Password reset and notification emails are now sending correctly.
If you recently requested a password reset, please check your inbox (and spam folder just in case).
You can now reset your password and log in as normal.
Welcome back to PCHF, and thank you for your patience during our migration process!
— The PCHF Team
Welcome to PC Help Forum!
You’re viewing our community as a guest.
That means you can browse posts, but can’t yet reply or start new topics.
Join us today — it's completely free!
As a member, you'll be able to:
✅ Get personalized tech support from trusted volunteers
🦠 Work one-on-one with our Malware Removal Specialists
Stupid question but was this the .com at one time?
Different site.
I see no real indicator of malware on your machine, what issues are you having that brings you here?
VirusTotal Scan.
[ul]
[li]Please go to VirusTotal.[/li][li]Click the Choose File button.[/li][li]Navigate to >>>>>>>> C:\Windows\system32{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat[/li][li]or simply copy and paste it. [/li]
[li]Include the link in your next reply.[/li][/ul] FRST Fix.
Download attached fixlist.txt file and save it to the Desktop. NOTE. It’s important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Clean up temp files and reduce startup load with CCleaner.
Note: This tool will clean your browsing history as well.
[ul]
[li]Download CCleaner from here.[/li][li]After install Click Options.[/li][li]Go to monitoring.[/li][li]Uncheck All Monitoring items.[/li][li]Go to advanced – Click close program after cleaning.[/li][li]Go to settings – click run ccleaner when the computer starts.[/li][li]Now that you have ccleaner installed and set-up:[/li][li]Open the program.[/li][li]Go to Tools[/li][li]Go to Startup[/li][li]Now double click each item. To Disable.[/li][li]Leave only your antivirus enabled.[/li][li]Then disable All items in your scheduled task as well.[/li][li]Unless they are related to windows defender.Or your antivirus.[/li][li]Reboot the machine.[/li][/ul] ZHP Scan.
Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.
Once you have started the program, you will need to click the scanner button.
The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.
[URL unfurl="true"]http://windowsinstructed.com/wp-content/uploads/2015/06/6QJjV50.png[/URL]
At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.
Copy and paste the report here in your next reply.
Thanks, for the quick reply. I tried running the aswmbr but got the blue screen. My son was downloading a texture pack for minecraft and one of the fake security screens popped up looking official and from Microsoft.
I will start on the rest of the work that you added.
I do not find "C:\Windows\system32{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat" in the first step. If I search it shows up in a file explorer search but if I try to past of look for it it says file not found
I do not find "C:\Windows\system32{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat" in the first step.
Well, it is not a windows file and it appears suspicious… We will remove it in a bit, after all of the above please do the following.
Rogue Killer Scan.
Download RogueKiller from one of the following links and save it to your Desktop:
Link 1
Link 2
[ul]
[li]Close all the running programs[/li][li]Double click on downloaded setup.exe file to install the program.[/li][li]Click on Start Scan button.[/li][li]Click on another Start Scan button.[/li][li]Wait until the Status box shows Scan Finished[/li][li]Click on Delete.[/li][li]Wait until the Status box shows Deleting Finished.[/li][li]Click on Report and copy/paste the content of the Notepad into your next reply.[/li][li]RKreport.txt could also be found on your desktop.[/li][li]If more than one log is produced post all logs.[/li][/ul]
Zemana Deep Scan.
[ul]
[li]Right click on Zemana and run as admin.[/li][/ul]
[ul]
[li]Click the Cog/Sproket Wheel, at the top right of Zemana[/li][/ul]
[ul]
[li]Select Advanced - I have read the warning and wish to proceed.[/li][/ul]
[ul]
[li]Place a tick next to Detect Suspicious (Root CA) Certificates.[/li][/ul]
[ul]
[li]Then click the house icon in Zemana.[/li][/ul]
[ul]
[li]Then hit your start button at the lower left hand corner of your desktop.[/li][/ul]
[ul]
[li]Then left click on Computer.[/li][/ul]
[ul]
[li]Drag Local Disk C: Into the area of Zemana that reads Drag and drop files here to scan them.[/li][/ul]
[ul]
[li]http://i.imgur.com/bOVO6lY.png[/li][/ul]
[ul]
[li]Once the scan has completed click graph icon on the top right of the programs User interface.[/li][/ul]
[ul]
[li]Double click to open the latest log-file.[/li][/ul]
[ul]
[li]Copy it to your clipboard.[/li][/ul]
[ul]
[li]Post the log here in your next reply.[/li][/ul]
Operating System : Windows 10 (10.0.10586) 64 bits version
Started in : Normal mode
User : CRJ [Administrator]
Started from : C:\Users\CRJ\Desktop\RogueKillerX64.exe
Mode : Delete – Date : 02/17/2017 06:40:14 (Duration : 00:18:41)
¤¤¤ Processes : 0 ¤¤¤
¤¤¤ Registry : 2 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S haredAccess\Parameters\FirewallPolicy\FirewallRule s | {8A929421-DBC9-43A3-B823-7701E1831825} : v2.25|Action=Allow|Active=TRUE|Dir=In|Protocol=6|P rofile=Private|App=C:\Users\CRJ\AppData\Local\Temp \WZSE0.TMP\Common\EpsonNet Setup\ENEasyApp.exe|Name=EpsonNet Setup| → Not selected
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S haredAccess\Parameters\FirewallPolicy\FirewallRule s | {8E183632-AE0D-4A77-80F5-721A212C4BD8} : v2.25|Action=Allow|Active=TRUE|Dir=In|Protocol=17| Profile=Private|App=C:\Users\CRJ\AppData\Local\Tem p\WZSE0.TMP\Common\EpsonNet Setup\ENEasyApp.exe|Name=EpsonNet Setup| → Not selected
What Rogue killer found is likely a false positive. Your machine is clean, it was likely just a pop up from a bad website, should be nothing to worry about unless it is happening constantly across many websites.
Just go ahead and post the FRST fix and the ZHP scan, and let me know if there are any other issues.
Here is the final scans. It took me a while to figure out the fix file for FRST. Had to change the file name to the correct one. lol. Thanks I appreciate everything.
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVers ion\Internet Settings\Connections\DefaultConnectionSettings => value removed successfully
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVers ion\Internet Settings\Connections\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-517047234-2264697268-270894284-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-517047234-2264697268-270894284-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\SavedLegacySettings => value removed successfully
========= End of RemoveProxy: =========
========= netsh advfirewall reset =========
Ok.
========= End of CMD: =========
========= netsh advfirewall set allprofiles state ON =========
Ok.
========= End of CMD: =========
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
=========== EmptyTemp: ==========
BITS transfer queue => 32768 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 59747642 B
Java, Flash, Steam htmlcache => 21730101 B
Windows/system/drivers => 578325814 B
Edge => 8668004 B
Chrome => 492476128 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 61440 B
NetworkService => 983408 B
CRJ => 14788726 B
Connor => 212133244 B
RecycleBin => 3191617918 B
EmptyTemp: => 4.3 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 09:23:42 ====
~ ZHPCleaner v2017.2.16.28 by Nicolas Coolman (2017/02/16)
~ Run by CRJ (Administrator) (18/02/2017 09:47:57)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : ZHP
~ State version : Version OK
~ Type : Repair
~ Report : C:\Users\CRJ\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\CRJ\AppData\Roaming\ZHP\ZHPCleaner_Quaran tine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Home, 64-bit (Build 10586)
—\ Browser internet (0)
~ No malicious or unnecessary items found.
—\ Hosts file (1)
~ The hosts file is legitimate (1)
—\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.
—\ Explorer ( File, Folder) (30)
MOVED file: C:\Windows\Installer\wix{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{3540181E-340A-4E7A-B409-31663472B2F7}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{CDB60A91-DA13-41AA-A827-7967BEC75AF8}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{D4D86CB2-2370-4691-8272-3869EDED6C64}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Users\CRJ\AppData\Local\Temp\wct880C.tmp =>.Superfluous.Temporary.Various
MOVED file: C:\Users\CRJ\AppData\Local\Temp\wct8F76.tmp =>.Superfluous.Temporary.Various
MOVED folder^: C:\Program Files (x86)\GIGABYTE\EasyTuneEngineService =>Heuristic.Pirrit
MOVED folder: C:\Program Files (x86)\QuickTime =>Riskware.QuickTime
MOVED folder: C:\Users\CRJ\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>PUP.Optional.DomaIQ
MOVED folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime =>Riskware.QuickTime
MOVED folder: C:\Windows\Installer\MSI1EDB.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI1F69.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI1FB8.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI28F7.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI307A.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI30E9.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3138.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI7C30.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI7CEC.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI7DB9.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI8346.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI83A5.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI8413.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI980A.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI9916.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSICFD6.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSID1BE.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSID733.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSIDE0B.tmp- =>.Superfluous.Empty
—\ Other deletions. (20)
~ Registry Keys Tracing deleted (20)
~ Remove the old reports ZHPCleaner. (0)
—\ Result of repair
~ Repair carried out successfully
~ Browser not found (Mozilla Firefox)
~ Browser not found (Opera Software)
~ The system has been restarted.
suggest the following in place of adblock.
Alternate DNS Server. Ad Blocking DNS.
Ublock Origin.
Anti Ad Block Killer.
Also, keep your browsing private with these tools:
Self Destructing Cookies.
Self Destructing Cookies Chrome.
Some items to keep you safe on the internet.
VooDoo Shield. control of what is running on your machine
Qualys BrowserCheck To update plugins.
Web Of Trust To Avoid Shady Websites.
Unchecky To Avoid Bundled Software.
Privazer To Clean up your mahcine.
Now Lets Clean up the tools we used and remove old restore points.
DownloadDelFix by “Xplode” to your Desktop.
Right Click the tool and Run as Admin ( Xp Users Double Click)
Put a check mark next the items below:
Remove disinfection tools
Create registry backup
Purge System Restore
Now click on “Run” button.
allow the program to complete its work.
all the tools we used will be removed.
Tool will create and open a log report (DelFix.txt)
Note: The report can be located at the following location C:\DelFix.txt
We process personal data about users of our site, through the use of cookies and other technologies, to deliver our services, personalize advertising, and to analyze site activity. We may share certain information about our users with our advertising and analytics partners. For additional details, refer to our Privacy Policy.
By clicking "I AGREE" below, you agree to our Privacy Policy and our personal data processing and cookie practices as described therein. You also acknowledge that this forum may be hosted outside your country and you consent to the collection, storage, and processing of your data in the country where this forum is hosted.
Tweet
Comment