[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge

roymunson
New Helpee

Posts: 31

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 25, 2016 18:01:16 GMT -8

Post by roymunson on Sept 25, 2016 18:01:16 GMT -8

Hello,

I very much appreciate the help I was given about 2 years ago. I have re-read the instructions posted for starting a thread.

I'm afraid I may now have an infection with a Support Scam type program. While on Shutterfly, I clicked on a box that indicated I had a message for me. Upon doing so, multiple boxes popped up, including one that began:

This site says...
Warning: Internet Security Damaged!!!

A Suspicious Connection Was Trying to Access Your Logins, Banking Details, & Tracking Your Internet Activity.

Your TCP Connection Was Blocked by Your Firewall. Your Accounts May be Suspended Until You Take an Action.

I can provide more of the message if needed.

It was very difficult to shut Microsoft Edge down. Eventually I went to shut down the system, but an extremely long Windows update began. It caused me to wonder if this was really a true Windows update, or some sort of malware process. Needless to say, I didn't want to start running anit-virus/malware programs or otherwise until I checked in to see if there was any advice you may be able to offer. When I open Microsoft Edge now, it runs slowly, and the usual icons that appear on the tabs on the top of the browser are replaced by a rectangle with some dots and a line in it. The windows startup also appears slower, and the boot-up picture has changed. Again, I am not sure if this is part of a legitimate Windows update, or something malicious. I have posted links to the wikisend Addition.txt and FRST.txt files below. Thank you!

wikisend.com/download/618496/Addition.txt

wikisend.com/download/471538/FRST.txt

Last Edit: Oct 5, 2016 21:59:10 GMT -8 by dbrisen

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 25, 2016 20:29:15 GMT -8

Post by dbrisen on Sept 25, 2016 20:29:15 GMT -8

Not seeing that much in the system but there is some pointers that maybe something came in from DropBox.

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Coupon Printer for Windows
QuickTime 7

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-1949448810-4113918848-3188763694-1000\...\Run: [GoogleChromeAutoLaunch_486A54232E7A6A76188CD6D03A70FC2E] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [967496 2016-09-13] (Google Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U079DF&PC=U079&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U079DF&PC=U079&q={searchTerms}&src=IE-SearchBox
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\gcswf32.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll => No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll => No File
CHR Extension: (Honey) - C:\Users\Brad\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2016-09-21]
CHR Extension: (Ebates Cash Back) - C:\Users\Brad\AppData\Local\Google\Chrome\User Data\Default\Extensions\chhjbpecpncaggjpdakmflnfcopglcmi [2016-09-11]
CHR Extension: (Google Search) - C:\Users\Brad\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Brad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-06]
U3 idsvc; no ImagePath
2016-09-23 16:42 - 2016-07-16 06:43 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2016-09-23 14:27 - 2016-01-14 14:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
CustomCLSID: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Brad\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => No File
Task: {0C21D29C-F712-4D82-8491-FFC523227083} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {4D5049D7-9481-4AB8-BEA6-855A19F42299} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {59855978-03F7-4DC0-A0AE-CE0C4F005E66} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {5E916EA6-12CD-440B-8667-C796B380CA03} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {736D8E92-5B5A-4108-A102-88E7241FB7B4} - \Microsoft\Windows\Setup\EOONotify -> No File <==== ATTENTION
Task: {835A3137-2548-4CDF-960C-3FB9E365F9AB} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {92D1E403-3591-45C9-A428-990E9CBCC1AA} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {9DFE4351-E6B8-4B41-BD78-D39BD4648112} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {A34A6FF7-F8BF-43EF-9D25-3889CE1B4CC4} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {A401F7C2-E668-49E6-9376-D111EDE1728A} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {AA03A68E-2669-4B7A-AB0A-0676FDC9EDDD} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {C77B4090-C140-47BA-A930-96D97572AEE8} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {C97DC4B8-F7BA-4C7E-A192-12BE2F7B86CA} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {CFB71760-54E8-4187-A8B4-59C8AC011E24} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {D50173D7-A07B-45EA-BE80-BFB67EF82E1B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {E283A3A2-B776-496C-8B8E-BA510591FB12} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {F29CE2E2-7253-4042-9CE3-52A2B2544CFE} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
AlternateDataStreams: C:\Users\Brad\Desktop\2011-07-12 09.23.20.jpg:com.dropbox.attributes [1246]
AlternateDataStreams: C:\Users\Brad\Desktop\2016-01-23 13.02.51.jpg:com.dropbox.attributes [1100]
AlternateDataStreams: C:\Users\Brad\Desktop\2016-05-15 16.35.09-1.jpg:com.dropbox.attributes [888]
AlternateDataStreams: C:\Users\Brad\Desktop\DSC_0892.JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\Brad\Desktop\John David Free Throw at Bucks Game.mp4:com.dropbox.attributes [418]
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

LAST >>>>

SCAN ONLY

[/b][/a] (by tigzy) on to your desktop
[*]Quit all programs
[*]Start RogueKiller.exe.

[*]Click on Scan. Once finished, click on Open Report

[*]Click on the Open TXT. (Note: The screen below shows a Delete report. A Scan report is in the same format.)

[/ul]
Please post the contents of that text report in your next Reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

roymunson
New Helpee

Posts: 31

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 25, 2016 21:01:31 GMT -8

Post by roymunson on Sept 25, 2016 21:01:31 GMT -8

Thanks much.

The Quicktime 7 was uninstalled without an error message.

When I tried to uninstall the Coupon Printer for Windows, it gave me the following message:

An error occurred while trying to uninstall Coupon Printer for Windows. It may have already been uninstalled. Would you like to remove Coupon Printer for Windows from the Programs and Features List?

It gives a Yes or No choice. I didn't pick one yet, as I wanted to double check that I should have it removed from the List (given the error message).

Thanks.

dbrisen Malware Removalists Posts: 3,688	[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 25, 2016 22:28:28 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Sept 25, 2016 22:28:28 GMT -8 Yes; please remove it from the list. And then continue with rest of the steps.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

roymunson
New Helpee

Posts: 31

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 26, 2016 15:27:27 GMT -8

Post by roymunson on Sept 26, 2016 15:27:27 GMT -8

After the Farbar tool requested a restart, I received messages that "Windows Firewall has blocked some features of this app", for both Google Chrome and Dropbox. I hit the cancel button for both, as opposed to Allow access. Please let me know if I should be doing something differently. Below is the wikisend link for fixlog.txt and the RogueKiller scan report. Thanks!

wikisend.com/download/321882/Fixlog.txt

RogueKiller V12.6.4.0 (x64) [Sep 26 2016] (Free) by Adlice Software
mail : www.adlice.com/contact/
Feedback : forum.adlice.com
Website : www.adlice.com/download/roguekiller/
Blog : www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version
Started in : Normal mode
User : Brad [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 09/26/2016 17:21:47 (Duration : 00:38:13)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 10 ¤¤¤
[PUP|VT.Application.Win32.Coupons.a] (X64) HKEY_CLASSES_ROOT\CLSID\{1A53AD8B-D0B9-4E7F-88E4-50C07A65F2DC} (C:\Windows\couponprinter_x64.ocx) -> Found
[PUP] (X64) HKEY_CLASSES_ROOT\Sample.BrowserHandler -> Found
[PUP] (X64) HKEY_CLASSES_ROOT\Sample.YTBPartnerSample -> Found
[PUP] (X64) HKEY_CLASSES_ROOT\yt.CacheLoader -> Found
[PUP] (X64) HKEY_CLASSES_ROOT\yt.Clickstream -> Found
[PUP] (X64) HKEY_CLASSES_ROOT\yt.YTHelper -> Found
[PUP] (X64) HKEY_CLASSES_ROOT\yt.YToolbarBand -> Found
[Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | CitrixReceiver : "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk" [x] -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : www.dell.com -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : www.dell.com -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 4 ¤¤¤
[PUP][File] C:\Windows\couponprinter_x64.ocx -> Found
[PUP][Folder] C:\Users\Brad\AppData\Roaming\Yahoo!\Companion -> Found
[PUP][Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons -> Found
[PUP][Folder] C:\Program Files (x86)\Coupons -> Found

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10 01FALS-00Y6A0 SATA Disk Device +++++
--- User ---
[MBR] 976ce782956f7cc273d66c9a91585e16
[BSP] 3ccd31632cfa554a76f6fc77277d5caf : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953317 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1952600064 | Size: 450 MB
User = LL1 ... OK
User = LL2 ... OK

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 26, 2016 21:57:26 GMT -8

Post by dbrisen on Sept 26, 2016 21:57:26 GMT -8

Please run RogueKiller once again and this time mark all item for deletion / fixing EXCEPT the following three:

[Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | CitrixReceiver : "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk" [x] -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : www.dell.com -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : www.dell.com -> Found

Please post the log here when RK is finished. Thanks.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

roymunson
New Helpee

Posts: 31

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 27, 2016 3:41:48 GMT -8

Post by roymunson on Sept 27, 2016 3:41:48 GMT -8

Done. Here it is. Thanks.

RogueKiller V12.6.4.0 (x64) [Sep 26 2016] (Free) by Adlice Software
mail : www.adlice.com/contact/
Feedback : forum.adlice.com
Website : www.adlice.com/download/roguekiller/
Blog : www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version
Started in : Normal mode
User : Brad [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete -- Date : 09/27/2016 05:58:50 (Duration : 00:32:52)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 10 ¤¤¤
[PUP|VT.Application.Win32.Coupons.a] (X64) HKEY_CLASSES_ROOT\CLSID\{1A53AD8B-D0B9-4E7F-88E4-50C07A65F2DC} (C:\Windows\couponprinter_x64.ocx) -> Deleted
[PUP] (X64) HKEY_CLASSES_ROOT\Sample.BrowserHandler -> Deleted
[PUP] (X64) HKEY_CLASSES_ROOT\Sample.YTBPartnerSample -> Deleted
[PUP] (X64) HKEY_CLASSES_ROOT\yt.CacheLoader -> Deleted
[PUP] (X64) HKEY_CLASSES_ROOT\yt.Clickstream -> Deleted
[PUP] (X64) HKEY_CLASSES_ROOT\yt.YTHelper -> Deleted
[PUP] (X64) HKEY_CLASSES_ROOT\yt.YToolbarBand -> Deleted
[Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | CitrixReceiver : "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk" [x] -> Not selected
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : www.dell.com -> Not selected
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : www.dell.com -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 4 ¤¤¤
[PUP][File] C:\Windows\couponprinter_x64.ocx -> Deleted
[PUP][Folder] C:\Users\Brad\AppData\Roaming\Yahoo!\Companion -> Deleted
[PUP][Folder] C:\Users\Brad\AppData\Roaming\Yahoo!\Companion\Buttons -> Deleted
[PUP][Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons -> Deleted
[PUP][Folder] C:\Program Files (x86)\Coupons -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Coupons.ico -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\CouponsDotCom.url -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\license_agreement.html -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\license_agreement.txt -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG1.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG1.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG10.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG11.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG2.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG2.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG3.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG3.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG4.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG4.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG5.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG5.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG6.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG7.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG8.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG9.BMP -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRZip.lmd -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\uninstall.dat -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\uninstall.xml -> Deleted
[PUP][Folder] C:\Program Files (x86)\Coupons\Uninstall -> Deleted

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0x20]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10 01FALS-00Y6A0 SATA Disk Device +++++
--- User ---
[MBR] 976ce782956f7cc273d66c9a91585e16
[BSP] 3ccd31632cfa554a76f6fc77277d5caf : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953317 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1952600064 | Size: 450 MB
User = LL1 ... OK
User = LL2 ... OK

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 27, 2016 8:16:03 GMT -8

Post by dbrisen on Sept 27, 2016 8:16:03 GMT -8

Let's check with one more scanner and then see if the system is ready ...

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

[/b][/color] Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt
[/ul]

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

roymunson
New Helpee

Posts: 31

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 27, 2016 16:55:47 GMT -8

Post by roymunson on Sept 27, 2016 16:55:47 GMT -8

Thanks, the log is below. I should also mention that now after my computer boots, a notepad file opens named desktop.ini. The file says:
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

# AdwCleaner v6.020 - Logfile created 27/09/2016 at 19:44:49
# Updated on 14/09/2016 by ToolsLib
# Database : 2016-09-27.2 [Server]
# Operating System : Windows 10 Home (X64)
# Username : Brad - BRAD-PC
# Running from : C:\Users\Brad\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\Brad\AppData\LocalLow\Yahoo!\Companion
[-] Folder deleted: C:\Program Files (x86)\Yahoo!\Companion

***** [ Files ] *****

[-] File deleted: C:\Program Files (x86)\Yahoo!\Common\unyt.exe

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\couponxplorer.dl.myway.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\myway.com
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[-] Key deleted: HKLM\SOFTWARE\Classes\Sample.BrowserHandler.1
[-] Key deleted: HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTBMButton
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTBMButton.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper.2
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Sample.BrowserHandler.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.CacheLoader.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.Clickstream.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTBMButton
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTBMButton.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTHelper.2
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YToolbarBand.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{1CAE874F-F5C7-4BCC-BA46-9AD26DF35B93}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{EFC0651C-B6D7-49CD-A6E0-B1CE9AB5FE46}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{7375D127-3955-4654-8E7D-1949A7A9C902}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1E57256D-9F39-4267-AB39-D7813D644C5A}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{31371420-098D-4C0E-A11E-EBEC2305DD01}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3A06AA27-D94B-48C2-BB55-9FD0FF2120E3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{46140CE4-76FE-440E-AE88-4C2272BC05C7}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9F9C4C5C-2BA8-4E00-A697-9F710BB1026B}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{C60CCE95-6AF9-4E74-B66B-3212D19F1D2F}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FBE30D66-39A2-4b72-8B43-6D4C335A6F34}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3C16E079-E4C7-493C-BE9F-E0F2BB0B7430}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6EB4349D-4333-442F-ACA4-4C72AF28B6ED}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{7DB8B625-DBF0-4491-B544-5A06F7B17BB4}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{8E74A0AE-F0ED-47ED-A940-A8E99687646B}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9DE77B51-89F6-468E-9402-16050382E950}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{371AD4A5-1520-4AA2-A8A4-F9AD3BAC6957}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7F124846-5453-4BB8-A41D-E11481FFC9DF}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8FD65019-BF09-45DA-AD81-E95AE911F1FD}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{61A2027D-B837-4080-A925-6E30E10DEF32}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{F6C2BABA-9E4C-425F-9AEC-24AB8F2B640D}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}]
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key deleted: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Yahoo\Companion
[-] Key deleted: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\Yahoo\YFriendsBar
[-] Key deleted: HKU\S-1-5-21-1949448810-4113918848-3188763694-1000\Software\AppDataLow\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\Yahoo\Companion
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\couponxplorer.dl.myway.com
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\myway.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\staticimgfarm.com
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\shopathome.com
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.shopathome.com
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\shopathome.com
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.shopathome.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\couponxplorer.dl.myway.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\myway.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\staticimgfarm.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\shopathome.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.shopathome.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\shopathome.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.shopathome.com
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\yt.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\ytbbroker.EXE

***** [ Web browsers ] *****

[-] [C:\Users\Brad\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ijjnmdphpnlnelhbhefnfmimenjgbfcn
[-] [C:\Users\iPad 2\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\iPad 2\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [13163 Bytes] - [27/09/2016 19:44:49]
C:\AdwCleaner\AdwCleaner[S0].txt - [12404 Bytes] - [27/09/2016 19:42:57]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [13311 Bytes] ##########

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge Sept 27, 2016 21:16:38 GMT -8

Post by dbrisen on Sept 27, 2016 21:16:38 GMT -8

Let's fix that desktop.ini error first:

From the Windows 10 Start Screen, click on the Control Panel app.
When the Control Panel opens make sure the view is set to View by: Category.
Click on the Appearance and Personalization link.
Under the Folder Options category, click on Show Hidden Files and Folders.
Place a checkmark in the checkbox labeled Hide protected operating system files (Recommended).
Press the Apply button and then the OK button..

Reboot your system and tell me if the notepad / desktop.ini file still opens.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

[ti]SOLVED[/ti]Suspect support scam which began while in Microsoft Edge

Post by roymunson on Sept 25, 2016 18:01:16 GMT -8

Post by dbrisen on Sept 25, 2016 20:29:15 GMT -8

Post by roymunson on Sept 25, 2016 21:01:31 GMT -8

Post by dbrisen on Sept 25, 2016 22:28:28 GMT -8

Post by roymunson on Sept 26, 2016 15:27:27 GMT -8

Post by dbrisen on Sept 26, 2016 21:57:26 GMT -8

Post by roymunson on Sept 27, 2016 3:41:48 GMT -8

Post by dbrisen on Sept 27, 2016 8:16:03 GMT -8

Post by roymunson on Sept 27, 2016 16:55:47 GMT -8

Post by dbrisen on Sept 27, 2016 21:16:38 GMT -8