Computer Hope
Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: SHESHE on March 08, 2016, 02:26:01 PM
-
I have a Dell Inspiron 17 currently running Windows 10 with Microsoft Edge. The day I installed Windows 10 (which I thought was from the Microsoft website) I started getting pop ups that I was infected by some kind of virus and to call Microsoft at such and such phone number. The warning wasn't from McAfee which is my virus protection and I had heard about this scam before. I try to close the window and others pop up. So, I went and used Firefox to access the internet.
I ran the scans that were listed on this site and here they are:
AdwCleaner
# AdwCleaner v5.101 - Logfile created 08/03/2016 at 14:16:09
# Updated 07/03/2016 by Xplode
# Database : 2016-03-08.1 [Server]
# Operating system : Windows 10 Home (x64)
# Username : Sheila - SHEILARAE
# Running from : C:\Users\Sheila\Downloads\adwcleaner_5.101.exe
# Option : Clean
# Support : http://toolslib.net/forum
***** [ Services ] *****
[-] Service Deleted : swdumon
***** [ Folders ] *****
[-] Folder Deleted : C:\Users\Sheila\AppData\Local\slimware utilities inc
***** [ Files ] *****
[-] File Deleted : C:\WINDOWS\SysNative\drivers\swdumon.sys
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
[-] Key Deleted : HKCU\Software\APN PIP
[-] Key Deleted : HKCU\Software\SlimWare Utilities Inc
[-] Key Deleted : HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.
[-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\C3F6D7A0BA2FDE84EB329997B1FF786D
[-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\C3F6D7A0BA2FDE84EB329997B1FF786D
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C3F6D7A0BA2FDE84EB329997B1FF786D
- Key Deleted : [x64] HKLM\SOFTWARE\Classes\Installer\Products\C3F6D7A0BA2FDE84EB329997B1FF786D
***** [ Web browsers ] *****
*************************
:: "Tracing" keys removed
:: Winsock settings cleared
*************************
C:\Program Files (x86)\AdwCleaner\AdwCleaner[C1].txt - [1948 bytes] - [08/03/2016 14:16:09]
C:\Program Files (x86)\AdwCleaner\AdwCleaner[S1].txt - [1963 bytes] - [08/03/2016 14:14:20]
########## EOF - C:\Program Files (x86)\AdwCleaner\AdwCleaner[C1].txt - [2134 bytes] ##########
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 3/8/2016
Scan Time: 2:31 PM
Logfile:
Administrator: Yes
Version: 2.2.0.1024
Malware Database: v2016.03.08.06
Rootkit Database: v2016.02.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 10
CPU: x64
File System: NTFS
User: Sheila
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 359898
Time Elapsed: 24 min, 40 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 1
PUP.Optional.DriverUpdate, C:\Users\Public\Documents\Downloaded Installers\{9DE6EA82-B1F4-4156-9565-B38A1AA2D924}, Quarantined, [5501f98ccecb2b0b515e9555eb1715eb],
Files: 1
PUP.Optional.DriverUpdate, C:\Users\Public\Documents\Downloaded Installers\{9DE6EA82-B1F4-4156-9565-B38A1AA2D924}\setup.msi, Quarantined, [5501f98ccecb2b0b515e9555eb1715eb],
Physical Sectors: 0
(No malicious items detected)
(end)
Results of screen317's Security Check version 1.014 --- 12/23/15
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Enabled!
Windows Defender
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````[/u]
Adobe Flash Player 20.0.0.306
Mozilla Firefox (44.0.2)
````````Process Check: objlist.exe by Laurent````````[/u]
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````[/u]
Thank you in advance for your assistance.
Sheila
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please download Junkware Removal Tool (http://thisisudax.org/downloads/JRT.exe) to your desktop.
•Warning! Once the scan is complete JRT will shut down your browser with NO warning.
•Shut down your protection software now to avoid potential conflicts.
•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this (http://www.bleepingcomputer.com/forums/topic114351.html) link to see a list of security programs that should be disabled and how to disable them.
•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator
•The tool will open and start scanning your system.
•Please be patient as this can take a while to complete depending on your system's specifications.
•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
•Copy and Paste the JRT.txt log into your next message.
*************************************************
You have two AV's running on your computer; Windows Defender and McAfee. One should be de-activated or uninstalled.Windows Defender is the default AV that comes with Win10
-
Thank you Dave for your help. So, what you are saying is that I don't need McAfee anymore? I just want to verify before I delete it.
Here is the log from JRT.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Windows 10 Home x64
Ran by Sheila (Administrator) on Wed 03/09/2016 at 13:51:15.87
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 3
Successfully deleted: C:\users\Public\Documents\downloaded installers (Folder)
Successfully deleted: C:\WINDOWS\system32\Tasks\PCDEventLauncherTask (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\PCDoctorBackgroundMonitorTask (Task)
Deleted the following from C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\hijyizz7.default\prefs.js
user_pref(browser.search.defaultenginename, Secure Search);
user_pref(browser.search.defaultenginename.US, Secure Search);
user_pref(browser.search.order.1, Secure Search);
user_pref(browser.search.selectedEngine, Secure Search);
Registry: 3
Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\0259691457549012mcinstcleanup (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6983788E-77A1-4F72-A019-22DA9083A52B} (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D16AAB9A-6038-4C45-9D58-7EF2DE54FB29} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 03/09/2016 at 13:53:20.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
So, what you are saying is that I don't need McAfee anymore? I just want to verify before I delete it.
If you paid for it, you should use it until the subscription runs out. You disable Windows Defender. IMO WD is as good as McAfee.
I'd like to scan your machine with ESET OnlineScan
•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan (http://eset.com/onlinescan)
•Click the (http://i424.photobucket.com/albums/pp322/digistar/esetOnline.png) button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on (http://i424.photobucket.com/albums/pp322/digistar/esetSmartInstall.png) to download the ESET Smart Installer. Save it to your desktop.
- Double click on the (http://i424.photobucket.com/albums/pp322/digistar/esetSmartInstallDesktopIcon-1.png) icon on your desktop.
•Check (http://i424.photobucket.com/albums/pp322/digistar/esetAcceptTerms.png)
•Click the (http://i424.photobucket.com/albums/pp322/digistar/esetStart.png) button.
•Accept any security warnings from your browser.
- Leave the check mark next to Remove found threats.
•Check (http://i424.photobucket.com/albums/pp322/digistar/esetScanArchives.png)
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push (http://i424.photobucket.com/albums/pp322/digistar/esetListThreats.png)
•Push (http://i424.photobucket.com/albums/pp322/digistar/esetExport.png), and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the (http://i424.photobucket.com/albums/pp322/digistar/esetBack.png) button.
•Push (http://i424.photobucket.com/albums/pp322/digistar/esetFinish.png)
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
-
Thanks Dave
I ran ESET SCAN and it took almost 2 hours. It said there was no issues/threats. I hit finish and the program crashed. I looked to see if there was anything in C:\Program Files\ESET\ESET Online Scanner\log.txt and there was nothing. Do I need to re-run the scan?
Thank you,
Sheila
-
How's your computer working now? Still having problems?
-
So far, so good. I have not had the message. I hope it's gone! Thank you so much for your help Dave.
-
Let's give it a few days. If it still good, come back and we'll do some cleanup.