[Naathim]

Hi!

Any other issues? Anything bothering?



Scan with Malwarebytes' Anti-Malware

Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.


Scan with ESET Online Scanner

This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
Please visit ESET Online Scanner website.
Click there Run ESET Online Scanner.

If using Internet Explorer:

• Accept the Terms of Use and click Start.
• Allow the running of add-on.

If using Mozilla Firefox or Google Chrome:

• Download esetsmartinstaller_enu.exe that you'll be given link to.
• Double click esetsmartinstaller_enu.exe.
• Allow the Terms of Use and click Start.

To perform the scan:

• Make sure that Remove found threats is unchecked.
• Scan archives is checked.
• In Advanced Settings: Scan for potentially unwanted applications, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.
• Click Start
• The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
• When completed, the program will begin to scan. This may take several hours. Please, be patient.
• Do not do anything on your machine as it may interrupt the scan.
• When the scan is done, click Finish.
• A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.

Please include this logfile in your next reply.
Don't forget to re-enable previously switched-off protection software!

[Advertisements]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 7/30/2014
Scan Time: 3:24:28 PM
Logfile: Malware scan.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.30.08
Rootkit Database: v2014.07.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Mary

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 284551
Time Elapsed: 12 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

 

 

 

 

 

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5f456def58da0f4788e297d042d75c3b
# engine=19428
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-31 09:04:04
# local_time=2014-07-31 02:04:04 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 0 2074129 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5273436 66217155 0 0
# scanned=211820
# found=0
# cleaned=0
# scan_time=30406
 

[GregMiller]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 7/30/2014
Scan Time: 3:24:28 PM
Logfile: Malware scan.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.30.08
Rootkit Database: v2014.07.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Mary

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 284551
Time Elapsed: 12 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

 

 

 

 

 

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5f456def58da0f4788e297d042d75c3b
# engine=19428
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-31 09:04:04
# local_time=2014-07-31 02:04:04 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 0 2074129 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5273436 66217155 0 0
# scanned=211820
# found=0
# cleaned=0
# scan_time=30406
 

[GregMiller]

I went into the uninstall list of programs and I see the listing is still there fvor them alware we just uninstalled:

 

Smart PC Booster 7   and the company is Ask4Experts.

 

Is there a way to remove that listing?

 

Also in Windows 8 there is that annoying desktop block of icons to perform tasks and there are a few different listings for Ask4Experts there- even though they probably do not link to anything. How can I get rid of those?

[Naathim]

Hi
 

Smart PC Booster 7 and the company is Ask4Experts.

Is there a way to remove that listing?

I will remove it later with a script, so don't worry
 

annoying desktop block of icons

few different listings for Ask4Experts

I'm afraid that I don't understand. Please be more specific with the descriptions about that issues, maybe post me some screenshots. The more info I get, the better assistance I can provide

[GregMiller]

What I meant is that when Windows 7 opens and there is a band of functions encased in different color squares with all the things you can do- in fact a whole block of three blocks high times about 12 wide called "apps - in these "selections" there are those Ask4Expert blocks - about three of them and I was wondering why those "bits" are left behind in the cleanup. I thought we were done- had no idea since the scans showed nothing that we were not. So I do look forward to finishing this.

 

Short of a screen shot which I'd have no idea in Windows 8 how to do, I don't understand why you are having difficulty knowing what I was talking about because it looks like that's the most predominantly different feature with Windows 8.

 

Thanks for your help; what's next?

[GregMiller]

I just tried to get a screenshot of the desktop.

 

The Windows key+prt sc copied the screen shot but nothing would insert or paste into this reply

[Naathim]

Try to paste it into the paint (press Windows key + R, in the run box type mspaint and enter). Save as jpg file and attach to your post.

Sorry for not more detailed instructions, but typing from cell phone

[GregMiller]

Here is the screenshot of the Desktop.

 

Note the blocks in rows and the several that have Ask4Expert in the file name - Smart PC Booster 7 had that name in the extension.

 

When I first tried to fix this there was another program in addition to Smart PC Booster 7 and it was downloaded on the same date 9/23/2013 and in addition a windows update came that same day.

 

I was able to eliminate the program but these are the bits left behind.

 

So I guess your script that you said you would clean this up is probably the last thing to do here.

Attached Thumbnails

• 

[Dakeyras]

This is merely a courtesy post, Naathim is currently unavailable due to a personal issue and should be able to continue assisting your good self some time tomorrow. So please be patient and in the event he will be unable to continue assistance I will myself.

[Naathim]

Hello and sorry for a little delay on by behalf, I had some real life issues.

Let's collect some additional information.


Scan with ZOEK

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  Smart PC Booster 7;u
  installedprogs;
  "%appdata%\microsoft\windows\start menu\programs";vs
  

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

[GregMiller]

Zoek.exe v5.0.0.0 Updated 04-August-2014
Tool run by Mary on Mon 08/04/2014 at  9:10:29.51.
Microsoft Windows 8 6.2.9200  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Mary\Documents\zoek\zoek.com [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-07-23-234728.log 32313 bytes
C:\zoek-results2014-07-24-232803.log 35907 bytes

==== Installed Programs ======================

4 Elements II 
Adobe Shockwave Player 11.6 
Amazon Cloud Player 
Apple Software Update 
avast Free Antivirus 
Bejeweled 3 
Bonjour 
Build-a-lot 4 - Power Source 
Chuzzle Deluxe 
Cradle Of Egypt Collector's Edition 
Cradle of Rome 2 
CyberLink LabelPrint 
CyberLink Media Suite 10 
CyberLink Power2Go 8 
CyberLink PowerDVD 
CyberLink YouCam 
D3DX10 
Energy Star 
Farm Frenzy 
FATE: The Cursed King 
Final Drive Fury 
FlatOut 2 
Governor of Poker 2 Premium Edition 
Hewlett-Packard ACLM.NET v1.2.2.3 
Hoyle Card Games 
HP Customer Experience Enhancements 
HP Documentation 
HP Games 
HP MyRoom 
HP Postscript Converter 
HP Quick Launch 
HP Recovery Manager 
HP Registration Service 
HP Software Framework 
HP Support Assistant 
HP Utility Center 
HP Wireless Button Driver 
iCloud 
Intel® Management Engine Components 
Intel® Processor Graphics 
Intel® SDK for OpenCL - CPU Only Runtime Package 
Intelr Trusted Connect Service Client 
Jewel Match 3 
John Deere Drive Green 
Luxor Evolved 
Mahjongg Dimensions Deluxe: Tiles in Time 
Malwarebytes Anti-Malware version 2.0.2.1012 
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) 
Microsoft Application Error Reporting 
Microsoft Office 
Microsoft Silverlight 
Microsoft SQL Server 2005 Compact Edition [ENU] 
Microsoft Visual C++ 2005 Redistributable 
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 
More Games from WildTangent Games 
Mortimer Beckett and the Crimson Thief Premium Edition 
MSVCRT 
Mystery P.I. - Curious Case of Counterfeit Cove 
Peggle Nights 
Penguins 
Polar Bowler 
Polar Golfer 
Ralink RT5390R 802.11bgn Wi-Fi Adapter 
Realtek Ethernet Controller Driver 
Realtek High Definition Audio Driver 
Realtek PCIE Card Reader 
Roads of Rome 3 
Smart PC Booster 7 
swMSM 
Synaptics Pointing Device Driver 
Tales of Lagoona 
Update Installer for WildTangent Games App 
Vacation QuestT - Australia 
Windows Live Communications Platform 
Windows Live Essentials 
Windows Live Installer 
Windows Live Language Selector 
Windows Live Movie Maker 
Windows Live Photo Common 
Windows Live Photo Gallery 
Windows Live PIMT Platform 
Windows Live SOXE 
Windows Live SOXE Definitions 
Windows Live UX Platform 
Windows Live UX Platform Language Pack 
Windows Live Writer 
Windows Live Writer Resources 
Zuma's Revenge 

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Smart PC Booster 7 deleted successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== EOF on Mon 08/04/2014 at  9:15:15.71 ===============

[GregMiller]

I see Smart Booster 7 is still showing as installed. When I go to the uninstall programs listing it is there.

 

The program doesn't startup whenever the PC is turned on like it used to but it worries me that it is still lurking there or at least the listing is still there.

[Naathim]

OK, that means we need to dig deeper. I need to reconsider my next steps. Please stay tuned

[GregMiller]

PS: The computer does not seem to be acting as if there is any sort of impediment so I am wondering if these are just program fragments but they should not be there or listed  in the apps screen--- that screen shot I sent. Another observation. That comapny Ask4Expert is the company that easily responded to the uninstall of the other program, the one current lisy=ted in the apps screen (or several of that name).

[Naathim]

Being honest - I don't believe that this app was malicious. Probably some feature was broken, what stalled the removal process. Most part is already deleted, now I need to search for the remains that should go, but first I need to collect some more info about where they may be located, cause some of them may be deep in the registry.

Appreciate your patience