gittinsjr 0 Posted December 4, 2015 Report Share Posted December 4, 2015 I was directed by Emsisoft Anti-Malware to come here to have you help me remove some stuff detected that the program couldn't remove. I am attaching the required files. Thanks for your help. BTW, the coupon printer needs to be added to whitelist. Addition.txt FRST.txt scan_151204-094618.txt Link to post Share on other sites
Kevin Zoll 309 Posted December 4, 2015 Report Share Posted December 4, 2015 Do the following: Copy the below code to Notepad; Save As fixlist.txt to your Desktop. () C:\Program Files\WNEn\129637286ab1f486423795d47012b51e.exe () C:\Program Files\WNEn\f5082a0192ab5a8cee5954e823a153e9.exe () C:\Program Files\WNEn\129637286ab1f486423795d47012b51e.exe HKLM-x32\...\Run: [UPS Assistant] => [X] HKLM-x32\...\RunOnce: [GrpConv] => grpconv -o HKLM\...\Policies\Explorer: [NoRecentDocsNetHood] 0 HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Run: [UPS Assistant] => [X] HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\system: [NoDispAppearancePage] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoPreviewPane] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoTrayContextMenu] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoSetTaskbar] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoViewContextMenu] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoWinkeys] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [HideClock] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [HideSCANetwork] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [HideSCAVolume] 0 HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - No File Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - No File Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - No File R2 WNEn Monitor; C:\Program Files\WNEn\129637286ab1f486423795d47012b51e.exe [2339328 2015-11-16] () [File not signed] 2015-11-27 16:24 - 2015-11-27 16:24 - 00000000 _____ C:\WINDOWS\SysWOW64\REN5F5C.tmp 2015-11-27 16:21 - 2015-11-27 16:21 - 00000000 _____ C:\WINDOWS\SysWOW64\REN95AD.tmp 2015-11-18 09:12 - 2015-11-18 09:12 - 00000000 ____D C:\Users\Marvin\AppData\Local\35787886 2015-11-18 09:12 - 2015-11-18 09:12 - 00000000 ____D C:\Users\Marvin\AppData\Local\30852275 2015-11-18 09:09 - 2015-11-18 14:48 - 00000000 ____D C:\Program Files (x86)\00412F4E-1447859364-0000-0000-0000FFFFFFFF 2015-11-18 09:02 - 2015-12-04 09:02 - 00002468 _____ C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user.job 2015-11-18 09:02 - 2015-12-04 09:02 - 00002132 _____ C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.job 2015-11-18 09:02 - 2015-11-18 09:02 - 00005654 _____ C:\WINDOWS\System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user 2015-11-18 09:02 - 2015-11-18 09:02 - 00005248 _____ C:\WINDOWS\System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5 2015-11-18 09:01 - 2015-11-18 09:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WNEn 2015-11-18 09:00 - 2015-11-18 09:01 - 00000000 ____D C:\Program Files\WNEn 2015-11-18 08:59 - 2015-11-18 08:59 - 00004320 _____ C:\WINDOWS\System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Pending Update 2015-11-18 08:59 - 2015-11-18 08:59 - 00004290 _____ C:\WINDOWS\System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Core C:\ProgramData\fontcacheev1.dat C:\Windows\Tasks\{6AEE5E74-B7FB-4443-B5EA-7C5A474FD4B7}.job C:\Users\Marvin\AppData\Local\Temp\any.exe C:\Users\Marvin\AppData\Local\Temp\AudioConverter.exe C:\Users\Marvin\AppData\Local\Temp\FreemakeAudioConverterFull.exe C:\Users\Marvin\AppData\Local\Temp\FreemakeMusicBoxFull.exe C:\Users\Marvin\AppData\Local\Temp\FreemakeVideoDownloaderFull.exe C:\Users\Marvin\AppData\Local\Temp\LMkRstPt.exe C:\Users\Marvin\AppData\Local\Temp\MusicBox.exe C:\Users\Marvin\AppData\Local\Temp\oksoft12.exe C:\Users\Marvin\AppData\Local\Temp\setup.exe C:\Users\Marvin\AppData\Local\Temp\speed.exe C:\Users\Marvin\AppData\Local\Temp\unins000.exe C:\Users\Marvin\AppData\Local\Temp\unins001.exe C:\Users\Marvin\AppData\Local\Temp\VideoDownloader.exe C:\Users\Marvin\AppData\Local\Temp\waj.exe C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage C:\Users\Marvin\AppData\Roaming\VOPackage C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\aspackage C:\Users\Marvin\AppData\Roaming\aspackage Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPACKAGE" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ASPACKAGE" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\CROSSRIDER" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\ARENAHD" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\HIGHDEFACTION" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\YORKNEWCIN" /f Reg: reg delete "HKEY_USERS\S-1-5-21-3474383695-1841813542-1221837453-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN" /v "FREE DOWNLOAD MANAGER" /f Task: {36F6664D-C7CB-4CB3-82B5-98919A1BC72B} - System32\Tasks\FSSUpdaterService => C:\Users\Marvin\AppData\Roaming\UpdaterService\FSSUpdaterService.exe [2015-08-25] () <==== ATTENTION Task: {6456B067-8749-467D-AEF9-03A0CB6B180D} - System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Pending Update => C:\Program Files (x86)\SwiftSearch_1.10.0.25\Update\SwiftSearchAutoUpdateClient.exe <==== ATTENTION Task: {990CDA0A-6660-4F26-AD19-9A7F9A73489B} - System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION Task: {AF112094-998B-49B5-81D0-16B36AF6C4E9} - System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Core => C:\Program Files (x86)\SwiftSearch_1.10.0.25\Update\SwiftSearchAutoUpdateClient.exe <==== ATTENTION Task: {DB8A500B-F65E-4E1A-9EC6-359AA5080568} - System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5 => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.job => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user.job => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION 2015-11-16 10:53 - 2015-11-16 10:53 - 01882624 _____ () c:\program files\wnen\f5082a0192ab5a8cee5954e823a153e9.exe 2015-11-16 10:55 - 2015-11-16 10:55 - 02339328 _____ () c:\program files\wnen\129637286ab1f486423795d47012b51e.exe 2015-12-03 19:47 - 2015-12-03 19:47 - 11972608 _____ () c:\program files\wnen\WNEnlibs\vyfukv.dll c:\program files\wnen c:\program files\wnen\WNEnlibs AlternateDataStreams: C:\ArtMoney:Win32App_1 AlternateDataStreams: C:\Boot:Win32App_1 AlternateDataStreams: C:\Program Files\A Ruler for Windows:Win32App_1 AlternateDataStreams: C:\Program Files\AMD:Win32App_1 AlternateDataStreams: C:\Program Files\Andy:Win32App_1 AlternateDataStreams: C:\Program Files\ATI Technologies:Win32App_1 AlternateDataStreams: C:\Program Files\Bonjour:Win32App_1 AlternateDataStreams: C:\Program Files\Bug head:Win32App_1 AlternateDataStreams: C:\Program Files\CCleaner:Win32App_1 AlternateDataStreams: C:\Program Files\Circuit Diagram:Win32App_1 AlternateDataStreams: C:\Program Files\Cyberfox:Win32App_1 AlternateDataStreams: C:\Program Files\Epic Games:Win32App_1 AlternateDataStreams: C:\Program Files\Fort - Crypto Extension for Windows:Win32App_1 AlternateDataStreams: C:\Program Files\fxCalc:Win32App_1 AlternateDataStreams: C:\Program Files\GIMP 2:Win32App_1 AlternateDataStreams: C:\Program Files\LibreOffice 5:Win32App_1 AlternateDataStreams: C:\Program Files\Microsoft Mouse and Keyboard Center:Win32App_1 AlternateDataStreams: C:\Program Files\My Family Tree:Win32App_1 AlternateDataStreams: C:\Program Files\OpenMPT:Win32App_1 AlternateDataStreams: C:\Program Files\Psycle Modular Music Studio:Win32App_1 AlternateDataStreams: C:\Program Files\Send To Toys:Win32App_1 AlternateDataStreams: C:\Program Files\Sigil:Win32App_1 AlternateDataStreams: C:\Program Files\Stellarium:Win32App_1 AlternateDataStreams: C:\Program Files\WinRAR:Win32App_1 AlternateDataStreams: C:\Program Files\WNEn:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\7-Zip:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Adguard:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Agat:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\AMD:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\AnyToISO:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\AOMEI Backupper:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\AOMEI OneKey Recovery 1.2:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\AOMEI Partition Assistant Standard Edition 5.8:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Artweaver Free 5:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\AtHome Camera:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\ATI Technologies:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Attribute Changer:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Audacity:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\BlueJ:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Bonjour:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\BS FAG:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Bubble Bobble Legacy BETA:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Calibre2:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\ConstEdit:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\ConvertAll:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\CoolSoft NSISDialogDesigner:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Coupons:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\CreateInstall Free:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\D-Fend Reloaded:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\DeepSound 2.0:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Doomsday:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\DoroPDFWriter:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\DPLS Scientific Calculator 2.4:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\DVDStyler:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\e-Sword:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\EMDB:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Emsisoft Anti-Malware:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\FontForgeBuilds:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Free Download Manager:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Freemake:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Frogger Reloaded:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\GeoGebra 5.0:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\GoOllie:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Greenfoot:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icecream Ebook Reader:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icecream Image Resizer:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icecream Media Converter:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icecream PDF Converter:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icecream PDF Split and Merge:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icecream Slideshow Maker:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Icons from File:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\ImBatch:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Inkscape:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Instagiffer:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\K-Lite Codec Pack:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Kalender:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\KaraFun Player 2:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Labography:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\LibreCAD:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Lyrik:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Mono:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\MSBuild:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\NSIS:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\ordrumbox:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\PDF24:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Pixia ver. 6:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\PrintMaster 6.0 Platinum:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\PySol Fan Club edition:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\RedNotebook:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\rpCalc:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\ScreenshotCaptor:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Sicyon calculator:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Sicyon Unit Converter:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Spybot Anti-Beacon:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\SSuiteInvoice:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\TeamViewer:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\TheSage:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Unchecky:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\WOLFCODERS ScreenSnag:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\XnView:Win32App_1 AlternateDataStreams: C:\Program Files (x86)\Zaz:Win32App_1 AlternateDataStreams: C:\WINDOWS\SysWOW64\Adobe:Win32App_1 AlternateDataStreams: C:\WINDOWS\SysWOW64\VirtualMIDISynth:Win32App_1 AlternateDataStreams: C:\ProgramData\eSellerate:Win32App_1 AlternateDataStreams: C:\ProgramData\Monodoc:Win32App_1 AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm AlternateDataStreams: C:\ProgramData\VMware:Win32App_1Close Notepad.NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST64 and press the Fix button just once and wait. If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply. Note: If the tool warns you about an outdated version please download and run the updated version. Link to post Share on other sites
gittinsjr 0 Posted December 7, 2015 Author Report Share Posted December 7, 2015 Ran FRST as instructed. Here's the log file. Thanks! Fixlog.txt Link to post Share on other sites
Kevin Zoll 309 Posted December 8, 2015 Report Share Posted December 8, 2015 Let's take a fresh look. Run fresh scans with Emsisoft Emergency Kit (EEK) and FRST, attach the new EEK and FRST scans to your reply. Be sure to let me know how things are running? Link to post Share on other sites
Kevin Zoll 309 Posted December 14, 2015 Report Share Posted December 14, 2015 Thread Closed Reason: Lack of Response PM either Kevin, Elise, or Arthur to have this thread reopened. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread. Link to post Share on other sites
Recommended Posts