3 Issues

Greetings and :welcome: to Major Geeks Malware Forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at Major Geeks volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please take special note in my instructions whether to copy and paste, attach, or upload reports or files requested in my instructions
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

The Addition.txt report is incomplete. Please run another FRST scan and attach that report to your reply.

 

Thanks for the report, this one was complete.

Let's start with this.

===================================================

Uninstalling Programs Using Revo Uninstaller Free Portable

--------------------

• Download Revo Uninstaller Free Portable and save it to your Desktop
• Right click on the folder and select Extract All..., then click Extract
• Double click on the RevoUninstaller-Portable folder
• Right click on RevoUPort and select Run as administrator
• Click OK on the License Agreement
• From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)

Code:

App Explorer
Adobe Shockwave Player 12.3

• If the program's uninstaller appears work through the steps to remove the program(s)
• Be sure the Advanced option is selected then click Scan
• For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
• Once done click Finish
• Reboot your computer

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Code:

Start::
CreateRestorePoint:
CloseProcesses:
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1234204.dll [2018-06-06] (Adobe Systems, Inc.) [File not signed]
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
HKU\S-1-5-21-1548894264-819181210-1643564009-1004\Software\Classes\exefile:  <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [113]
Task: {0DE8B5C5-D933-4CB9-98FA-D5C31ED9F685} - System32\Tasks\AcerCMUpdateTask2.5.22250 => C:\Program Files (x86)\Acer\Amundsen\2.5.22250\awc.exe [96904 2022-09-25] (Acer Incorporated -> )
Task: {07E94F36-7571-4BBB-81C8-06869D1CCEF3} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {B8076462-66D6-41D5-B4D7-6E60841A0E1B} - System32\Tasks\BlueStacksHelper => C:\ProgramData\BlueStacks\Client\Helper\BlueStacksHelper.exe  -sr (No File)
Task: {DA466977-043C-44A2-BDC3-EB23AF71D0FE} - System32\Tasks\CCleaner Update => D:\Various Programs\CCleaner\CCUpdate.exe  (No File)
Task: {C1172F43-7126-4DC5-A601-48994E510A6C} - System32\Tasks\CCleanerSkipUAC - Jesse => "D:\Various Programs\CCleaner\CCleaner.exe"  $(Arg0) (No File)
Task: {5DA5EB4F-6F8A-45AB-B3F7-E3035B2A2C40} - System32\Tasks\Microsoft\Windows\Clip\ClipESU => %SystemRoot%\system32\clipesu.exe  (No File)
Task: {6CAA0058-2521-4F39-9C16-09F6A85D84D8} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumer => %SystemRoot%\system32\ClipESUConsumer.exe  -evaluateEligibility (No File)
Task: {518AF501-674B-4095-97EB-F03D798C0524} - System32\Tasks\Microsoft\Windows\Clip\ClipEsuConsumerProcessPreOrder => %SystemRoot%\system32\ClipESUConsumer.exe  -postProcessPreOrder (No File)
Task: {A3F74F1A-D08D-4202-8FCD-7EFF379B82B2} - System32\Tasks\Microsoft\Windows\Clip\ClipEsuConsumerProcessRefund => %SystemRoot%\system32\ClipESUConsumer.exe  -processRefund (No File)
Task: {E88D9B2C-DDEA-47B2-9582-085153004DB5} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {4DC0E083-16FB-4735-B610-A39AB5F3C97D} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => %systemroot%\system32\MusNotification.exe  LogonUpdateResults (No File)
Task: {FB1544C1-FB2E-4870-B6B6-8F20B40138C0} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval => %systemroot%\system32\MusNotification.exe  Display (No File)
Task: {6ECC17BA-2F21-4D1D-A937-AF5B7E29ED7A} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => %systemroot%\system32\MusNotification.exe  Reboot (No File)
Task: {E67F75A9-1405-41C5-B572-D2E4AB3F7DE5} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {7E4ADFE9-4C6C-4AF0-B9EA-FAA31AE86B39} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {BBFC2016-970B-41DE-BA6C-25B569993AD1} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display => %systemroot%\system32\MusNotification.exe  Display (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {CA753B15-CE73-4790-AA30-8E0A4A2BD548} - System32\Tasks\Mozilla\Firefox Default Browser Agent 3EEC2BB1E75616D8 => D:\Various Programs\Fire Fox\default-browser-agent.exe  do-task "3EEC2BB1E75616D8" (No File) <==== ATTENTION
Task: {39C0F019-A1CB-4409-AF68-0AD12A9FC98E} - System32\Tasks\Oem\AcerJumpstartTask => "C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe"  /default (No File)
Task: {339DE183-0AE1-4E66-89A6-ECD3EDF313AD} - System32\Tasks\OneDrive Startup Task-S-1-5-21-1548894264-819181210-1643564009-1001 => C:\Users\Jesse\AppData\Local\Microsoft\OneDrive\25.206.1021.0003\OneDriveLauncher.exe  /startInstances (No File)
Task: {A85B5056-9BAD-4B17-865C-9EB097C02DCF} - System32\Tasks\OneDrive Startup Task-S-1-5-21-1548894264-819181210-1643564009-1003 => C:\Users\New Guest\AppData\Local\Microsoft\OneDrive\25.216.1104.0002\OneDriveLauncher.exe  /startInstances (No File)
HKU\S-1-5-21-1548894264-819181210-1643564009-1004\...\Run: [MicrosoftEdgeAutoLaunch_CB597B479230DDCF7F69B4ACCD0FB52F] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5018440 2026-08-09] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-1548894264-819181210-1643564009-1005\...\Run: [MicrosoftEdgeAutoLaunch_8D6AADF2653E934432CCA87C0AED8CC3] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5018440 2026-08-09] (Microsoft Corporation -> Microsoft Corporation)
S3 LVRS64; \SystemRoot\system32\DRIVERS\lvrs64.sys (No File)
S3 LVUVC64; \SystemRoot\system32\DRIVERS\lvuvc64.sys (No File)
S3 MpKsl93e081d8; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{26D56574-3298-4820-B054-859ADD67510E}\MpKslDrv.sys (No File)
S4 NvModuleTracker; \SystemRoot\System32\DriverStore\FileRepository\nvmoduletracker.inf_amd64_ea6cec41fc5b2a8b\NvModuleTracker.sys (No File)
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} =>  -> No File
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
cmd: netsh winsock reset catalog
cmd: netsh int ip reset resetlog.txt
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: bitsadmin /reset /allusers
cmd: ipconfig /flushdns
Removeproxy:
hosts:
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
Emptytemp:
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.
• WARNING Regarding the Emptytemp: command, please see here before running the Fixlist. If you have concerns stop and let me know.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Programs removed?
• Fixlog
• Update on computer behavior