Please help with malware removal

Welcome to Major Geeks!

No logs were attached.

Hitman Pro is free to use for scanning. You do not need a key. Please just run a scan and save a log to attach.

 

Your Malwarebytes log does not show that you fixed anything? Did you save the log before fixing or did you forget to fix? Please check by running a new scan and if anything is detected, fix it first and then save a log. Attach the new log.

Please attach a proper text log from RogueKiller not the json file which is in XML format.

Do you use the Yahoo Companion Toolbar?

 

It has the below in it. Notice the .log file extension.

Okay so then I suggest that you uninstall the toolbar now.


Please download OTM by Old Timer and save it to your Desktop.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
 
:Files
C:\Users\Howard.Weisberg\AppData\Local\Temp\*.*
 
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
[-HKEY_USERS\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_USERS\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_USERS\S-1-5-18\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_USERS\S-1-5-21-304742085-4023170951-4043297385-129073-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_USERS\S-1-5-21-304742085-4023170951-4043297385-129073-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Optimizer Pro]
[-HKEY_USERS\S-1-5-21-304742085-4023170951-4043297385-129073\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_USERS\S-1-5-21-304742085-4023170951-4043297385-129073\Software\Optimizer Pro]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the C:\_OTM\MovedFiles log
• the JRT.TXT log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

See if this portable appl GeekUninstaller lists and can remove it.

 

Please do not rename the MGlogs.zip file to attach it. Just attach MGlogs.zip as is. The file at C:\MGlogs.zip is always updated with logs as they run. If the scan from GetLogs.bat does not complete ( like you see it hang at MiscInfo.Bat ) then scans from there on will not add new data and MGlogs.zip will not be copied to the desktop but C:\MGlogs.zip will still be there containing everything from last time run plus any new updates.

This is not a malware problem. It is likely a Chrome problem. Have you tried running it with IE or Firefox? If not then try them.

Also not a malware problem as you really did not have too much to do and there were no serious issues. This again may be a Chrome issue. Have you tried running it with IE or Firefox? If not then try them.

 

So does this mean that your browsing/surfing is slow in all three browsers? Also when you tested, did you shutdown the other browsers? You need to test by only have one browser running at any time and you need to make sure that when you exit the browser that it really terminates by looking in Task Manager.

Again it does not sound like malware behavior.

Let's try a couple more scans just to touch all bases.


Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Attach the logfile to your next next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Please download FRST the below link:

Farbar Recovery Scan Tool

and save it to your Desktop.


Note: Make sure you download the proper version ( 32 bit or 64 bit ) for your PC. Only one will run, the correct one. So it you make a mistake and download the wrong one, go back and get the other.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Okay thanks for the update. How your reinstall goes easily.