General Check up after virus' found

**jmarket** · 09-16-2017, 11:58 PM

Hello Jaymie,
First thing is you do not have any antivirus app running on your machine, so that is an open door to anything malicious. Please attend to installing or at least enabling a full time antivirus, Would recommend uninstalling your currently disabled security. There are plenty of good ones out there for free such as Avast, 360 Total, Avira etc.

Secondly your hard drive is almost full and this will prevent Windows from operating efficiently. You should remove or relocate unwanted/unused data from your C: drive.

We will need a log from AdwCleaner for further information.

Please download a copy of AdwCleaner from HERE, it is important to download it to your desktop.

Once downloaded to the desktop AdwCleaner will create an icon [MEDIA=imgur]eEGkHPS[/MEDIA]

Should you receive any security warnings or your User Account Control warning appears whilst you are using this application you can safely allow AdwCleaner to continue.

Before running AdwCleaner please ensure all other programs and browsers are closed, then double left click the icon to open it.

AdwCleaner will open, click the scan button to start searching.

[MEDIA=imgur]hBYSf6z[/MEDIA]

The scan may take some time to complete, and when it has any malware found will be automatically selected for quarantining. Click the “Clean” button.

[MEDIA=imgur]ftC2WaB[/MEDIA]

After a few seconds a message should tell you your computer will now reboot. Allow the reboot.

When the computer restarts a log file will be displayed, but if its closed for any reason before copying the contents, you will find a copy of the file if you navigate to C:\AdwCleaner[C#].txt (The C denotes the Clean log)

[MEDIA=imgur]jr9Bx9h[/MEDIA]

Please Copy and Paste the contents of the log file with your next reply.

We now need to run Junkware Removal Tool (JRT) on your computer, please go HERE and download it to your DESKTOP.
Before running JRT ensure your antivirus, and any other security software is disabled, if you are unsure how to do this please ask. Also close browsers and other applications before running this tool.
Should you receive any User Account Control (UAC) alert warning when starting JRT you can safely allow it.

Right click the JRT desktop icon [MEDIA=imgur]fam7djI[/MEDIA] and select “run as administrator” from the menu, for XP users just double click the icon. JRT will open with a simple interface, and ask to press any keyboard key to continue. Please do so.

http://i.imgur.com/B7AebVQ.jpg?1

Depending on the amount of data on your computer JRT may take some time to complete the scan. When JRT finishes a .txt file will be saved and displayed on your desktop, please COPY and PASTE the contents of this file in your next post

**Jaymie1989** · 09-17-2017, 06:02 PM

Thanks for your reply. I have installed Avast.
[HEADING=1]AdwCleaner 7.0.2.1 - Logfile created on Sun Sep 17 17:23:03 2017[/HEADING]
[HEADING=1]Updated on 2017/29/08 by Malwarebytes[/HEADING]
[HEADING=1]Running on Windows 7 Ultimate (X64)[/HEADING]
[HEADING=1]Mode: clean[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\Program Files\e64b5f6d2eee67dc2fc2c18b94e108be

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

C:/AdwCleaner/AdwCleaner[C0].txt - [2128 B] - [2010/1/2 1:38:24]
C:/AdwCleaner/AdwCleaner[S0].txt - [2117 B] - [2010/1/2 1:38:10]
C:/AdwCleaner/AdwCleaner[S1].txt - [1535 B] - [2017/9/16 15:19:2]
C:/AdwCleaner/AdwCleaner[S2].txt - [1193 B] - [2017/9/17 17:22:8]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt ##########

Code:

Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Ultimate x64 
Ran by User (Administrator) on 17/09/2017 at 18:51:01.24

File System: 9

Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\5N1QHZCN (Temporary Internet Files Folder)
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\AFCUQGQQ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\C8261M7R (Temporary Internet Files Folder)
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\L5TZG2PA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\5N1QHZCN (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFCUQGQQ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\C8261M7R (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\L5TZG2PA (Temporary Internet Files Folder)

Registry: 0

Code:

Scan was completed on 17/09/2017 at 18:59:28.31
End of JRT log

**jmarket** · 09-18-2017, 12:33 AM

From the latest log.

Originally posted by Jaymie1989

Name: SM Bus Controller
Description: SM Bus Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)

[ul]
[li]This message from your log is indicative of not having your chipset drivers installed. Looking in Device manager may also confirm this. If the case please only get the drivers from your motherboard/PC manufacturer.[/li][li]Also have you addressed the serious shortage of free disc space?[/li][/ul]

Please left click on the attached Fixlist.txt file at the bottom of this post. On the dialogue box that opens click “Save File” and then “OK”

[MEDIA=imgur]vzol8OV[/MEDIA]

Select a location then save the file. IMPORTANT the fixlist.txt file must be in the same location as the FRST program otherwise the fix will not work.

[MEDIA=imgur]pjsQ8XB[/MEDIA]

To run the fix right click the FRST icon and choose “Run as Administrator” then click on “Fix”

[MEDIA=imgur]cp0349X[/MEDIA]

Depending on the amount of data to be moved it may take a few minutes to complete, and the computer may reboot. When the fix is complete and/or the computer has rebooted the “Fixlist.txt” file you created will be renamed “Fixlog.txt”

Please COPY and PASTE the contents of this new file in your next post:slight_smile:

**Jaymie1989** · 09-18-2017, 01:28 PM

[HEADING=1]Fix result of Farbar Recovery Scan Tool (x64) Version: 17-09-2017 01
Ran by User (18-09-2017 14:13:04) Run:1
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal[/HEADING]
fixlist content:

Start
CreateRestorepoint:
CloseProcesses:
FF Plugin: @microsoft.com/GENUINE → disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE → disabled [No File]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys
S3 tsusbhub; system32\drivers\tsusbhub.sys
S3 VGPU; System32\drivers\rdvgkmd.sys
Task: {021E162C-EDA6-468C-9DD2-28996F336D9C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-09-07] (Piriform Ltd)
Task: {1104C839-6310-4BB9-B27D-60655EDA3A1B} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ gwx\refreshgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe → /RefreshConfigAndContent
Task: {1104C839-6310-4BB9-B27D-60655EDA3A1B} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ gwx\refreshgwxconfigandcontent => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {2EFE862F-7F0B-42E5-BD3B-52EFAE9F78E1} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ GWXTriggers\ScheduleUpgradeReminderTime => Command(1): %windir%\system32\GWX\GWXUXWorker.exe → /ScheduleUpgradeReminderTime
Task: {2EFE862F-7F0B-42E5-BD3B-52EFAE9F78E1} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ GWXTriggers\ScheduleUpgradeReminderTime => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {B68255E5-3D5A-46A9-A7A0-C514F9CBEA29} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ GWXTriggers\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe → /RefreshConfig
Task: {B68255E5-3D5A-46A9-A7A0-C514F9CBEA29} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ GWXTriggers\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe → /RefreshContent
Task: {B68255E5-3D5A-46A9-A7A0-C514F9CBEA29} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ GWXTriggers\refreshgwxconfig-B => Command(3): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {E865C574-2F76-4E37-9ACD-3AFB12F8DDB3} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ gwx\refreshgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe → /RefreshConfig
Task: {E865C574-2F76-4E37-9ACD-3AFB12F8DDB3} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ gwx\refreshgwxconfig => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
FirewallRules: [TCP Query User{3DF8FB50-9CD5-4E6C-BAB1-ACB3F6586743}C:\program files (x86)\kodi\kodi.exe] => (Allow) C:\program files (x86)\kodi\kodi.exe
FirewallRules: [UDP Query User{243CC3E7-DCB6-4225-A129-F30B512228BF}C:\program files (x86)\kodi\kodi.exe] => (Allow) C:\program files (x86)\kodi\kodi.exe
FirewallRules: [{8A301A8A-AE4E-4DF5-9E45-578EBF56B2D2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\System32\Tasks\Safer-Networking
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ gwx
C:\Windows\system32\GWX
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\ GWXTriggers
C:\ProgramData\TEMP

1B5B4F1 [114]
C:\ProgramData\hash.dat
EmptyTemp:
Hosts:
Reboot:
End

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\MozillaPlugins@microsoft.com/GENUINE => key removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins@microsoft.com/GENUINE => key removed successfully
HKLM\System\CurrentControlSet\Services\Synth3dVsc => key removed successfully
Synth3dVsc => service removed successfully
HKLM\System\CurrentControlSet\Services\tsusbhub => key removed successfully
tsusbhub => service removed successfully
HKLM\System\CurrentControlSet\Services\VGPU => key removed successfully
VGPU => service removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{021E162 C-EDA6-468C-9DD2-28996F336D9C} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{021E162 C-EDA6-468C-9DD2-28996F336D9C} => key removed successfully
C:\Windows\System32\Tasks\CCleanerSkipUAC => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CCleaner SkipUAC => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{1104C83 9-6310-4BB9-B27D-60655EDA3A1B} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TreeC:\Window s\System32\Tasks\Microsoft\Windows\Setup\gwx\refre shgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{1104C83 9-6310-4BB9-B27D-60655EDA3A1B} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{2EFE862 F-7F0B-42E5-BD3B-52EFAE9F78E1} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TreeC:\Window s\System32\Tasks\Microsoft\Windows\Setup\GWXTrigge rs\ScheduleUpgradeReminderTime => Command(1): %windir%\system32\GWX\GWXUXWorker.exe => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{2EFE862 F-7F0B-42E5-BD3B-52EFAE9F78E1} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{B68255E 5-3D5A-46A9-A7A0-C514F9CBEA29} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TreeC:\Window s\System32\Tasks\Microsoft\Windows\Setup\GWXTrigge rs\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{B68255E 5-3D5A-46A9-A7A0-C514F9CBEA29} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TreeC:\Window s\System32\Tasks\Microsoft\Windows\Setup\GWXTrigge rs\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{B68255E 5-3D5A-46A9-A7A0-C514F9CBEA29} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{E865C57 4-2F76-4E37-9ACD-3AFB12F8DDB3} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TreeC:\Window s\System32\Tasks\Microsoft\Windows\Setup\gwx\refre shgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{E865C57 4-2F76-4E37-9ACD-3AFB12F8DDB3} => key not found.
HKLM\SYSTEM\CurrentControlSet\services\SharedAcces s\Parameters\FirewallPolicy\FirewallRules\TCP Query User{3DF8FB50-9CD5-4E6C-BAB1-ACB3F6586743}C:\program files (x86)\kodi\kodi.exe => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAcces s\Parameters\FirewallPolicy\FirewallRules\UDP Query User{243CC3E7-DCB6-4225-A129-F30B512228BF}C:\program files (x86)\kodi\kodi.exe => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAcces s\Parameters\FirewallPolicy\FirewallRules\{8A301A8 A-AE4E-4DF5-9E45-578EBF56B2D2} => value removed successfully
C:\Windows\System32\Tasks\Safer-Networking => moved successfully
“C:\Windows\System32\Tasks\Microsoft\Windows\Setup \gwx” => not found.
“C:\Windows\system32\GWX” => not found.
“C:\Windows\System32\Tasks\Microsoft\Windows\Setup \GWXTriggers” => not found.
“C:\ProgramData\TEMP

1B5B4F1 [114]” => not found.
C:\ProgramData\hash.dat => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 3180449 B
Java, Flash, Steam htmlcache => 23589052 B
Windows/system/drivers => 2999604 B
Edge => 0 B
Chrome => 101376 B
Firefox => 1910071 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 33253 B
systemprofile32 => 33253 B
LocalService => 0 B
NetworkService => 450560 B
User => 54018593 B

RecycleBin => 0 B
EmptyTemp: => 90.3 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 14:13:34 ====

I’m sorting out the chipset drivers and a storage space.

**jmarket** · 09-19-2017, 12:43 AM

Originally posted by Jaymie1989

I’m sorting out the chipset drivers and a storage space.

Hi Jaymie, Suggest if you attend to the above your computer should be good to go. Please advise if there are any issues?

**Jaymie1989** · 09-19-2017, 10:04 AM

Hi Gus,

All seems good. No issues.

Thank you.

**jmarket** · 09-20-2017, 12:46 AM

You are welcome, You can remove the tools we used by following this guide.

Please go HERE and download Delfix Save it to your desktop.
Right click the new Delfix desktop icon [MEDIA=imgur]3gArQoZ[/MEDIA] and then click “run as administrator”
Place a tick in the following checkboxes
[ol]
[li]Remove disinfection tools[/li][li]Create registry backup[/li][li]Purge system restore[/li][li]Then select “Run”[/li][/ol]
[MEDIA=imgur]tdR6h0N[/MEDIA]

Delfix will remove the tools used to clean your PC and remove itself. When finished a .txt file will display on your desktop.

General Check up after virus' found

General Check up after virus' found

Comment

Comment

Comment

Comment

Comment

Comment

Comment