vleong

So far, so good. Thank you again, Ron, for all your help. Vivien

I ran the Farbar Recovery Scan Tool and the logfiles are now attached. Thanks, Vivien FRST.txt Addition.txt

Kaspersky default scan done. All clear - screen capture of results pasted into this reply. Now do Farbar Recovery Scan Tool? Vivien

Ron, I was able to get through only steps 1 and 2: Junkware Removal Tool & AdwCleaner. I've attached those logfiles. I downloaded the Sophos Virus Removal Tool (step 3), but when I've tried to run it, I always get an error message. See below (and attached). I've tried about 5-8 times, including after shutting down my computer overnight (during which time updates were installed on my computer). I'm now re-downloading the program, in case that might help, but not holding my breath. Suggestions for what to do next? (And I did NOT do step 4 - FRST scan - at this point.) Vivien JRT.txt AdwCleaner[S1].txt AdwCleaner[C2].txt

Threat scan done. Logfile attached. Again, fingers crossed, Vivien Malwarebytes threat scan - June 13 2017.txt

Hi, Ron, Fixlog.txt is attached. FYI, my computer seemed stuck, for a very long time, at "10%" complete scanning & fixing C: drive. I left it for several hours, and finally came back to see it in sleep mode. And I've just revived it. Fingers crossed. Thanks as ever, Vivien Fixlog.txt

Yes, I know how to zip/unzip files. But the link was a good verification that I'm doing it right. Thanks! But I can't get the file to show up in Explorer. All I get is the same C:\Windows\System32> prompt again. I've tried many times, using different methods in case I was doing it wrong, e.g., typing in CMD vs. CMD.exe in the START BOX, typing the entire "attrib . . . " line in the START box; using upper- vs. lowercasing, double-checking spelling, etc. I've attached a jpeg of one of my attempts. Vivien

Result below (also attached as jpeg of screen capture): Note: I need to go to sleep now. So, if you reply to this now and don't hear back from me, that's why. Thanks, Vivien

Hi, Ron, I searched several times for that exe file, but it didn't turn up in the search results. I searched both in that specific subdirectory (C:\Users\Vivien\AppData\Roaming\) and in the root directory (C:\). I also tried an advanced search that included non-indexed locations. I've attached & pasted below a jpeg of one of my search results. Looking at the FRST.txt log, I tried searching for - and found - the A shortcut link, whose target is that EXE file. See screen capture below. I didn't dare to click on the shortcut link. But I did look at the shortcut's properties, and the target is the same as was indicated by you and in the FRST.txt log. N What next? Vivien

Here's the new set of FRST.txt and Addition.txt log files. Thanks, Vivien FRST.txt Addition.txt

Yes, I know, it was stupid to click on the email link - the link said "See replies . . . " and I thought I'd check who had accepted the meeting invitation. And b/c I attend meetings of this committee as an alternate only, I don't actually know the names of the people on the committee, much less their "real" email addresses. Sigh. In any case, I've done the Custom Scan, including rootkits, and the logfile is attached. Note: I'd closed down my email, so didn't see you'd said to select just C: drive. I selected both C: and D: drive. If that's a problem, let me know and I'll re-run the scan. But the scan came up clear. Though I did see something in the Quarantine, which definitely relates to the USB shortcut virus - see image. Thanks, Vivien Malwarebytes custom scan, incl rootkits - June 7 2017.txt

Unfortunately, the "Website blocked" pop-ups started again this morning - fast and furiously non-stop! And the USB shortcut virus also seems to be back - I also put in a USB key today and my files are hidden again. Should I follow the rest of your previous instructions, as I've quoted below? FYI, I've done another Malwarebytes 3 threat scan. It again came up clear - see attached log. Note: I also did get a potentially phishing email yesterday - I opened the email as it was about an upcoming meeting, and did click on one link; soonafter, the person it came from said he didn't send it and it was likely a phishing scam. Thanks, Vivien Malwarebytes threat scan - June 7 2017.txt

Here is the Malwarebytes 3 Threat Scan report - attached .txt file. It was all clear, and I haven't had any more "Website blocked" pop-ups and the USB shortcut virus seems to be gone, so I stopped there and didn't download the fixlist.txt file. Fingers crossed all is good now. Thank you! Vivien threat scan report export - June 5 2017.txt

Hi, @AdvancedSetup, I've followed all 4 steps: 1. One (1) JRT.txt logfile is attached. 2. Two (2) AdwCleaner logfiles are attached: 1 of scan; 1 post clean. 3. Sophos Free Virus Removal Tool scan found no threats. 4. FRST.txt and Addition.txt logfiles are attached. Thanks, Vivien JRT.txt AdwCleaner[S0].txt AdwCleaner[C0].txt FRST.txt Addition.txt

Hi, I am having several problems on my PC laptop, which is running Windows 8.1. FYI, I have Malwarebytes Premium 3.0.6.1469, and I have run recent threat and custom scans on my laptop, and it is now showing up clear (Trojan Agents were quarantined and have now been removed). But the problems persist. (1) My laptop seems to have the "USB shortcut virus," which hides all files/folders on any USB stick that I insert into my USB drives and replaces them with a shortcut. See attached jpeg. Following instructions I found on the Internet, I have been able to unhide the files/folders and recover them, and I've reformatted my USB sticks so they are okay when I insert them into a different laptop. But the virus seems to still be on my laptop, and I haven't figured out how to remove it (so, if I put my reformatted USB stick into a USB drive, the shortcut again appears on the USB stick, Malwarebytes detects and quarantines something, and I have to repeat the process to unhide any files and reformat the USB stick). (2) Malwarebytes is constantly showing me "Website blocked" pop-ups. I've attached 3 jpegs of pop-up variants (showing some of the different domain names that have appeared). I have also exported and attached 3 recent Malwarebytes reports - see those 3 txt files. And I have run the Farbar Recovery Scan Tool and attached the FRST.txt and Addition.txt files. Thank you in advance! Vivien FRST.txt Addition.txt Website blocked - export of recent report - May 27 2017, 9-23pm.txt Website blocked - export of recent report - May 27 2017, 9-22pm.txt Website blocked - export of recent report - May 27 2017, 9-21pm.txt