Download
AV block remover .
Unzip it (but
not to the Desktop or
Download folder ), perhaps inside of documents folder or on the c programfiles folder ...run it, and follow the instructions. If it doesn't start, rename the file AVbr.exe in, for example, AV-br.exe (or any other name).
If it doesn't start anyway, run it in safe mode with network .
Looking back everything loaded thru One drive.
Can you disable that?
Everything is
C:\Users\domin\OneDrive\Desktop\Auto\AutoLogger\AV\av_z.exe
When it should be C:\Users\domin\Desktop\Auto\AutoLogger\AV\av_z.exe
Look in the Autologger folder and drag out the CheckBrowsersLNK file.
To your desktop.
AutoLogger\CheckBrowserLnk
Drag and drop onto the
ClearLNK utility .
After saving ClearLNK to desktop.
Run
HijackThis! as admin! (located in the folder ...Autologger\HijackThis)
Do a system scan, then check each item below, make sure and only check the items listed.
Then click Fix checked.
The computer will need to reboot, allow it to do so.
Code:
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo\BatteryGauge (empty)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo\ImController\TimeBasedEvents (empty)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\McAfeeTsk (empty)
O22 - Tasks: (damaged) \Microsoft\Windows\Application Experience\MareBackup - C:\WINDOWS\system32\compattelrunner.exe -m:aemarebackup.dll -f:BackupMareData (user missing) (sign: 'Microsoft')
O22 - Tasks: (damaged) \Microsoft\Windows\Application Experience\MareBackup - C:\WINDOWS\system32\compattelrunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun (user missing) (sign: 'Microsoft')
O22 - Tasks: NahimicSvc32Run - C:\Windows\SysWOW64\NahimicSvc32.exe $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (sign: 'Microsoft')
O22 - Tasks: NahimicSvc64Run - C:\Windows\system32\NahimicSvc64.exe $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (sign: 'Microsoft')
O22 - Tasks: NahimicTask32 - C:\WINDOWS\system32\..\SysWOW64\NahimicSvc32.exe $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (sign: 'Microsoft')
O22 - Tasks: NahimicTask64 - C:\WINDOWS\system32\.\NahimicSvc64.exe $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (sign: 'Microsoft')
O22 - Tasks_Migrated: (telemetry) \Lenovo\Vantage\Schedule\DailyTelemetryTransmission - C:\Program Files (x86)\Lenovo\VantageService\3.8.23.0\ScheduleEventAction.exe DailyTelemetryTransmission (file missing)
O22 - Tasks_Migrated: \Lenovo\BatteryGauge\BatteryGaugeMaintenance - C:\ProgramData\Lenovo\ImController\Plugins\LenovoBatteryGaugePackage\x64\BGHelper.exe (file missing)
O22 - Tasks_Migrated: \Lenovo\LenovoWelcomeLauncher - C:\ProgramData\Lenovo\ImController\Plugins\LenovoFirstRunExperiencePackage\x86\LenovoWelcome.exe /task (file missing)
O22 - Tasks_Migrated: \Lenovo\LenovoWelcomeTask - C:\ProgramData\Lenovo\ImController\Plugins\LenovoFirstRunExperiencePackage\x86\LenovoWelcomeTask.exe $(EventData) (file missing)
O22 - Tasks_Migrated: \Lenovo\Vantage\Schedule\HeartbeatAddinDailyScheduleTask - C:\Program Files (x86)\Lenovo\VantageService\3.8.23.0\ScheduleEventAction.exe HeartbeatAddinDailyScheduleTask (file missing)
O22 - Tasks_Migrated: \McAfeeTsk\OOBEUpgrader - C:\Program Files\McAfee\MSC\OOBE_Upgrader.exe /Run (file missing)
O22 - Tasks_Migrated: OneDrive Reporting Task-S-1-5-21-4241844815-1059841684-711678986-1001 - C:\Users\domin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /reporting (file missing)
O22 - Tasks_Migrated: OneDrive Standalone Update Task-S-1-5-21-4241844815-1059841684-711678986-1001 - C:\Users\domin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (file missing)
Disable your antivirus prior to running AVZ!
Run
AVZ as admin! (located in the folder ...Autologger\AVZ) click
File => Customs Scripts.
Copy the content of the text file I uploaded. (AVZFix.txt)
Click edit select all copy.
Paste into AVZ window.
Make sure the word begin is in the absolute top left of the window as per picture below.
Hit Run Fix.
The computer will reboot.
Code:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
QuarantineFile('C:\ProgramData\princeton-produce','');
QuarantineFile('C:\WINDOWS\system32\rfxvmt.dll','');
DeleteFile('C:\WINDOWS\system32\rfxvmt.dll','');
DeleteFile('C:\ProgramData\princeton-produce','');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
ExecuteRepair(6);
RebootWindows(true);
end.
(