Win 10 BSOD

[jmarket]

Whilst I look over your logs will you please move FRST program, and the Frst.txt and Additions.txt files to your desktop as per my instructions.
Please also remove any external drives and cd’s etc whilst we proceed with this.

Also please open Chrome
Click the three dots to the right of the URL bar
Click on Settings in the dropdown list
Click Extensions on the left hand list
Remove any extensions relating to Avast, plus any others you dont use.

[Loosie]

OK, I put all the ‘prework’ in a folder on my desktop & thought that was OK, sorry - has been what I’ve always done in the past. It’s now out of the folder for you. I didn’t realise there was a DVD in the drive - now removed.

I do not have Google Chrome on my machine(to my knowledge - doesn’t come up in search so don’t think it’s hiding somewhere). I use Firefox & also have Microsoft Edge installed by default, but don’t use that one. I presume I don’t need to install Chrome?? I cannot find any extensions relating to Avast in Firefox, and cannot find an extensions tab in Edge at all!

[jmarket]

Please left click on the attached Fixlist.txt file at the bottom of this post. On the dialogue box that opens click “Save File” and then “OK”

https://pchelpforum.net/proxy.php?image=http%3A%2F%2Fi.imgur.com%2Fvzol8OV .jpg&hash=60483f868df807006c3eb7113a487891

Save the file to the desktop. IMPORTANT the fixlist.txt file must be in the same location as the FRST program otherwise the fix will not work.

https://pchelpforum.net/proxy.php?image=http%3A%2F%2Fi.imgur.com%2FpjsQ8XB .jpg&hash=3c583e7fbab51c73233ca05c2fb7eaa7

To run the fix right click the FRST icon and choose “Run as Administrator” then click on “Fix”

https://pchelpforum.net/proxy.php?image=http%3A%2F%2Fi.imgur.com%2Fcp0349X .jpg&hash=2da87348afa0449c33228b851f3367cb

Depending on the amount of data to be moved it may take a few minutes to complete, and the computer may reboot. When the fix is complete and/or the computer has rebooted the “Fixlist.txt” file you created will be renamed “Fixlog.txt”

[COLOR=rgb(250, 197, 28)]Please COPY and PASTE the contents of this new file in your next post[COLOR=rgb(250, 197, 28)][/COLOR][/COLOR]

[Loosie]

Fix Log;
[HEADING=1]Fix result of Farbar Recovery Scan Tool (x64) Version: 28-04-2020
Ran by Anya (29-04-2020 17:45:42) Run:1
Running from C:\Users\Anya\Desktop
Loaded Profiles: Anya (Available Profiles: USER & Anya & Administrator)
Boot Mode: Normal[/HEADING]
fixlist content:

---

Start:
CreateRestorepoint:
CloseProcesses:
BHO: No Name → {13D67BB7-DB5F-48AA-884D-7A5D94168509} → No File
BHO-x32: No Name → {13D67BB7-DB5F-48AA-884D-7A5D94168509} → No File
Toolbar: HKLM-x32 - FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~2\FRESHD~1\FRESHD~1\fdiebar.dll No File
FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\Anya\AppData\Roaming\Mozilla\Firefox\Prof iles\ji7iaqgm.default\Extensionssp@avast.com.xpi [2019-10-22]
FF Extension: (Avast Online Security) - C:\Users\Anya\AppData\Roaming\Mozilla\Firefox\Prof iles\ji7iaqgm.default\Extensionswrc@avast.com.xpi [2019-10-22]
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
CustomCLSID: HKU\S-1-5-21-440688634-2831198262-268214595-1002_Classes\CLSID{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 → C:\Users\Anya\AppData\Local\Microsoft\OneDrive\19. 174.0902.0013\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-440688634-2831198262-268214595-1002_Classes\CLSID{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 → C:\Users\Anya\AppData\Local\Microsoft\OneDrive\19. 174.0902.0013\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-440688634-2831198262-268214595-1002_Classes\CLSID{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 → C:\Users\Anya\AppData\Local\Microsoft\OneDrive\19. 174.0902.0013\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [ OneDrive1] → {BBACC218-34EA-4666-9D7A-C78F2274A524} => → No File
ShellIconOverlayIdentifiers: [ OneDrive2] → {5AB7172C-9C11-405C-8DD5-AF20F3606282} => → No File
ShellIconOverlayIdentifiers: [ OneDrive3] → {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => → No File
ShellIconOverlayIdentifiers: [ OneDrive4] → {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => → No File
ShellIconOverlayIdentifiers: [ OneDrive5] → {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => → No File
ShellIconOverlayIdentifiers: [ OneDrive6] → {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => → No File
ShellIconOverlayIdentifiers: [ OneDrive7] → {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => → No File
ShellIconOverlayIdentifiers: [00asw] → {472083B0-C522-11CF-8763-00608CC02F24} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] → {BBACC218-34EA-4666-9D7A-C78F2274A524} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] → {5AB7172C-9C11-405C-8DD5-AF20F3606282} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] → {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] → {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] → {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] → {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => → No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] → {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => → No File
FirewallRules: [{2B96CE60-1BDE-479F-9214-16265E3B1734}] => (Allow) %systemroot%\system32\alg.exe No File
FirewallRules: [{9C4B6BD7-BDA7-4632-AB00-AB9B75D4E4A5}] => (Allow) %systemroot%\system32\alg.exe No File
C:\Users\Anya\AppData\Roaming\AVAST Software
C:\ProgramData\AVAST Software
Hosts:
EmptyTemp:
Reboot:
End:

---

Restore point was successfully created.
Processes closed successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects{13D67BB7-DB5F-48AA-884D-7A5D94168509} => removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\Browser Helper Objects{13D67BB7-DB5F-48AA-884D-7A5D94168509} => removed successfully
“HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ED0E8CA5-42FB-4B18-997B-769E0408E79D}” => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID{ED0E8CA5-42FB-4B18-997B-769E0408E79D} => removed successfully
C:\Users\Anya\AppData\Roaming\Mozilla\Firefox\Prof iles\ji7iaqgm.default\Extensionssp@avast.com.xpi => moved successfully
C:\Users\Anya\AppData\Roaming\Mozilla\Firefox\Prof iles\ji7iaqgm.default\Extensionswrc@avast.com.xpi => moved successfully
“AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}” => removed successfully
HKU\S-1-5-21-440688634-2831198262-268214595-1002_Classes\CLSID{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => removed successfully
HKU\S-1-5-21-440688634-2831198262-268214595-1002_Classes\CLSID{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => removed successfully
HKU\S-1-5-21-440688634-2831198262-268214595-1002_Classes\CLSID{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\00asw => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully
“HKLM\SYSTEM\CurrentControlSet\services\SharedAcce ss\Parameters\FirewallPolicy\FirewallRules\{2B96CE 60-1BDE-479F-9214-16265E3B1734}” => removed successfully
“HKLM\SYSTEM\CurrentControlSet\services\SharedAcce ss\Parameters\FirewallPolicy\FirewallRules\{9C4B6B D7-BDA7-4632-AB00-AB9B75D4E4A5}” => removed successfully
C:\Users\Anya\AppData\Roaming\AVAST Software => moved successfully
C:\ProgramData\AVAST Software => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 10772480 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 185689996 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 3714876 B
Edge => 2570181 B
Chrome => 15012691 B
Firefox => 157167821 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 34126 B
USER => 561579 B
Anya => 21852734 B
Administrator => 21883359 B

RecycleBin => 0 B
EmptyTemp: => 399.8 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 17:48:58 ====

[jmarket]

Please go HERE and download AdwCleaner to your [COLOR=rgb(250, 197, 28)]Desktop[/COLOR][COLOR=rgb(250, 197, 28)]. Once downloaded right click the new icon and select Run as Administrator from the context menu to open the program. It will open at the Dashboard tab and no further changes to the program are necessary at this stage.

Click the Scan Now button.

https://pchelpforum.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2FILRtBy H.jpg&hash=b94d258b509e14069dc86f22876a302d

Allow AdwCleaner to start scanning and depending on the amount of data on your PC it may take some time. At the conclusion of the scan any content considered unnecessary will be displayed in the Scan Results box. Ensure all items are selected for removal and click “Clean & Repair”

https://pchelpforum.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2FrodxNo u.jpg&hash=f7b587326d412e7aeb5bc46dc0ce7e36

After selecting “Clean & Repair” another dialogue box may appear asking to restart now or later. If so choose “Clean & Restart Now”

https://pchelpforum.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2FsAbeW6 Z.jpg&hash=f269614302ac6b8e122473d4c5eaea6a

Once the PC has restarted if AdwCleaner does not restart then open it again and click “Log Files” tab on the left. All log files will be listed. If you have used the program previously you may have several logs to select from so double click the most recent “Clean” log and it will open a notepad file on your Desktop.

Please COPY and PASTE the contents of that file in your next post:slight_smile:[/color]

[Loosie]

OK, AdwCleaner didn’t give me a ‘clean & repair’ option after scanning, but it offered to ‘quarrantine’(as if I haven’t had enough of that!) and that seemed to do the job. Below are both the Scan log & the clean log

Scan;
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Malwarebytes AdwCleaner 8.0.4.0[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Build: 04-03-2020[/HEADING]
[HEADING=1]Database: 2020-04-08.2 (Cloud)[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Mode: Scan[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Start: 04-30-2020[/HEADING]
[HEADING=1]Duration: 00:00:44[/HEADING]
[HEADING=1]OS: Windows 10 Pro[/HEADING]
[HEADING=1]Scanned: 31802[/HEADING]
[HEADING=1]Detected: 16[/HEADING]
***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

PUP.Optional.Restoro C:\Windows\restoro.ini

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

PUP.Adware.Heuristic C:\Windows\System32\Tasks\FreeDownloadManagerNetwo rkMonitor

***** [ Registry ] *****

PUP.Adware.Heuristic HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot{51C7FEED-5391-4B44-AAD1-98D2227E41C0}#
PUP.Adware.Heuristic HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{51C7FEE D-5391-4B44-AAD1-98D2227E41C0}#
PUP.Adware.Heuristic HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FreeDown loadManagerNetworkMonitor
PUP.Optional.Legacy HKLM\Software\Classes\Interface{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy HKLM\Software\Classes\Interface{BD51A48E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\Interface{9BB31A D8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\Interface{BD51A4 8E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Restoro HKCU\Software\Local AppWizard-Generated Applications\Restoro
PUP.Optional.Restoro HKCU\Software\Restoro
PUP.Optional.Restoro HKLM\Software\Classes\CLSID{AE198C69-7358-4856-9029-F4C0FAD524C1}
PUP.Optional.Restoro HKLM\Software\Classes\CLSID{BA827421-E282-479E-AE60-34796877B8AE}
PUP.Optional.Restoro HKLM\Software\Classes\Restoro.Engine
PUP.Optional.Restoro HKLM\Software\Restoro

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

PUP.Optional.BrowseToSave SaveFrom.net helper - helper-sig@savefrom.net

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.

AdwCleaner_Debug.log - [10467 octets] - [09/09/2019 19:33:30]
AdwCleaner[S00].txt - [1591 octets] - [09/09/2019 19:34:28]
AdwCleaner[C00].txt - [1732 octets] - [09/09/2019 19:58:41]
AdwCleaner[S01].txt - [1509 octets] - [18/09/2019 08:44:39]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S02].txt ##########

Clean;
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Malwarebytes AdwCleaner 8.0.4.0[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Build: 04-03-2020[/HEADING]
[HEADING=1]Database: 2020-04-08.2 (Cloud)[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Mode: Clean[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Start: 04-30-2020[/HEADING]
[HEADING=1]Duration: 00:00:03[/HEADING]
[HEADING=1]OS: Windows 10 Pro[/HEADING]
[HEADING=1]Cleaned: 16[/HEADING]
[HEADING=1]Failed: 0[/HEADING]
***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

Deleted C:\Windows\restoro.ini

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted C:\Windows\System32\Tasks\FreeDownloadManagerNetwo rkMonitor

***** [ Registry ] *****

Deleted HKCU\Software\Local AppWizard-Generated Applications\Restoro
Deleted HKCU\Software\Restoro
Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot{51C7FEED-5391-4B44-AAD1-98D2227E41C0}#
Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{51C7FEE D-5391-4B44-AAD1-98D2227E41C0}#
Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FreeDown loadManagerNetworkMonitor
Deleted HKLM\Software\Classes\CLSID{AE198C69-7358-4856-9029-F4C0FAD524C1}
Deleted HKLM\Software\Classes\CLSID{BA827421-E282-479E-AE60-34796877B8AE}
Deleted HKLM\Software\Classes\Interface{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Deleted HKLM\Software\Classes\Interface{BD51A48E-EB5F-4454-8774-EF962DF64546}
Deleted HKLM\Software\Classes\Restoro.Engine
Deleted HKLM\Software\Restoro
Deleted HKLM\Software\Wow6432Node\Classes\Interface{9BB31A D8-5DB2-459E-A901-DEA536F23BA4}
Deleted HKLM\Software\Wow6432Node\Classes\Interface{BD51A4 8E-EB5F-4454-8774-EF962DF64546}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

Deleted SaveFrom.net helper - helper-sig@savefrom.net

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.

---

[+] Delete Tracing Keys
[+] Reset Winsock

---

AdwCleaner_Debug.log - [10467 octets] - [09/09/2019 19:33:30]
AdwCleaner[S00].txt - [1591 octets] - [09/09/2019 19:34:28]
AdwCleaner[C00].txt - [1732 octets] - [09/09/2019 19:58:41]
AdwCleaner[S01].txt - [1509 octets] - [18/09/2019 08:44:39]
AdwCleaner[S02].txt - [3103 octets] - [30/04/2020 13:06:11]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C02].txt ##########

[jmarket]

Please supply a fresh Speccy log

[Loosie]

http://speccy.piriform.com/results/V...1uF4hoxjNkIV6i Yay, I can’t see Avast listed - can you??

[jmarket]

The majority of Avast remnant are gone, it is pretty well impossible to completely remove every scrap of Avast but what remains should not affect your machine.

Will move this thread back for attention of @phillpower2

[Loosie]

OK, thanks so much again.

[phillpower2]

Thanks gus (y)

Is there something still outstanding that you need help with Loosie

[Loosie]

Hopefully that’s this one done, but I did start another thread(think same prob) for my daughter’s machine that hasn’t yet been got to.

[phillpower2]

Can`t help you with that so you will need the expertise of gus again.