdl-logging = yes 2017-03-06 05:35:50.328 Customer ID: 094260ca9b3af99f9d4a3909fc47a743 2017-03-06 05:35:50.328 Machine ID: bca0e6517d7a4f57b3a56d3ceff4f841 2017-03-06 05:35:50.329 Component SVRTcli.exe version 2.5.6 2017-03-06 05:35:50.329 Component control.dll version 2.5.6 2017-03-06 05:35:50.329 Component SVRTservice.exe version 2.5.6 2017-03-06 05:35:50.330 Component engine\osdp.dll version 1.44.1.2280 2017-03-06 05:35:50.330 Component engine\veex.dll version 3.68.0.2280 2017-03-06 05:35:50.330 Component engine\savi.dll version 9.0.7.2280 2017-03-06 05:35:50.330 Component rkdisk.dll version 1.5.31.1 2017-03-06 05:35:50.330 Version info: Product version 2.5.6 2017-03-06 05:35:50.331 Version info: Detection engine 3.68.0 2017-03-06 05:35:50.331 Version info: Detection data 5.36 2017-03-06 05:35:50.331 Version info: Build date 2/7/2017 2017-03-06 05:35:50.331 Version info: Data files added 250 2017-03-06 05:35:50.331 Version info: Last successful update (not yet updated) 2017-03-06 05:35:59.728 Downloading updates... 2017-03-06 05:35:59.730 Update progress: [I96736] sdds.svrt_10: adding primary package C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED baseVersion=1 2017-03-06 05:35:59.730 Update progress: [I95020] sdds.svrt_10: looking for packages included from product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path= 2017-03-06 05:35:59.730 Update progress: [I22529] sdds.svrt_10: looking for supplements included from product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path= 2017-03-06 05:35:59.730 Update progress: [I49502] sdds.savi0910.xml: found supplement SAVIW32 LATEST path= baseVersion= [included from product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path=] 2017-03-06 05:35:59.730 Update progress: [I95020] sdds.savi0910.xml: looking for packages included from product SAVIW32 LATEST path= 2017-03-06 05:35:59.730 Update progress: [I22529] sdds.savi0910.xml: looking for supplements included from product SAVIW32 LATEST path= 2017-03-06 05:35:59.730 Update progress: [I49502] sdds.data0910.xml: found supplement IDE537 LATEST path= baseVersion= [included from product SAVIW32 LATEST path=] 2017-03-06 05:35:59.730 Update progress: [I95020] sdds.data0910.xml: looking for packages included from product IDE537 LATEST path= 2017-03-06 05:35:59.730 Update progress: [I22529] sdds.data0910.xml: looking for supplements included from product IDE537 LATEST path= 2017-03-06 05:35:59.730 Update progress: [I49502] sdds.data0910.xml: found supplement IDE538 LATEST path= baseVersion= [included from product IDE537 LATEST path=] 2017-03-06 05:35:59.730 Update progress: [I95020] sdds.data0910.xml: looking for packages included from product IDE538 LATEST path= 2017-03-06 05:35:59.730 Update progress: [I22529] sdds.data0910.xml: looking for supplements included from product IDE538 LATEST path= 2017-03-06 05:35:59.730 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path= 2017-03-06 05:36:00.073 Update progress: [I19463] Syncing product SAVIW32 LATEST path= 2017-03-06 05:36:00.073 Update progress: [I19463] Product download size 158884372 bytes 2017-03-06 05:36:11.736 Update progress: [I19463] Syncing product IDE537 LATEST path= 2017-03-06 05:36:11.736 Update progress: [I19463] Product download size 2537599 bytes 2017-03-06 05:36:13.531 Update progress: [I19463] Syncing product IDE538 LATEST path= 2017-03-06 05:36:13.531 Update progress: [I19463] Product download size 2166788 bytes 2017-03-06 05:36:15.995 Installing updates... 2017-03-06 05:36:16.600 Error level 1 2017-03-06 05:36:39.651 Update successful 2017-03-06 05:36:53.113 Option all = no 2017-03-06 05:36:53.113 Option recurse = yes 2017-03-06 05:36:53.113 Option archive = no 2017-03-06 05:36:53.113 Option service = yes 2017-03-06 05:36:53.113 Option confirm = yes 2017-03-06 05:36:53.113 Option sxl = yes

im going to let the third one run over night but here are the first two. thanks for your help # AdwCleaner v6.044 - Logfile created 05/03/2017 at 20:51:53 # Updated on 28/02/2017 by Malwarebytes # Database : 2017-03-02.1 [Server] # Operating System : Windows 10 Pro (X64) # Username : Will - DESKTOP-MG0EN4R # Running from : C:\Users\Will\Desktop\AdwCleaner.exe # Mode: Clean # Support : https://www.malwarebytes.com/support ***** [ Services ] ***** ***** [ Folders ] ***** [-] Folder deleted: C:\Users\Will\.proxycheck [-] Folder deleted: C:\Users\Will\.AnonymizerLauncher [-] Folder deleted: C:\Users\Will\AppData\Local\AnonymizerLauncher [-] Folder deleted: C:\Users\Will\AppData\Roaming\Microleaves [-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnonymizerGadget [-] Folder deleted: C:\Users\Will\AppData\Roaming\AGData ***** [ Files ] ***** ***** [ DLL ] ***** ***** [ WMI ] ***** ***** [ Shortcuts ] ***** ***** [ Scheduled Tasks ] ***** [-] Task deleted: Online Application ***** [ Registry ] ***** [-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Dataup [#] Key deleted on reboot: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Dataup [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C} [-] Key deleted: HKLM\SOFTWARE\Microleaves [-] Key deleted: [x64] HKLM\SOFTWARE\Microleaves [-] Value deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 [cpx] ***** [ Web browsers ] ***** [-] [C:\Users\Will\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: aol.com [-] [C:\Users\Will\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: ask.com [-] [C:\Users\vhans\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com [-] [C:\Users\vhans\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com [-] [C:\Users\ellis\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com [-] [C:\Users\ellis\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com ************************* :: "Tracing" keys deleted :: Winsock settings cleared ************************* C:\AdwCleaner\AdwCleaner[C0].txt - [2309 Bytes] - [05/03/2017 20:51:53] C:\AdwCleaner\AdwCleaner[S0].txt - [2441 Bytes] - [05/03/2017 20:50:40] ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2455 Bytes] ########## log.txt

FRST_04-03-2017 19.54.08.txt Fixlog_04-03-2017 17.00.03.txt Addition_04-03-2017 19.54.08.txt

here are the logs Addition_04-03-2017 15.37.10.txt FRST_04-03-2017 15.37.10.txt

winvmx client has shown up in my task manager i need help removing it please