Cant connect to websites

[jxdama]

i deleted tools and its all gone but when i downlaod fixlist it says notepad. is that ok?

[Malnutrition]

Yep then download FRST run as admin and click the fix button.

[jxdama]

this is what comes up when i hit download

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
RemoveProxy:
HKLM...\Run: =>
S2 avast; “C:\Program Files\AVAST Software\Browser\Update\AvastBrowserUpdate.exe” /svc
S3 avastm; “C:\Program Files\AVAST Software\Browser\Update\AvastBrowserUpdate.exe” /medsvc
HKU\S-1-5-21-2314338359-2121603862-2684469121-1000...\Run: [AvastBrowserIsDefault] => “C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtector .exe” --force-protect (No File)
HKLM...\Windows NT x86\Print Processors\winprint: localspl.dll (No File)
Task: {33047591-8B4F-4E15-A0CF-4B4A30556B90} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files\AVAST Software\Browser\Update\AvastBrowserUpdate.exe /c (No File)
Task: {6F5E79BC-5451-4BE4-8858-F7F7B4B1B754} - System32\Tasks\JavaUpdateAdministrator => C:\Windows\system32\jusched.exe (No File)
Task: {F0C37474-8AF1-4947-8556-6C4C06128A88} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files\AVAST Software\Browser\Update\AvastBrowserUpdate.exe /ua /installsource scheduler (No File)
S3 謌챊젳২精诿ﱊ젳￨靖룿栨旟૩ﯦ쳿쳌쳌䶋菰Ӂ䗩诿솃郊￬咋ࠤ䊍謌젳짨靖룿桤旟퓩ﯥ쳿쳌쳌쳌쳌쳌쳌쳌 ⡪䖋僤靖菿ࣄ诃觩诿삃倌䖋僠秨菿ࣄ诃༁಄HdsKe; C:\Windows\system32\drivers\謌챊젳২精诿ﱊ젳￨靖룿栨旟૩ﯦ쳿쳌쳌䶋菰Ӂ䗩 诿솃郊￬咋ࠤ䊍謌젳짨靖룿桤旟퓩ﯥ쳿쳌쳌쳌쳌쳌쳌쳌⡪䖋僤靖菿ࣄ诃觩诿삃倌䖋僠秨菿ࣄ诃 ༁಄HdsKe.sys [84928 2017-09-07] (AVAST Software) [File not signed]
C:\Windows\system32\drivers\謌챊젳২精诿ﱊ젳￨靖룿栨旟૩ﯦ쳿쳌쳌䶋菰Ӂ䗩 诿솃郊￬咋ࠤ䊍謌젳짨靖룿桤旟퓩ﯥ쳿쳌쳌쳌쳌쳌쳌쳌⡪䖋僤靖菿ࣄ诃觩诿삃倌䖋僠秨菿ࣄ诃 ༁಄HdsKe.sys
C:\Users\John\AppData\Roaming\wklnhst.dat
C:\Users\John\AppData\Local\0CMR8yFmkXh
C:\Users\John\AppData\Local\1hu4i5i6c1wx6ngdh3brb4 vh33mo74i8k66043
C:\Users\John\AppData\Local\e32lig0acfqskqq
C:\Users\John\AppData\Local\q3k132b461d0vlmjgwe342 3qks888wt4i067x
C:\Users\John\AppData\Local\R4AlO7HdsW5
C:\Users\John\AppData\Local{BF478C30-F17C-40D8-8397-984D790151A8}
CustomCLSID: HKU\S-1-5-21-2314338359-2121603862-2684469121-1000_Classes\CLSID{47198917-0962-7895-9795-211497132047}\InprocServer32 → C:\Users\John\AppData\Local\Temp\npd.dll => No File
CustomCLSID: HKU\S-1-5-21-2314338359-2121603862-2684469121-1000_Classes\CLSID{51906541-9778-0483-4923-241141919285}\InprocServer32 → C:\Users\John\AppData\Local\Temp\npd.dll => No File
CustomCLSID: HKU\S-1-5-21-2314338359-2121603862-2684469121-1000_Classes\CLSID{7629C9DE-2E38-4963-A01C-02FFAC203D87}\InprocServer32 → C:\Program Files\AOL 9.0\axtrack.dll => No File
URLSearchHook: HKU\S-1-5-21-2314338359-2121603862-2684469121-1000 - (No Name) - {03402f96-3dc7-4285-bc50-9e81fefafe43} - No File
BHO: No Name → {02478D38-C3F9-4efb-9B51-7695ECA05670} → No File
BHO: No Name → {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} → No File
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-2314338359-2121603862-2684469121-1000 → No Name - {61539ECD-CC67-4437-A03C-9AACCBD14326} - No File
FirewallRules: [{C133EC92-F266-4770-AE47-0907D744B98D}] => (Allow) C:\Program Files\AOL\RC\regclient.exe => No File
FirewallRules: [{20DBAB36-0150-4D56-BC7D-54541BE99CD0}] => (Allow) C:\Program Files\AOL\RC\regclient.exe => No File
FirewallRules: [{409BA08A-77F4-4A4D-992F-B6A8C2BEA8B5}] => (Allow) C:\Program Files\Common Files\aol\acs\AOLDial.exe => No File
FirewallRules: [{8B5638FA-DE84-45C7-9BC6-978A743378C4}] => (Allow) C:\Program Files\Common Files\aol\acs\AOLDial.exe => No File
FirewallRules: [{DF95CEE6-1067-4A15-AF9E-814CE1FA82E6}] => (Allow) C:\Program Files\Common Files\aol\acs\AOLacsd.exe => No File
FirewallRules: [{028FE028-17D8-4F17-86B2-A75431342C79}] => (Allow) C:\Program Files\Common Files\aol\acs\AOLacsd.exe => No File
FirewallRules: [{034FF40F-BEF0-41DF-A275-9ADDA0E1B9D2}] => (Allow) C:\Program Files\AOL 9.0\waol.exe => No File
FirewallRules: [{F3AE08AF-70CD-4291-8B8B-F12AD64A57BC}] => (Allow) C:\Program Files\AOL 9.0\waol.exe => No File
FirewallRules: [{C2375134-BB0B-4A77-B2D0-F77CBBC733B4}] => (Allow) C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe => No File
FirewallRules: [{B74C0255-0363-4721-9ECE-FBDCEDDE3008}] => (Allow) C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe => No File
FirewallRules: [{887358AC-FFBB-4D2D-AA5A-BC075B527666}] => (Allow) C:\Program Files\Common Files\aol\System Information\sinf.exe => No File
FirewallRules: [{13BFD45F-CF68-4EE8-AB8F-798534491DC6}] => (Allow) C:\Program Files\Common Files\aol\System Information\sinf.exe => No File
FirewallRules: [{4B02A4DA-033C-446D-9CBA-8F15BE579CF8}] => (Allow) C:\Program Files\AOL\RC\regclient.exe => No File
FirewallRules: [{7874A038-C8C4-4AC3-8E31-A2E7256564E7}] => (Allow) C:\Program Files\AOL\RC\regclient.exe => No File
FirewallRules: [{59A90F23-9877-45CD-A803-CDE2A96E6F8F}] => (Allow) C:\Program Files\Common Files\aol\ACS\AOLDial.exe => No File
FirewallRules: [{144F2593-F905-49C8-AC64-E06BED99271E}] => (Allow) C:\Program Files\Common Files\aol\ACS\AOLDial.exe => No File
FirewallRules: [{BC18F993-9262-4132-8699-D07D226CE809}] => (Allow) C:\Program Files\Common Files\aol\ACS\AOLacsd.exe => No File
FirewallRules: [{1E5BA508-903A-4F15-8E9E-35FBFB97BF10}] => (Allow) C:\Program Files\Common Files\aol\ACS\AOLacsd.exe => No File
FirewallRules: [{FACA43AB-EF9E-44C0-8075-8F53F77541CC}] => (Allow) C:\Program Files\AOL 9.0\waol.exe => No File
FirewallRules: [{6862ABA1-CD2D-445C-B923-3BA9E6143310}] => (Allow) C:\Program Files\AOL 9.0\waol.exe => No File
FirewallRules: [{B7319344-442A-416B-9DB7-D0CAE33DE301}] => (Allow) C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe => No File
FirewallRules: [{3C1CD680-FC89-4B2B-BC29-900E787123AD}] => (Allow) C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe => No File
FirewallRules: [{6E42CD65-F903-4BD4-8EEC-1ADD17BF0914}] => (Allow) C:\Program Files\Common Files\aol\System Information\sinf.exe => No File
FirewallRules: [{5DDE8334-035E-490C-AB30-12440EF16748}] => (Allow) C:\Program Files\Common Files\aol\System Information\sinf.exe => No File
FirewallRules: [{282E5F63-F2DE-4390-990C-31EDBDF45A97}] => (Allow) C:\Program Files\Common Files\aol\1212182531\ee\aolsoftware.exe => No File
FirewallRules: [{CA5E833B-4277-4352-832F-AB028D206023}] => (Allow) C:\Program Files\Common Files\aol\1212182531\ee\aolsoftware.exe => No File
FirewallRules: [{C86B1F57-57D4-45E2-AB94-0A02254EA863}] => (Allow) C:\Program Files\AIM6\aim6.exe => No File
FirewallRules: [{30D77DDD-3A5B-411C-A015-B783C97EBA4F}] => (Allow) C:\Program Files\AIM6\aim6.exe => No File
FirewallRules: [TCP Query User{85AAFA08-706B-49E1-999B-B5FF8BD3AA6D}C:\program files\java\jre6\bin\java.exe] => (Block) C:\program files\java\jre6\bin\java.exe => No File
FirewallRules: [UDP Query User{AF2C37B3-6DFE-441F-870C-FF59F0AC308E}C:\program files\java\jre6\bin\java.exe] => (Block) C:\program files\java\jre6\bin\java.exe => No File
FirewallRules: [{7A079647-21C6-4286-9747-39ECC71EB2CA}] => (Allow) C:\Program Files\AVG\Av\avgmfapx.exe => No File
FirewallRules: [{C679F87D-AC18-409F-8F53-8138C5E43D83}] => (Allow) C:\Program Files\AVG\Av\avgmfapx.exe => No File
FirewallRules: [{5930E0D1-F887-4C3D-AFA7-663F001D3755}] => (Allow) C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe => No File
SearchScopes: HKU\S-1-5-21-2314338359-2121603862-2684469121-1000 → {6FFC5051-438A-4405-9F3C-54DFE9532F52} URL = hxxp://www.ask.com/web?q={searchTerms}&l=dis&o=uscqd
C:\Windows\system32\drivers\etc\hosts
Hosts:
MSCONFIG\startupreg: ApnUpdater => “C:\Program Files\Ask.com\Updater\Updater.exe”
FirewallRules: [{857D3169-708F-4F8D-BA1F-E6CCF850BF2C}] => (Allow) LPort=80
FirewallRules: [{205B24DF-41BD-4198-AB65-428419E931C9}] => (Allow) LPort=80
FirewallRules: [{7AC26C43-F94F-47C3-A07C-07F39E26E8C9}] => (Allow) LPort=80
Task: {EC2DD444-24FC-414F-B116-674077F8029E} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => Command(1): C:\Windows\servicing\vsp1ceip.exe [175104 [2008-01-19]] (Microsoft Windows → Microsoft Corporation)
Task: {9AE06C97-3310-4680-BE3B-FEE61B6440FB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpda teService.exe [335416 2020-12-08] (Adobe Inc. → Adobe) [File not signed]
Task: {A0364B18-9C67-4642-A27D-19F8E1364E9D} - System32\Tasks\PC-Doctor\Scheduled Maintanence => C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe [73728 2007-06-25] (PC-Doctor, Inc.) [File not signed]
Task: {7AF197DA-602F-486C-BD9B-8328544A7E5C} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_32_ 0_0_465_Plugin.exe [1504312 2020-12-08] (Adobe Inc. → Adobe) [File not signed]
HKLM...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Windows → Microsoft Corporation)
HKLM...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-02-18] (Hewlett-Packard Company → Hewlett-Packard)
HKLM...\Run: [SunJavaUpdateReg] => C:\Windows\system32\jureg.exe [54680 2009-03-08] (Sun Microsystems, Inc. → Sun Microsystems, Inc.)
HKLM...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems, Incorporated → Adobe Systems Incorporated)
HKLM...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle America, Inc. → Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19...\Run: [WindowsWelcomeCenter] => C:\Windows\system32\oobefldr.dll [2153472 2008-01-19] (Microsoft Windows → Microsoft Corporation)
HKU\S-1-5-20...\Run: [WindowsWelcomeCenter] => C:\Windows\system32\oobefldr.dll [2153472 2008-01-19] (Microsoft Windows → Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] → C:\Program Files\Google\Chrome\Application\49.0.2623.112\Inst aller\chrmstp.exe [2022-03-23] (Google Inc → Google Inc.)
MD: del /f /s /q %windir%\prefetch*.*
CMD: del /s /q C:\Windows\SoftwareDistribution\download*.*
CMD: del /s /q “%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache*."
CMD: del /s /q "%userprofile%\AppData\Local\temp*.”
CMD: ipconfig /flushdns
C:\Windows\Temp*.*
C:\WINDOWS\system32*.tmp
C:\WINDOWS\syswow64*.tmp
emptytemp:
Reboot:
End::

[jxdama]

when i click frst 32 bit it says failed to update and i get that scan box again. I dont think the first thing updated

[Malnutrition]

this is what comes up when i hit download

Yep. Now you download FRST.exe then right click it and run as admin and hit the fix button.

Click me to download FRST.

[ATTACH type=“full”]11008[/ATTACH]

[jxdama]

That whole bunch of stuff is what comes up when i click on download me

[Malnutrition]

I dont think the first thing updated

Not a problem just hit the fix button as in the picture.

[Malnutrition]

Yep. Now you download FRST.exe then right click it and run as admin and hit the fix button.
Click me to download FRST.

    [IMG alt="1671038564456.png"]https://pchelpforum.net/attachments/1671038564456-png.11008/

[jxdama]

I hit fix and it stopped responding after 5 minutes and got stuck. I had to click out of that so i could come back here

[jxdama]

all my passwords are gone

[Malnutrition]

Allow it to complete, it may take some time as there is malware on your computer.

If it will not complete in 15 minutes, then let me know.

[Malnutrition]

all my passwords are gone

Just run the fix and get back to me. Nothing in that fixlist deals with any passwords.

[Malnutrition]

All passwords in your browsers can be viewed with this tool.

https://www.nirsoft.net/utils/web_browser_password.html

[jxdama]

thanks, i found the passwords. IS it normal for it to get stuck? It didnt do anything for 5 minutes. Said it wasnt responding. It wont eliminate bookmarks, will it? Also, it never downlaoded on my desktop so i couldnt click run as admin

[jxdama]

Ok, we will clear the other download and run it like this.
Download KpRM
start the program
Check Delete Tools’

Do the steps below in order this should get you going.

Then download the fixlist Click me to download fixlist.
Then download FRST 32 bit
Right click FRST run as admin and hit the fix button.

Those 1st 2 things click me to download fixlist and FRST 32 bit never downlaoded anywhere so i cant hit run as admin. a box came up saying ready to run or something like that and i hit fix. I got so lost in this im late for work. Back tonight and thanks again.