Im getting what looks like virus/adware

[Antoine]

well I got the Additional is but not the FRST if I try to paste or attach that nothing. I even tried different browses. Couldnt do either on Chrome or firefox. Microsoft Edge at least let me paste the Additional.txt but when I try the FRST I get the same error message and still cant attach it

[jmarket]

Ok I found the culprit. Try it again It should work this time. You were still triggering our firewall.

[Antoine]

Ok I found the culprit. Try it again It should work this time. You were still triggering our firewall.

nope same thing

[jmarket]

Your PC keeps triggering our firewall. Are you able to upload the required files to Google drive or OneDrive and share the link?

[Antoine]

lol why didnt I think of that… brb

[jmarket]

Appreciate it Normally we don’t have this issue but your PC seems to be trying to upload other files along with it, which is triggering a block.

[Antoine]

https://drive.google.com/file/d/1dw_...ew?usp=sharing FRST

https://drive.google.com/file/d/11aP...ew?usp=sharing Additional

[jmarket]

Awesome It’s late here but I’ll look at your logs in-between work tomorrow. Sorry about all the hurdles but we’ll get you taken care of

[Antoine]

Awesome It’s late here but I’ll look at your logs in-between work tomorrow. Sorry about all the hurdles but we’ll get you taken care of

Well if my files are trying to upload other stuff along with it wouldnt you say there might be something else t hat need sto be looked in to too? Also the malware pop ups and stuff have goten worse since that scan was done. At first it was just 1 or 2 of the same fake alert or pop up showing now theres all sorts of different ones

[jmarket]

You have what’s called Rogue alerts. Here’s what you can do in the meantime:

We will need a log from AdwCleaner for further information.

Please go HERE and download AdwCleaner to your Desktop. Once downloaded right click the new icon and select Run as Administrator from the context menu to open the program. It will open at the Dashboard tab and no further changes to the program are necessary at this stage.

Click the Scan Now button.

[IMG alt="oklj3amfOpqEpPVXnuqk79lHRApDnhPQVXn6z6Y3NoRuE Owdc4_mOGQu11P43d4Fb8OGSEeDJ_AsebIM9FWRakQeH_rBtmE r8_ua1VJwBd_Ws3-miUSngeShjQ7W5K4p6SytCWs2=w2400" width="627px" height="401px"]https://lh3.googleusercontent.com/oklj3amfOpqEpPVXnuqk79lHRApDnhPQVXn6z6Y3NoRuEOwdc4 _mOGQu11P43d4Fb8OGSEeDJ_AsebIM9FWRakQeH_rBtmEr8_ua 1VJwBd_Ws3-miUSngeShjQ7W5K4p6SytCWs2=w2400[/IMG]

Allow AdwCleaner to start scanning and depending on the amount of data on your PC it may take some time. At the conclusion of the scan any content considered unnecessary will be displayed in the Scan Results box. Ensure all items are selected for removal and click “Clean & Repair”
[IMG alt="7pQdUft-ojpPn88OGfzif4Zs2nG7cOkKWXOxq2hnIP5ll37IPbMzLUh9W3 aC0wQonD-NEIwql19Hh7DJiYPOF1HL71bdqy81MiaqpcsP5f0JtykiLSk-l96KByQKj1ou2rexlOpo=w2400" width="627px" height="401px"]https://lh3.googleusercontent.com/7pQdUft-ojpPn88OGfzif4Zs2nG7cOkKWXOxq2hnIP5ll37IPbMzLUh9W3 aC0wQonD-NEIwql19Hh7DJiYPOF1HL71bdqy81MiaqpcsP5f0JtykiLSk-l96KByQKj1ou2rexlOpo=w2400[/IMG]

After selecting “Clean & Repair” another dialogue box may appear asking to restart now or later. If so choose “Clean & Restart Now”
Once the PC has restarted if AdwCleaner does not restart then open it again and click “Log Files” tab on the left. All log files will be listed. If you have used the program previously you may have several logs to select from so double click the most recent “Clean” log and it will open a notepad file on your Desktop.

Please COPY and PASTE the contents of that file in your next post (or if you can’t please upload to Google Drive and share link)

We need you to run Malwarebytes Anti-Malware (MBAM) to get a log. Please download the free version of Malwarebytes HERE

Save the file to somewhere you can easily find it. Double click the saved file to start the install, accept any security warnings that may appear and after the install click the new desktop icon https://pchelpforum.net/attachments/mwb-jpg.481 to start the program. We need to modify a couple of things with MalwareBytes before we use it so please follow the steps below.

[ul]
[li]If the dashboard is not already displayed select it.[/li][li]Then select Update to get the latest definition database.[/li][/ul]

https://pchelpforum.net/attachments/mwb1-jpg.482

[ul]
[li]Next we need to change a scanning option, select Settings on the main menu[/li][li]Then Detection and Protection on the left.[/li][li]Then select Scan for rootkits in the detection options, as well as the other two options already checked.[/li][/ul]

https://pchelpforum.net/attachments/mwb2-jpg.483

Now return to Dashboard on the main menu and select Scan Now at the bottom of the screen.

https://pchelpforum.net/attachments/mwb3-jpg.484

[ul]
[li]Allow Malwarebytes to scan your system. It may take some time depending on how much data loaded onto your hard drive. When the scan is finished any threats will be listed for action. Ensure all threats are selected, and click Remove Selected[/li][/ul]

https://pchelpforum.net/attachments/mwb5-jpg.489

A dialogue box may open and ask to restart the computer, if so select Yes

https://pchelpforum.net/attachments/mwb7cc-jpg.486

Once the computer restarts open Malwarebytes again and select History on the menu bar, Application logs, then click the scan just completed, then click Export, choose text file. Name the text file and select a location, preferably the desktop and close Malwarebytes.

https://pchelpforum.net/attachments/mwb8aa-jpg.492

Please copy and paste the contents of the text file in your next post (or upload to Google Drive if unable and post link)

[jmarket]

I’ve almost got a first fix for you. However I do have a couple questions:

[ul]
[li]Are you running a cracked version of Windows or Office? The reason I ask is because I see a lot of GWX files.[/li][li]Are you using Avast for anti-virus?[/li][/ul]
I await your response as well as the logs for MBAM and AdwCleaner

[Antoine]

I’ve almost got a first fix for you. However I do have a couple questions:

[ul]
[li]Are you running a cracked version of Windows or Office? The reason I ask is because I see a lot of GWX files.[/li][li]Are you using Avast for anti-virus?[/li][/ul]
I await your response as well as the logs for MBAM and AdwCleaner

Ill get those scans done after work, As for a cracked version or Windows orf Office, I dunno bu Id say Im 90% certain that Im not running a cracked version. As for Avast it definitely USE Dto be on the PC dont remember if it still is but Im 99% certain thats still there, Ill check in a few hours

[jmarket]

In this case since you’re unsure, I would honestly recommend you just do a clean install of Windows 10. Here’s the easiest way to do it:

[ol]
[li]Select the Start button, then select Settings > Update & Security > Recovery .[/li][li]Under Reset this PC, select Get started and then choose Remove everything[/li][/ol]

This will ensure no unwanted software is left over.

[Antoine]

[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Malwarebytes AdwCleaner 8.1.0.0[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Build: 02-15-2021[/HEADING]
[HEADING=1]Database: 2021-01-26.1 (Cloud)[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Mode: Clean[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Start: 03-01-2021[/HEADING]
[HEADING=1]Duration: 00:00:01[/HEADING]
[HEADING=1]OS: Windows 10 Pro[/HEADING]
[HEADING=1]Cleaned: 3[/HEADING]
[HEADING=1]Failed: 0[/HEADING]
***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \AppContainer\Storage\microsoft.microsoftedge_8wek yb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotomi.com
Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \AppContainer\Storage\microsoft.microsoftedge_8wek yb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\dotomi.com
Deleted HKCU\Software\drpsu

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.

---

[+] Delete Tracing Keys
[+] Reset Winsock

---

AdwCleaner[S00].txt - [4353 octets] - [01/03/2021 18:29:12]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Malwarebytes AdwCleaner 8.1.0.0[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Build: 02-15-2021[/HEADING]
[HEADING=1]Database: 2021-01-26.1 (Cloud)[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Mode: Scan[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Start: 03-01-2021[/HEADING]
[HEADING=1]Duration: 00:00:30[/HEADING]
[HEADING=1]OS: Windows 10 Pro[/HEADING]
[HEADING=1]Scanned: 1672[/HEADING]
[HEADING=1]Detected: 21[/HEADING]
***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.DriverPack HKCU\Software\drpsu
PUP.Optional.Legacy HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \AppContainer\Storage\microsoft.microsoftedge_8wek yb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotomi.com
PUP.Optional.Legacy HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \AppContainer\Storage\microsoft.microsoftedge_8wek yb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\dotomi.com

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

Preinstalled.CyberLinkLabelPrint Folder C:\Program Files (x86)\CYBERLINK\LABELPRINT
Preinstalled.CyberLinkLabelPrint Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}
Preinstalled.CyberLinkLabelPrint Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall{C59C179C-668D-49A9-B6EA-0121CCFC1243}
Preinstalled.CyberLinkMediaEspresso Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{EEE8493 7-7BE0-4117-8233-DEB9AC0CDFA8}
Preinstalled.CyberLinkMediaEspresso Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DeviceDe tector
Preinstalled.CyberLinkMediaEspresso Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}
Preinstalled.CyberLinkMediaEspresso Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall{E3739848-5329-48E3-8D28-5BBD6E8BE384}
Preinstalled.CyberLinkMediaEspresso Task C:\Windows\System32\Tasks\DEVICEDETECTOR
Preinstalled.LenovoLBAI Folder C:\Program Files (x86)\LENOVO\LBAI
Preinstalled.LenovoLBAI Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall{C5C91B7B-38A6-40B7-84D6-E44885E44B13}is1
Preinstalled.LenovoPower2Go Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\StartupApproved\Run32|CLMLServer
Preinstalled.LenovoPower2Go Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Run|CLMLServer
Preinstalled.LenovoPower2Go Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall\InstallShield{40BF1E83-20EB-11D8-97C5-0009C5020658}
Preinstalled.LenovoPower2Go Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall{40BF1E83-20EB-11D8-97C5-0009C5020658}
Preinstalled.LenovoPowerDVD Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\StartupApproved\Run32|RemoteControl10
Preinstalled.LenovoPowerDVD Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Run|RemoteControl10
Preinstalled.LenovoPowerDVD Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}
Preinstalled.LenovoPowerDVD Registry HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Uninstall{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/1/21
Scan Time: 6:50 PM
Log File: 425003a2-7af1-11eb-976e-00c2c671cd06.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1173
Update Package Version: 1.0.37649
License: Trial

-System Information-
OS: Windows 10 (Build 19042.804)
CPU: x64
File System: NTFS
User: Owner-PC\Owner

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 309885
Threats Detected: 14
Threats Quarantined: 14
Time Elapsed: 3 min, 55 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 1
PUP.Optional.Spigot.Generic, HKU\S-1-5-21-1014905426-3769363605-1701117676-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default \extensions.settings|mkodglccjkggchpdpiikgcjplniem dej, Quarantined, 8440, 530199, , , , , ,

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.Spigot.Generic, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Extension Settings\mkodglccjkggchpdpiikgcjplniemdej, Quarantined, 8440, 530199, , , , , ,
PUP.Optional.Spigot.Generic, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MKODGLCCJKGGCHPDPIIKGCJPLN IEMDEJ, Quarantined, 8440, 530199, 1.0.37649, , ame, , ,

File: 11
PUP.Optional.MindSpark, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_free.yourtemplatefinder.com_0.localst orage, Quarantined, 373, 368613, 1.0.37649, , ame, , ED793943AB6AE40E95400CE999792ADF, 04D65DF798B7A75C04847CC6BCBF314C1D4CC4D5D9C6E4B9A6 6EAA719EB3807B
PUP.Optional.MindSpark, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_free.yourtemplatefinder.com_0.localst orage-journal, Quarantined, 373, 368613, 1.0.37649, , ame, , ,
PUP.Optional.Spigot.Generic, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 8440, 530199, , , , , B9FC002873F554FA6A6F056487E4F8DB, 0E9F7E23F4B8022F4F50358F7E960A2B04F1036476CD5371F2 7E359B44F72C6B
PUP.Optional.Spigot.Generic, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, 8440, 530199, , , , , D976BE80FFC1AFFF4F8099C942C98136, 1BAAE80E48527E70075DCDCAD686AF5E17275CBB7EA18461C5 D4157188EC3FCF
PUP.Optional.Spigot.Generic, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\mkodglccjkggchpdpiikgcjplniemdej\000003.l og, Quarantined, 8440, 530199, , , , , A124216219A171524D904EF1133AA8DD, 5DCD57725749FC53038685425AFCF86E69008AC2202F123286 81A62270ADA7F6
PUP.Optional.Spigot.Generic, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\mkodglccjkggchpdpiikgcjplniemdej\CURRENT, Quarantined, 8440, 530199, , , , , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39 D6D0D70B780443
PUP.Optional.Spigot.Generic, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\mkodglccjkggchpdpiikgcjplniemdej\LOCK, Quarantined, 8440, 530199, , , , , ,
PUP.Optional.Spigot.Generic, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\mkodglccjkggchpdpiikgcjplniemdej\LOG, Quarantined, 8440, 530199, , , , , C42735BE079EA4DAD2664BAE59647A52, BD41E994A30ADE5401FECFB408C493B216E45FB9E39A192888 D65F0C4955F511
PUP.Optional.Spigot.Generic, C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\mkodglccjkggchpdpiikgcjplniemdej\MANIFEST-000001, Quarantined, 8440, 530199, , , , , 5AF87DFD673BA2115E2FCF5CFDB727AB, F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F6 12160FEAD4B2B4
PUP.Optional.Spigot.Generic, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MKODGLCCJKGGCHPDPIIKGCJPLN IEMDEJ\1.4_0\CHROMERESTORE.JS, Quarantined, 8440, 530199, 1.0.37649, , ame, , 6F85D53053625DA783F81BF7CC7B79DF, 46F28DCE019D8BF1408027E19FECBE463BB4DCB1958758E59D C7F4B57B316491
PUP.Optional.Spigot.Generic, C:\USERS\OWNER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MKODGLCCJKGGCHPDPIIKGCJPLN IEMDEJ\1.4_0\BACKGROUND.JS, Quarantined, 8440, 774169, 1.0.37649, , ame, , E279CD0E85F41939C18E65E52914EC51, 9A92934AEFD9A850CCA0BFEA7BAFFE629ACD8E7B03340BDA04 2E082D6CB7D6EE

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[Antoine]

After doing all that Im still getting a few your pc is infected/at risk messages (including one from Macafee despite not having macafee on my pc… i notice the macafee pop up also says google chrome so maybe its a chrome extension?) Im doing a second MAlwarebytes scan since teh first one was just a quick scan of the memory, startup files and file systems etc etc. and only took 3 mins, this new one is scanning every drive in full has gone 30 mins so far but hasnt found anything yet. Ill let you know if it does