I'm new, but I'm desperate please help.

[EbiomzPamws]

Please help, i downloaded a file via mis-click and I'm 110% sure i have an infection now. I have tried everything, and nothing works. Re-installing windows is NOT an option. I have tried MB-anti root kit thing, Chameleon failed, chrome is slower, some advisory addon with a redirection error was on my PC, each of my internet browsers randomly ask to be default (Does not normally happen) Files like the .log have locks and them and are invisible and hard to get to, I'm locked out of some files, though I am admin even when i try and change permissions it fails. I used JTR, MBAR, rKill, Msert. None of them worked.

 

Alright, so this started after i downloaded a file and i knew it was an error, I went and downloaded Mbam 2.0 and ran it, but it detected nothing (I have a license, but Idk if i do now because i got a 1.7v to work and it said i was no longer registered...w.e) Then upon restart the windows start up took 2-3 minutes, way longer then normal. I had a strange add-on that people claimed was a virus, i attempted to remove it. I removed other files via dual-linux/ubuntu boot. Mbam 2.0 Would not start, no matter what method i tried, even via chameleon...it's uninstalled now. When i try and re-install it I get run time errors and if it succeeds it still won't open. My computer is still slow, and i have a feeling it's a rootkit or trojan, but nothing can find it. Please help. Here is my Hijack this log. Excuse my un-professionalism, but I'm scared, nervous and the whole 9 yards.

 

HiJackThis:

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:07:51 AM, on 4/6/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.16521)

Boot mode: Normal

 

Running processes:

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.audio4fun.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.search.yahoo.com/?type=198484&fr=spigot-yhp-ie

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: (no name) - {43D9786F-A485-683B-9B5B-ACC97ABC17FC} - (no file)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: ArcPluginIEBHO - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~2\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{9379E447-BBF0-4D9A-B4C5-E5A3ECEC3906}: NameServer = 192.168.0.130

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Protocol: WSIEChrome - (no CLSID) - (no file)

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

O23 - Service: Arc Service (ArcService) - Perfect World Entertainment Inc - C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe

O23 - Service: BitRaider Mini-Support Service (BRSptSvc) - BitRaider, LLC - C:\ProgramData\BitRaider\BRSptSvc.exe

O23 - Service: BlueStacks Android Service (BstHdAndroidSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-Service.exe

O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Remote Procedure Call (RPC) Locator (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: RzKLService - Razer Inc. - C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe

O23 - Service: Razer Surround Audio Service (RzMaelstromVADStreamingService) - Unknown owner - C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

 

--

End of file - 8886 bytes

 

 

 

 

Here is the startup log:

 

StartupList report, 4/6/2014, 12:20:37 AM

StartupList version: 1.52.2

Started from : C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.EXE

Detected: Windows 7 SP1 (WinNT 6.00.3505)

Detected: Internet Explorer v11.0 (11.00.9600.16521)

* Using default options

==================================================

 

Running processes:

 

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Eric\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

 

--------------------------------------------------

 

Checking Windows NT UserInit:

 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = userinit.exe,

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

 

amd_dc_opt = C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

(Default) = 

Razer Synapse = "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

 

[AutorunsDisabled]

APSDaemon = "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

iTunesHelper = "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

 

--------------------------------------------------

 

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command

 

(Default) = C:\Windows\SysWOW64\mshta.exe "%1" %*

 

--------------------------------------------------

 

Shell & screensaver key from C:\Windows\SYSTEM.INI:

 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

 

Shell & screensaver key from Registry:

 

Shell=explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

 

Policies Shell key:

 

HKCU\..\Policies: Shell=*Registry value not found*

HKLM\..\Policies: Shell=*Registry value not found*

 

--------------------------------------------------

 

 

Enumerating Browser Helper Objects:

 

(no name) - (no file) - {43D9786F-A485-683B-9B5B-ACC97ABC17FC}

(no name) - C:\Program Files (x86)\Java\jre7\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

ArcPluginIEBHO - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F}

(no name) - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}

(no name) - C:\PROGRA~2\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}

(no name) - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}

 

--------------------------------------------------

 

Enumerating Task Scheduler jobs:

 

Adobe Flash Player Updater.job

GoogleUpdateTaskUserS-1-5-21-234947849-84365881-2129188560-1001Core.job

GoogleUpdateTaskUserS-1-5-21-234947849-84365881-2129188560-1001UA.job

 

--------------------------------------------------

 

Enumerating Download Program Files:

 

[shockwave Flash Object]

InProcServer32 = C:\Windows\SysWOW64\Macromed\Flash\Flash32_12_0_0_77.ocx

CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

 

[{D4B68B83-8710-488B-A692-D74B50BA558E}]

CODEBASE = http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

 

[Creative Software AutoUpdate 2]

InProcServer32 = C:\PROGRA~2\Creative\SHARED~1\SOFTWA~1\CTSUEng.ocx

CODEBASE = http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

 

[Creative Software AutoUpdate Support Package]

InProcServer32 = C:\PROGRA~2\Creative\SHARED~1\SOFTWA~1\CTPID.ocx

CODEBASE = http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab

 

--------------------------------------------------

 

Enumerating Winsock LSP files:

 

NameSpace #1: C:\Windows\system32\NLAapi.dll

NameSpace #2: C:\Windows\system32\napinsp.dll

NameSpace #3: C:\Windows\system32\pnrpnsp.dll

NameSpace #4: C:\Windows\system32\pnrpnsp.dll

NameSpace #7: C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

NameSpace #8: C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

NameSpace #9: C:\Program Files (x86)\Bonjour\mdnsNSP.dll

 

--------------------------------------------------

 

Enumerating Windows NT logon/logoff scripts:

 

Windows NT checkdisk command:

BootExecute = autocheck autochk *

 

Windows NT 'Wininit.ini':

PendingFileRenameOperations: C:\Users\Eric\AppData\Local\Temp\_iu14D2N.tmp|||L

 

--------------------------------------------------

 

Enumerating ShellServiceObjectDelayLoad items:

 

WebCheck: *Registry key not found*

 

--------------------------------------------------

End of report, 6,647 bytes

Report generated in 0.031 seconds

 

Command line options:

   /verbose  - to add additional info on each section

   /complete - to include empty sections and unsuspicious data

   /full     - to include several rarely-important sections

   /force9x  - to include Win9x-only startups even if running on WinNT

   /forcent  - to include WinNT-only startups even if running on Win9x

   /forceall - to include all Win9x and WinNT startups, regardless of platform

   /history  - to list version history only

 

 

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• 
  

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Kevin..

[EbiomzPamws]

Hello, i have no idea what p2p software or pirated/cracked software I'd have on here. If any support could be granted, that would be appreciated. Does steam count as p2p? Origin? uhm....arc? All of those are gaming platform thingys where you add friends and stuff, but idk if that's p2p. I use resource hacker to modify splash screens and text for programs, but that is a binary thingy (I'm not sure what it's called, i just follow YouTube tutorials on how to use it and then i made it my own thing) I have quite a few free to play games, but again I'm not sure if that counts.

[EbiomzPamws]

Here are addition and frst.txt. Enjoy.

Addition.txt

FRST.txt

[kevinf80]

I strongly advise that any software you have related to  Advanced System Care, otherwise known as IOBit should be removed at your earliest convenience.. Read the following:

 

https://forums.malwarebytes.org/index.php?showtopic=29681 IOBit Steals Malwarebytes' Intellectual Property

https://forums.malwarebytes.org/index.php?showtopic=30989 IOBit's Denial of Theft Unconvincing

https://forums.malwarebytes.org/index.php?showtopic=33217 IOBit Theft Conclusion

http://antivirus.about.com/od/antivirussoftwarereviews/a/iobittrustingantivirus.htm IObit: Trusting Your Antivirus Vendor

http://news.softpedia.com/news/Malwarebytes-IObit-Stole-Our-Signatures-Database-125928.shtml Malwarebytes: IObit Stole Our Signatures Database

http://blogs.computerworld.com/15026/iobit_accused_of_stealing_from_malwarebytes IObit accused of stealing from Malwarebytes

http://shanegowland.com/opinions/2012/iobit-is-a-sucky-company/

 

Next,

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Please download Malwarebytes Anti-Malware to your desktop.

• 
  

Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.
On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

 

How to get logs:

(Export log to save as txt)

 

• 
  

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Export'.
Click 'Text file (*.txt)'
In the Save File dialog box which appears, click on Desktop.
In the File name: box type a name for your scan log.
A message box named 'File Saved' should appear stating "Your file has been successfully exported".
Click Ok
Attach that saved log to your next reply.

 

Next,

 

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

 

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt.

 

Let me see those logs in your next reply, also give an update on any remaining issues or concerns...

 

Kevin..

 

 

fixlist.txt

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!