Boots To Desktop - No Buttons Work

[Steve_Sr]

I think I am infected with some form of malware. I have a dual boot P4 system running Win2K on drive 0 and WinXP on Drive 1.

 

I recently installed a Canon 9000F scanner which came with its own software and drivers and also with Adobe Photoshop Elements 8 on the XP machine. This information may be a red herring and unrelated but I am mentioning it for completeness.

 

This evening while using the newly installed Photoshop the PC locked up such that Task Manager wouldn’t work to shut down Photoshop which I blamed for the lockup. I had to force a shutdown with the power switch.

 

When I rebooted the XP image it started normally and accepted my password but wouldn’t respond to the task bar or bring up the Start Menu. Well, I had a True Image backup of the XP machine made before the scanner installation and thought that I would just boot the 2K image and restore the XP partition.

 

Upon booting the 2K machine It suddenly has the same issues as the XP machine!. It will start to the desktop and then nothing seems to work. Task manager will open but not respond to buttons. Power switch is required to shut down system.

 

This sure smells like Malware to screw up both an active AND inactive system in the same way. Any ideas as to what this is and how to get rid of it? Obviously I can’t boot to a useful system so any recommendations on a good rescue CD that won’t make matters worse?

[Blackbird]

Hi,

 

Welcome to Malwarebytes' Support Forums! I am Blackbird and I will help you removing any malware that might be present on your computer.

An important WARNING to all individuals reading this topic:
All advice in this topic was given specifically for this user and this computer!! Performing instructions given by me in this topic on other computers may harm your computer's infrastructure and can cause serious damage to them!!
Please don't perform the steps given by me or other Helpers in this topic when you are not the original Topic Starter, but start your own topic with a question for help. You will get help from a trained and qualified Helper to clean up your computer from any present malware when you do so.

General rules:

• From now on, don't use this computer anymore to access your bank account or any other serious business where you have to login for, untill I've told you your computer is clean from malware.
• Be patient waiting for my answer. I'm doing the best I can to answer to logs as soon as possible, but I'm handling multiple topics at the same time. Please feel free to remind me of your topic by sending a link to it by private message, when I didn't get back to you after 24 hours.
• Don't change anything on your computer in the period I'm helping you, except when I tell you to do so. So don't add/remove any software (programs, drivers, etc.) and don't change any hardware. If you really need to change something that can't wait, please inform me directly, by posting it in this topic or - if private - send me a private message containing an explanation of the changes made by you. This gives me the possibility to give you good advice.

Rules about advices from me:

• The Helpers active on this board first got a full training in removing malware and providing support to people who got infected. Also they were trained to resolve any problems caused by malware infections. Please use the programs I provide to you only when under supervision of a trained Helper. This, because using these programs without supervision can cause damage to your computer.
• It's possible that your virus scanner, anti-spyware program or any other malware protection program or policy tries to block one or more of the programs provided by us. If that is the case, please always allow those programs to run and/or allow the provided changes to be made. If needed to run our tools properly, temporarily disable your anti-malware programs.
• Always Save tools provided by me to your Desktop, unless I give you other instructions. Don't ever run tools directly from the internet, because this can stop them from working properly. Also never save tools to any other locations than your Desktop.
• If you have any problems while following my instructions, stop there and tell me the exact nature of the issue.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• You can check here if you're not sure if your computer is 32-bit or 64-bit.

Rules about posting results:

• Always copy/paste the logfiles in your replies completely. If a logfile doesn't fit into one post, please add the logfile as an attachment instead. If this still won't work, please inform me.
• Never change something in the logfiles!! Include them in your posts as they were provided by the tools. This way I'll get a clear view on your system's situation. If you change the logfiles, it will take more time to clean up your computer.
• Don't post logs using CODE, QUOTE or FONT tags. Just post them as direct text.

Things I want you to do before performing the steps below:

• Please enable your system to show hidden files: How to see hidden files in Windows.
• Make sure you're subscribed to this topic. Click on the Follow This Topic button at the top right of this page, make sure that the Receive Notification box is checked and that it is set to Instantly.
• Even though we do the best we can to help you, removing malware includes risks. Therefor I advise you to back-up all of your important files to a CD/DVD, external drive or flash drive. For instructions/help, take a look here.

-------------------------------------------------------------------------------------------------------------------------------------------------------
Thanks in advance for keeping above rules in mind.
Maybe they look like unnecessary rules, but practice teaches us they are needed to help.

Now, let's continue with the steps you need to do:
-------------------------------------------------------------------------------------------------------------------------------------------------------
 

First, just a couple of questions:

- Can you still boot into Safe Mode and can you actually use the basic functions from Windows from within that mode, like running applications, opening Start Menu, etc.?

- Did you already run any malware scans? If so, can you please include the reports/results from those scans in your next reply?

 

Good luck.

[Steve_Sr]

Thanks for your help!

 

The system will boot and successfully run Memtest86 from CD. I let it run 1 complete pass before terminating it.

 

The system will also boot and run Spinrite 6. I never actually ran Spinrite because I didn't want to disturb the hard drives.

 

I tried to get into Windows safe mode by hitting F8 but was never given the safe mode prompt screen. It tried to boot regular windows and then froze as previously described.

 

What should I try next?

 

 

Thanks,

 

Steve

[Blackbird]

Hi,

 

Please try to save the tools to a thumb drive or CD/DVD that I mentioned in my previous post. You can then try to run them from that thumb drive/CD/DVD on the affected PC.

 

Please let me know if you succeeded.

[Steve_Sr]

Hi,

 

Please try to save the tools to a thumb drive or CD/DVD that I mentioned in my previous post. You can then try to run them from that thumb drive/CD/DVD on the affected PC.

 

Please let me know if you succeeded.

 

Blackbird,

 

Sorry, but I see nothing about any tools to load or run in your previous post. Specifically, what tools should I run, what are they supposed to do, and where do I find them.

 

 

Thanks,

 

steve

[Blackbird]

Hi,

 

I'm sorry, my mistake.

 

1. We need to temporarily disable any cd-emulators active on your computer, as they can impede the interpretation of logfiles provided by our tools.

• Download Defogger and save it to your Desktop.
• Right-click Defogger.exe and select Run as Administrator.
• When the program has opened, click the Disable button.
• When Defogger asks for a confirmation, click Yes.
• Wait untill you get the "Finished" message. Click OK.
• When Defogger asks you to restart the system, please allow the program to do so immediately.

• When an error occured while using Defogger, look for a file called "defogger_disable.txt", which should be located at your Desktop. Post the contents of this file into your next reply.
• You can enable the cd-emulator software again by running Defogger again and clicking the "Re-enable" button. Only do this when I told you your computer is clean again.

2. Download AdwCleaner and save it to your Desktop.

• Close all open windows.
• Right-click AdwCleaner.exe and select Run as Administrator.
• When the program has started, click the Scan button and wait untill the scan has finished.
• Make sure everything (on all tabs) is selected, and click the Clean button.
• It's possible that AdwCleaner asks you to restart the system. It's important that you agree with this.
• After restart a logfile will appear. Please post the contents of that logfile in your next reply.

3. Download Malwarebytes' Anti-Malware and save it to your Desktop.
If you already got Malwarebytes' Anti-Malware installed on your computer, please go to step 3-A.

• Install the program, eventually using these instructions.

3-A. Start Malwarebytes' Anti-Malware.

• On the Dashboard tab, click the Update Now button, to update the definitions to the latest version.
• Then click the Scan tab. Select Custom Scan and click the Start Scan button.
• In the window that appears, check the box next to Scan for Rootkits. Also, select all drives, except for CD/DVD-drives. After you have done this, click Start Scan.
• Follow the instructions given by Malwarebytes' Anti-Malware.
• If any items were found during the scan process, Malwarebytes' Anti-Malware will ask you what you want to do with those items. Please quarantine all items.
• It's possible the program asks you for permission to restart the computer. If so, please allow MBAM to do so immediately.
• Save the logfile in txt-format and copy/paste it in your next reply.
• Note: If you can't find the logfile, look at the "History" tab. Select the most recent logfile (you can see the creation date in the log's title).

4. Please read and perform the steps described on this page: I'm infected - What do I do now?.
Post the logfile from Farbar Recovery Scan Tool into your next reply.

5. Download GMER Rootkit Scanner and save it to your Desktop.
NOTE: Windows 8 users can skip this step. GMER Rootkit Scanner isn't compatible with Windows 8. Don't run it.

• Right-click the GMER executable file (which's name will contain 8 digits/characters) and select Run as Administrator.
• If GMER warns you about possible rootkit activity and asks you to scan for rootkits, DON'T allow GMER to do so.
• Under "Files", put a checkmark next to Quick Scan.
• Remove the checkmark next to Show all.
• Now, click the Scan button.
• Note: This scan often provides False Positives in the scan results. Never fix anything found by Gmer, unless I instructed you to do so!
• If the scan's finished, click Save and save the log to your Desktop.
• Post GMER's logfile into your next reply.

6. Please provide me a detailed description of any computer problems you're facing, together with the logfiles mentioned in step 1 - 6.

Good luck!

[Steve_Sr]

Blackbird,

 

Sorry, but I am still confused. How am I supposed to load and run these tools when the computer won't boot Windows? Don't I need a CD rom version of something to accomplish this?

 

 

Thanks,

 

Steve

[Blackbird]

Hi Steve,

 

That was my question, actually. If you could boot to Windows and properly run tools on it.

No problem at all, we'll use a rescue USB flash drive first to (hopefully) get into Windows.

 

For these instructions you'll need an empty USB Flash drive and a computer with an internet signal (so you can download this tool). You can download this tool and install it to the USB-stick (you'll find the instructions below) on the same, second computer.

 

1. Please download HitmanPro with Kickstart (32-bit) and save it to your Desktop.

• Please download this User Manual: HitmanPro User Manual
  I'm directing you to this user manual, as the steps provided there are as clear as possible and contain screenshots which make the process more understandable. If you got any questions about using HitmanPro or creating the USB Flash drive, you can ask me.
  
• Read and follow the steps listed in chapter 4 in this user manual, to create a bootable USB Flash drive.
  
• While running the setup file, choose "No, I only want to perform a one-time scan to check this computer." That way, the program won't be installed on your computer, but only creates a bootable USB Flash drive.
  
• Once done, read and follow the steps in chapter 5 to boot from this USB Flash drive and remove any malware that prevents you from booting up and using Windows properly.
  
• If you got any questions, please feel free to ask me.
  
• Once you booted the system with this tool, remove any malware that has been found. If a reboot is necessary, please allow HitmanPro to reboot your PC immediately.
  
• When results are presented, a link in the lower-left corner will appear called "Save Log". Please click this link to save a logfile to your computer. Include those results in your next reply.

 

2. After reboot, please read and perform the steps described on this page: I'm infected - What do I do now?.
Post the logfile from Farbar Recovery Scan Tool into your next reply.

 

Please let me know if you could succesfully perform the steps above.

 

Good luck!

[Steve_Sr]

Blackbird,

 

I finally got some time to work on this. I made the Hitman Pro USB stick as instructed. When booting to the 2K partition Hitman Pro wouldn't run because it does not support Win2K. I then tried booting to the XP partition and got a ...system32\hal.dll missing or corrupt! error message. Apparently Kickstart doesn't understand dual boot systems.

 

I then tried to boot XP natively and succeeded but the mouse was still not responding correctly. I was able to run Hitman Pro and Farbar from here. I have attached the logs for your review.

 

I am begining to think that this may be some sort of hardware failure and not malware after all.

 

 

Thanks,

 

Steve

 

 

Addition.txt

FRST.txt

HitmanPro_20150115_1139.log

[Blackbird]

Hi,

I want to look a little bit deeper into this system.

Download ComboFix to your Desktop.

WARNING: ComboFix is a very powerful tool that can damage your system when not used properly. ONLY use this tool under supervision of a trained Malware Analyst. Never use it on your own!!!

NOTE: Don't use your computer for other purposes while running ComboFix. It may cause it to stall!

• Temporary disable your own anti-virus and other anti-malware programs. For instructions, take a look here.
• Close all open windows.
• Right-click ComboFix.exe and select Run as Administrator.
• Accept the Disclaimer.
• If you're asked to install the Recovery Console, allow the program to do so.
• The scan may take some time to finish. Wait for it, please.
• If ComboFix asks to restart the system, please allow so immediately.
• When finished, ComboFix will show you a logfile. Please copy/paste the contents of this logfile in your next reply.

If somehow the logfile didn't open or if you can't find it anymore, it's saved as C:\ComboFix.txt.

Also please perform a new scan with FRST and post the logfile into your next reply.

Good luck.

[Steve_Sr]

Blackbird,

 

As requested here are the latest logs from both Combofix and FRST. Please let me know if you need anything else.

 

 

Thanks,

 

Steve

FRST.txt

ComboFix_log.txt

[Blackbird]

Hi,

 

Please try to post back within three days from now on. After that, a topic will be closed due to lack of feedback from the user. We can't keep topics open from weeks, as new logs are posted on a daily basis. Thanks for understanding.

 

1.Please disable Spybot TeaTimer.

 

2. Download RKill and save it to your Desktop.

• Right-click RKill.exe and select Run as Administrator....
• If a Windows Security prompt shows up, please allow the program to start.
• The program will start immediately with it's tasks. When the program has finished, a logfile will appear.
  Please copy the contents of this logfile in your next reply.

 

3. Please download fixlist.txt to your Desktop.

• Please make sure to put fixlist.txt in the same location as where FRST.exe/FRST64.exe is located!

 
4. Start Farbar Recovery Scan Tool by right-clicking it and selecting Run as Administrator.

• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called fixlog.txt. Please include this logfile in your next reply.

 

5. Please delete fixlist.txt from your PC and reboot the system.

 

6. Start Malwarebytes' Anti-Malware.

• On the Dashboard tab, click the Update Now button, to update the definitions to the latest version.
• Then click the Scan tab. Select Custom Scan and click the Start Scan button.
• In the window that appears, check the box next to Scan for Rootkits. Also, select all drives, except for CD/DVD-drives. After you have done this, click Start Scan.
• Follow the instructions given by Malwarebytes' Anti-Malware.
• If any items were found during the scan process, Malwarebytes' Anti-Malware will ask you what you want to do with those items. Please quarantine all items.
• It's possible the program asks you for permission to restart the computer. If so, please allow MBAM to do so immediately.
• Save the logfile in txt-format and copy/paste it in your next reply.
• Note: If you can't find the logfile, look at the "History" tab. Select the most recent logfile (you can see the creation date in the log's title).

 
7. Start Farbar Recovery Scan Tool

• If asked, click Yes at the Disclaimer window.
• Click Scan once the program has opened.
• It will create a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

 

8. Please give me an update on your PC problems and post the logfiles from:

• RKill
  
• Farbar Recovery Scan Tool - using fixlist.txt
  
• Malwarebytes' Anti-Malware
  
• Farbar Recovery Scan Tool - regular scan

 

Good luck.

[Steve_Sr]

Blackbird,

 

I didn't get past step 2 above. Rkill wouldn't run. It says "appdata doesn't exist! Rkill terminated!"

 

There also seems to be something missing in Step 3. Where does the file Fixlist.txt come from? Is it generated by Rkill?

 

So have any of the steps so far found any evidence of malware?

 

What's next?

 

 

Thanks,

 

Steve

[Blackbird]

Hi,

 

The fixlist.txt is the file you have to download by the link I provided to you in my previous post. It is a manual script for FRST, written by myself, specifically for this computer.

 

Just download the file linked to in step 3, and then proceed with step 4 and so on.

[Steve_Sr]

Blackbird,

 

I managed to follow all steps. I got Rkill to run by running it as my user with administrative privelidges. Renaming it didn't help. Appdata... appears to be an issue with Rkill when run directly as administrator.

 

PC is still acting strange with missed and double mouse clicks. This was very noticeable while trying to select all of the drives in MBAM.

 

MBAM didn't appear to find anything except some old warez keygens from the 2K partition. These were probably never executed. Once I found Jotti and then Virus Total I checked everything before running it.

 

The requested log files are attached.

 

 

Thanks,

 

Steve

Rkill.txt

MBAMlog.txt

FRST.txt

Fixlog.txt

[Blackbird]

Hi,

 

General P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

1. Download ComboFix to your Desktop.

WARNING: ComboFix is a very powerful tool that can damage your system when not used properly. ONLY use this tool under supervision of a trained Malware Analyst. Never use it on your own!!!

NOTE: Don't use your computer for other purposes while running ComboFix. It may cause it to stall!

• Temporary disable your own anti-virus and other anti-malware programs. For instructions, take a look here.
• Close all open windows.
• Right-click ComboFix.exe and select Run as Administrator.
• Accept the Disclaimer.
• If you're asked to install the Recovery Console, allow the program to do so.
• The scan may take some time to finish. Wait for it, please.
• If ComboFix asks to restart the system, please allow so immediately.
• When finished, ComboFix will show you a logfile. Please copy/paste the contents of this logfile in your next reply.

If somehow the logfile didn't open or if you can't find it anymore, it's saved as C:\ComboFix.txt.

 

2. Start Farbar Recovery Scan Tool

• If asked, click Yes at the Disclaimer window.
• Click Scan once the program has opened.
• It will create a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

[Steve_Sr]

Blackbird,

 

Here are the latest scan logs. So have any of the tools found any evidence of *active* malware yet?

 

 

Thanks,

 

Steve

FRST.txt

ComboFixLog.txt

[Blackbird]

Hi,

 

Yes, we cleaned up some active malware that was inside your internet browser earlier.

 

Do you still have the same problems?

[Steve_Sr]

Blackbird,

 

Unfortunately, the mouse issue is still present. I think that I am ready to call this a hardware problem.

 

As far as the active malware found can you give me more details about it so that I can attempt to avoid it in the future? BTW, which tool found it? I am mostly interested in what it is, what it does, how it may have got there, and how long it may have been active.

 

As far as security goes I have a hardware firewall in the router, Keep all software updated, run Spybot and BitDefender online scanner. I also use Adblock Plus and run NoScript.

 

However, NoScript is becoming more of an annoyance as most legitimate web sites won't work properly without scripts enabled and it is impossible for the layman to know if a script is malware just by looking at the name.

 

Thanks,

 

Steve

[Blackbird]

Hi Steve,

 

I think it's a hardware problem as well. I can't find any other reason on your system that may cause this problem.

 

The malware present on your system was a browser add-on, called "IE Tab Plus" and beside that some random entries in your system. I've found it using FRST and we deleted it with fixlist. Please don't use this tool without supervision of one of the trained Helpers here, though.

 

The programs you run are good, but to be honest I advise you to replace Spybot with Malwarebytes' Anti-Malware. The detection rate is just higher at MBAM, compared with Spybot. I understand your problem regarding NoScript, and I'm experiencing the same problem sometimes. Nevertheless I still advise you to use it.

 

All Clean!
Congratulations, your computer seems to be clean again! I don't see anymore signs of malware on your system. I feel glad to tell you that we are done here! The steps below will remove the tools we have used, and reset any settings changed. I have also provided a list of recourses and tools that you might find useful.

Download DelFix and save the file to your Desktop.

• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset system settings

  [*]Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + Delete).

==============================================================

I have compiled below a list of resources you may find useful. The articles document information on computer security, common infection vectors and how you can stay safe on the Internet.

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• How to Prevent Malware by miekiemoes, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP

The following programmes come highly recommended in the security community.

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
• Malwarebytes' Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

My help will always be free! However, if you're happy with the help provided and/or want to buy me a drink, you can consider a donation:

==============================================================

Please confirm if you have no outstanding issues, and are happy with the state of your computer. Also please tell me if you got any questions left regarding the removal process we went through and the information I gave you in this post.

[Steve_Sr]

Blackbird,

 

Thanks so much for your assistance in cleaning up my system. Unfortunately, when this PC started having issues I transferred everything over to a spare PC. In doing this I transplanted the infected Firefox profile to the spare PC which I am assuming also brought the problematic IE Tab Plus and maybe some other stuff with it. I have since removed the IE Tab Plus extension. Do we need to do anything else with this PC (the one that I am currently typing on)?

 

I did some internet searching and couldn't find anything specific linking this extension to malware. So how does a tool decide what is malware and what is not? I am assuming that there is a human involved somewhere. I was also surprised to find MBAM pick up Free File Sync which I had previously used is now packed with AdWare thanks to the author. Good program gone bad. Apparently you can avoid the AdWare by doing a Custom installation.

 

Thanks,

 

Steve

[Blackbird]

Hi Steve,

 

No problem, it was a pleasure to help you out.

 

Yes, there is a human involved 'somewhere'. Most of the Helpers here refer to an online database where all these extensions are stored. That database tells us about some log entries if a file/folder/CLSID/etc. is legit or not. Beside that I also googled the extension and found it had malware bundled. This made me delete it from your system. Beside that there's no 'standard' fix or result for us... It depends all on the Malware Analyst.

 

I always advise you to choose the 'custom installation' option in every setup wizard. You never know what kind of features/options are hidden in a setup file.

 

If you don't have any malware related issues on your spare PC, then you don't have to do anything for now. Just keep your PC's updated, and follow up the 'guidelines of the internet'. Read the links in my previous post well, and you'll be protected well enough.

 

Have you got any more questions for me? About my previous post maybe?

[Steve_Sr]

Blackbird,

 

I don't see any signs of malware on the second PC so I think that we are done. Thanks again for all of your help even though it turned out to be a hardware problem. These days hardware is so reliable that no one looks here first especially when the symptoms are sudden and weird like mine.

 

I am still working on digesting everything in your previous post. There is a lot of stuff there. I am most concerned with all of this crypto ransom ware as my backup strategy currently relies on separate physical media but is concurrently online. One attack could take out the main data as well as the backup.

 

I am just curious whether this was one of the cleaner PCs that you have had to work on? I tend to be pretty careful when it comes to safe computing. However, I can't do much for anything that gets in through a zero day browser or browser script, or OS hole. Most virus checkers would be late to this party as well.

 

 

Thanks,

 

Steve

[Blackbird]

Hi Steve,

 

Yes, hardware symptoms are sometimes hard to detect and analyse. Still I like to help you out and we cleaned up some malware anyway, so we didn't do all steps for nothing! Take the time you need to read and analyse all the articles I included in my previous post for you. There's a lot of handy information in them, written by some very capable experts from our communities. If you need any guidance or help with (understanding) them, don't hesitate to ask about it in one of the sections of the Malwarebytes' forums.

 

I'm dealing about 8 years with logs now... so actually I have seen a lot of logs and computers. This was an 'easy one', as it was only a browser add-on. It was easily removed by our tools, using my custom scripts and there wasn't really a challenge. Still, there is a lot to learn in each log - each computer, each person you help - that you're handling with. So in that point of view I'd say there was some useful information in it.

 

The only thing I can advise you is to have at least an up-to-date, real-time virusscanner and beside that, an anti-malware scanner (up-to-date, but it's not needed to be a real-time scanner, although it's preferred). For example, you can use Malwarebytes' Anti-Malware Free or Premium for that.

 

Do you have any questions left? If not, I'll ask a moderator to lock-up this topic, as we're done then.

[Steve_Sr]

Blackbird,

 

I don't have any more questions so you might as well close this topic. Thanks again for all of your help and advice.

 

 

Best regards,

 

Steve