Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: possible virus after downloading/installing Windows 10  (Read 3211 times)

0 Members and 1 Guest are viewing this topic.

SHESHE

    Topic Starter


    Beginner

    Thanked: 1
    possible virus after downloading/installing Windows 10
    « on: March 08, 2016, 02:26:01 PM »
    I have a Dell Inspiron 17 currently running Windows 10 with Microsoft Edge.  The day I installed Windows 10 (which I thought was from the Microsoft website) I started getting pop ups that I was infected by some kind of virus and to call Microsoft at such and such phone number.  The warning wasn't from McAfee which is my virus protection and I had heard about this scam before.  I try to close the window and others pop up.  So, I went and used Firefox to access the internet.
    I ran the scans that were listed on this site and here they are:

    AdwCleaner
    # AdwCleaner v5.101 - Logfile created 08/03/2016 at 14:16:09
    # Updated 07/03/2016 by Xplode
    # Database : 2016-03-08.1 [Server]
    # Operating system : Windows 10 Home  (x64)
    # Username : Sheila - SHEILARAE
    # Running from : C:\Users\Sheila\Downloads\adwcleaner_5.101.exe
    # Option : Clean
    # Support : http://toolslib.net/forum

    ***** [ Services ] *****

    [-] Service Deleted : swdumon

    ***** [ Folders ] *****

    [-] Folder Deleted : C:\Users\Sheila\AppData\Local\slimware utilities inc

    ***** [ Files ] *****

    [-] File Deleted : C:\WINDOWS\SysNative\drivers\swdumon.sys

    ***** [ DLLs ] *****


    ***** [ Shortcuts ] *****


    ***** [ Scheduled tasks ] *****


    ***** [ Registry ] *****

    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
    [-] Key Deleted : HKCU\Software\APN PIP
    [-] Key Deleted : HKCU\Software\SlimWare Utilities Inc
    [-] Key Deleted : HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.
    [-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\C3F6D7A0BA2FDE84EB329997B1FF786D
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\C3F6D7A0BA2FDE84EB329997B1FF786D
    [-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C3F6D7A0BA2FDE84EB329997B1FF786D
    • Key Deleted : [x64] HKLM\SOFTWARE\Classes\Installer\Products\C3F6D7A0BA2FDE84EB329997B1FF786D


    ***** [ Web browsers ] *****


    *************************

    :: "Tracing" keys removed
    :: Winsock settings cleared

    *************************

    C:\Program Files (x86)\AdwCleaner\AdwCleaner[C1].txt - [1948 bytes] - [08/03/2016 14:16:09]
    C:\Program Files (x86)\AdwCleaner\AdwCleaner[S1].txt - [1963 bytes] - [08/03/2016 14:14:20]

    ########## EOF - C:\Program Files (x86)\AdwCleaner\AdwCleaner[C1].txt - [2134 bytes] ##########


    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 3/8/2016
    Scan Time: 2:31 PM
    Logfile:
    Administrator: Yes

    Version: 2.2.0.1024
    Malware Database: v2016.03.08.06
    Rootkit Database: v2016.02.27.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 10
    CPU: x64
    File System: NTFS
    User: Sheila

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 359898
    Time Elapsed: 24 min, 40 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 1
    PUP.Optional.DriverUpdate, C:\Users\Public\Documents\Downloaded Installers\{9DE6EA82-B1F4-4156-9565-B38A1AA2D924}, Quarantined, [5501f98ccecb2b0b515e9555eb1715eb],

    Files: 1
    PUP.Optional.DriverUpdate, C:\Users\Public\Documents\Downloaded Installers\{9DE6EA82-B1F4-4156-9565-B38A1AA2D924}\setup.msi, Quarantined, [5501f98ccecb2b0b515e9555eb1715eb],

    Physical Sectors: 0
    (No malicious items detected)


    (end)

    Results of screen317's Security Check version 1.014 --- 12/23/15 
       x64 (UAC is enabled) 
     Internet Explorer 11 
    ``````````````Antivirus/Firewall Check:``````````````[/u]
     Windows Firewall Enabled! 
    Windows Defender                     
    McAfee Anti-Virus and Anti-Spyware   
     WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````[/u]
     Adobe Flash Player    20.0.0.306 
     Mozilla Firefox (44.0.2)
    ````````Process Check: objlist.exe by Laurent````````[/u] 
     Malwarebytes Anti-Malware mbamservice.exe 
     Malwarebytes Anti-Malware mbam.exe 
     Malwarebytes Anti-Malware mbamscheduler.exe   
    `````````````````System Health check`````````````````[/u]
     Total Fragmentation on Drive C:  %
    ````````````````````End of Log``````````````````````[/u]


    Thank you in advance for your assistance.
    Sheila


    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 990
    • Certifications: List
    • Experience: Expert
    • OS: Windows 8
    Re: possible virus after downloading/installing Windows 10
    « Reply #1 on: March 09, 2016, 10:28:50 AM »
    Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
    *************************************************************************
    Please download Junkware Removal Tool to your desktop.

    Warning! Once the scan is complete JRT will shut down your browser with NO warning.

    Shut down your protection software now to avoid potential conflicts.

    •Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

    •Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator

    •The tool will open and start scanning your system.

    •Please be patient as this can take a while to complete depending on your system's specifications.

    •On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

    •Copy and Paste the JRT.txt log into your next message.
    *************************************************
    You have two AV's running on your computer; Windows Defender and McAfee. One should be de-activated or uninstalled.Windows Defender is the default AV that comes with Win10
    Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

    SHESHE

      Topic Starter


      Beginner

      Thanked: 1
      Re: possible virus after downloading/installing Windows 10
      « Reply #2 on: March 09, 2016, 12:56:53 PM »
      Thank you Dave for your help.  So, what you are saying is that I don't need McAfee anymore?  I just want to verify before I delete it.

      Here is the log from JRT.

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Junkware Removal Tool (JRT) by Malwarebytes
      Version: 8.0.3 (02.09.2016)
      Operating System: Windows 10 Home x64
      Ran by Sheila (Administrator) on Wed 03/09/2016 at 13:51:15.87
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




      File System: 3

      Successfully deleted: C:\users\Public\Documents\downloaded installers (Folder)
      Successfully deleted: C:\WINDOWS\system32\Tasks\PCDEventLauncherTask (Task)
      Successfully deleted: C:\WINDOWS\system32\Tasks\PCDoctorBackgroundMonitorTask (Task)

      Deleted the following from C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\hijyizz7.default\prefs.js
      user_pref(browser.search.defaultenginename, Secure Search);
      user_pref(browser.search.defaultenginename.US, Secure Search);
      user_pref(browser.search.order.1, Secure Search);
      user_pref(browser.search.selectedEngine, Secure Search);



      Registry: 3

      Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\0259691457549012mcinstcleanup (Registry Key)
      Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6983788E-77A1-4F72-A019-22DA9083A52B} (Registry Key)
      Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D16AAB9A-6038-4C45-9D58-7EF2DE54FB29} (Registry Key)




      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Scan was completed on Wed 03/09/2016 at 13:53:20.47
      End of JRT log
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 990
      • Certifications: List
      • Experience: Expert
      • OS: Windows 8
      Re: possible virus after downloading/installing Windows 10
      « Reply #3 on: March 09, 2016, 04:21:33 PM »
      Quote
      So, what you are saying is that I don't need McAfee anymore?  I just want to verify before I delete it.
      If you paid for it, you should use it until the subscription runs out. You disable Windows Defender. IMO WD is as good as McAfee.

      I'd like to scan your machine with ESET OnlineScan

      •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESET OnlineScan

      •Click the button.
      •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      • Click on to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the icon on your desktop.
      •Check
      •Click the button.
      •Accept any security warnings from your browser.
      • Leave the check mark next to Remove found threats.
      •Check
      •Push the Start button.
      •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      •When the scan completes, push
      •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      •Push the button.
      •Push
      A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
      Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

      SHESHE

        Topic Starter


        Beginner

        Thanked: 1
        Re: possible virus after downloading/installing Windows 10
        « Reply #4 on: March 09, 2016, 10:12:09 PM »
        Thanks Dave

        I ran ESET SCAN and it took almost 2 hours.  It said there was no issues/threats.  I hit finish and the program crashed.  I looked to see if there was anything in C:\Program Files\ESET\ESET Online Scanner\log.txt and there was nothing.  Do I need to re-run the scan?
        Thank you,
        Sheila






        SuperDave

        • Malware Removal Specialist


        • Genius
        • Thanked: 990
        • Certifications: List
        • Experience: Expert
        • OS: Windows 8
        Re: possible virus after downloading/installing Windows 10
        « Reply #5 on: March 10, 2016, 12:04:26 PM »
        How's your computer working now? Still having problems?
        Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

        SHESHE

          Topic Starter


          Beginner

          Thanked: 1
          Re: possible virus after downloading/installing Windows 10
          « Reply #6 on: March 10, 2016, 12:30:39 PM »
          So far, so good.  I have not had the message.  I hope it's gone!  Thank you so much for your help Dave. 

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 990
          • Certifications: List
          • Experience: Expert
          • OS: Windows 8
          Re: possible virus after downloading/installing Windows 10
          « Reply #7 on: March 10, 2016, 04:35:44 PM »
          Let's give it a few days. If it still good, come back and we'll do some cleanup.
          Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender