[LiquidTension]

Hi Ian, 
 
Lets deal with those files detected by ESET, and your list of installed programmes. 
If all is well afterwards, we'll remove the tools we've used. 
 
Let me know how you get on.
 
 Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key  + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  C:\ProgramData\EmailNotifier
  C:\Users\All Users\EmailNotifier
  C:\ProgramData\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res 
  C:\Users\All Users\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res
  C:\Users\Papa\Documents\New Folder\winzip175-mediafire_c1.exe
  C:\Users\Papa\Downloads\java_installer.exe
  C:\Users\Papa\Downloads\winzip18-lan_en.exe
  C:\Windows\Installer\12c478.msi
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST.exe and select  Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

​----------------------------
 
I've listed the programmes installed on your machine below, along with a description of the programme and a link to a reference. I've also stated whether I believe the programme should be kept, removed, or decided by you. 
 
Key: 

• o = optional
• k = keep
• x = remove

​----------------------------

• o 7-Zip 9.20 (file archiver, used to compress files) 
• o ACID Pro 7.0 (audio editor)
• o Acrobat.com (increases Adobe Cloud service functionality; usually bundled with other Adobe software)
• o Adobe AIR (package the same code into native apps; for developers)
• k Adobe Flash Player (view multimedia content)
• k Adobe Reader X (10.1.12) (pdf reader)
• o Adobe Shockwave Player (multimedia platform to add animation to webpages)
• o Amazon MP3 Downloader 1.0.5 (automatically imports songs purchased on Amazon into iTunes or WMP) 
• x AOL Uninstaller (AOL software uninstaller; no AOL software installed)
• k Apple Application Support (required to run iTunes, QuickTime, etc)
• k Apple Mobile Device Support (required to sync Apples device to PC)
• k Apple Software Update (installs latest version of Apple software)
• k Atheros Driver Installation Program (wireless driver package)
• o Betting Assistant (1-click betting and live scores)
• o calibre (e-book library manager)
• o Company of Heroes 2 (strategy game)
• o Compatibility Pack for the 2007 Office system (save and edit documents from different versions of Word, Excel, etc)
• k Conexant HD Audio (audio codecs)
• k Dell V305 (Dell V305 printer)
• o DHTML Editing Component (IE ActiveX object provides HTML editing capabilities)
• o EA Download Manager (manage EA games)
• k ESU for Microsoft Vista (essential system updates)
• o FBReader for Windows (e-book reader)
• x Geek Squad 24 Hour Computer Support (remote assistance from Geek Squad)
• k Google Chrome (browser)
• x Google Desktop (discontinued Google software)
• k HDAUDIO Soft Data Fax Modem with SmartCP (related to Conexant HD Audio)
• k HP Active Support Library (troubleshooting HP tools)
• k HP Battery Check
• x HP Customer Experience Enhancements
• o HP Doc Viewer (convert documents into editable text)
• k HP DVD Play 3.7 (DVD play back)
• k HP Help and Support
• k HP Quick Launch Buttons 6.40 H2 (controls quick launch buttons on your keyboard)
• o HP Total Care Advisor (see PC status at a glance)
• x HP Total Care Setup (setups Total Care, which is already installed)
• k HP Update
• o HP User Guides 0118
• k HP Wireless Assistant (reports status of installed wireless devices)
• o iCopyExpert 3.1.2 (transfer music from iPod to PC)
• o iPod To Computer Transfer 5.6 (transfer music from iPod to PC)
• o iTunes (media library)
• o LabelPrint (print CD/DVD labels)
• o LightScribe System Software (create laser-etched CD/DVD labels)
• o Logitech Touch Mouse Server 1.0 (control PC with iPod/iPhone)
• k Malwarebytes Anti-Malware version 2.0.2.1012 (anti-malware programme; run a Threat Scan once/week)
• o Microsoft Live Search Toolbar (provides additional functionality to IE)
• k Microsoft Office (contains Word, Excel, PowerPoint, etc)
• o Microsoft Virtual PC 2007 (virtualization software)
• k Mozilla Firefox (browser)
• o muvee Reveal (video editing software)
• k Nero 11 (multimedia suite)
• k Norton 360 (security suite)
• k NVIDIA Drivers (Nvidia graphics)
• o Power Tab Editor 1.7 (tablature editor for guitar, bass and ukulele)
• o Power2Go (burn data, rip music, copy discs)
• k QuickBooks Pro 2009 (accounting software)
• o QuickTime (media player)
• k Realtek USB 2.0 Card Reader
• k Revo Uninstaller 1.95 (comprehensive programme uninstaller)
• o Skype web features (click-to-call integrated into web pages)
• k Skype™ 6.11 (VoIP service and IM client)
• o SPORE™ (game)
• x SupportSoft Assisted Service (bundled support software for large IT helpdesks)
• k Synaptics Pointing Device Driver (touchpad driver)
• o System Requirements Lab CYRI (compare your system specs with the required specs for a game)
• o Turbo Lister 2 (eBay bulk listing tool)
• o TuxGuitar (tablature editor)
• k Update for 2007 Microsoft Office 
• o VLC media player (media player)
• o WeatherBug® (provides live weather information)
• x Windows Live ID Sign-in Assistant (used for Windows Live Esstentials software, which aren't installed)
• x Yahoo! Install Manager (manages Yahoo! software, which aren't installed)

​----------------------------
 
It's important to consider if you use the programme or not, the size of the programme, and whether the programme is paid-for or free. Please remember that you should not treat the above as gospel; ultimately, the choice is yours, and you must be certain before you remove any software. 
 
Programmes can be uninstalled by:
 
 Uninstall Software

• Press the Windows Key  + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the programme, right-click and click Uninstall.
• Follow the prompts.
• Reboot if necessary.

​----------------------------
 
The following software (if still installed) requires updating. Please do so afterwards. 
 
 Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

•  Adobe Air
•  Adobe Flash Player (Uncheck the "Optional Offer")
•  Adobe Reader (Uncheck the "Optional Offer")
•  Adobe Shockwave Player
•  Google Chrome
•  Mozilla Firefox
•  Follow these instructions to check for and download the latest Windows Updates.

[Advertisements]

Hello Adam,

 

FRST stopped agai, ran it twice, stoped twice, but it did produce the following

 

Fixlog

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 30-09-2014

Ran by Papa at 2014-10-01 15:00:37 Run:8

Running from C:\Users\Papa\Desktop

Loaded Profiles: Papa &  (Available profiles: Papa)

Boot Mode: Normal

 

==============================================

 

Content of fixlist:

*****************

start

C:\ProgramData\EmailNotifier

C:\Users\All Users\EmailNotifier

C:\ProgramData\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res 

C:\Users\All Users\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res

C:\Users\Papa\Documents\New Folder\winzip175-mediafire_c1.exe

C:\Users\Papa\Downloads\java_installer.exe

C:\Users\Papa\Downloads\winzip18-lan_en.exe

C:\Windows\Installer\12c478.msi

EmptyTemp:

end

*****************

 

"C:\ProgramData\EmailNotifier" => File/Directory not found.

"C:\Users\All Users\EmailNotifier" => File/Directory not found.

"C:\ProgramData\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res" => File/Directory not found.

"C:\Users\All Users\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res" => File/Directory not found.

"C:\Users\Papa\Documents\New Folder\winzip175-mediafire_c1.exe" => File/Directory not found.

"C:\Users\Papa\Downloads\java_installer.exe" => File/Directory not found.

"C:\Users\Papa\Downloads\winzip18-lan_en.exe" => File/Directory not found.

"C:\Windows\Installer\12c478.msi" => File/Directory not found.

 

The other items will take some time, I will have to work my way through the lists.

 

Regards,

Ian

[Geekimnot]

Hello Adam,

 

FRST stopped agai, ran it twice, stoped twice, but it did produce the following

 

Fixlog

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 30-09-2014

Ran by Papa at 2014-10-01 15:00:37 Run:8

Running from C:\Users\Papa\Desktop

Loaded Profiles: Papa &  (Available profiles: Papa)

Boot Mode: Normal

 

==============================================

 

Content of fixlist:

*****************

start

C:\ProgramData\EmailNotifier

C:\Users\All Users\EmailNotifier

C:\ProgramData\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res 

C:\Users\All Users\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res

C:\Users\Papa\Documents\New Folder\winzip175-mediafire_c1.exe

C:\Users\Papa\Downloads\java_installer.exe

C:\Users\Papa\Downloads\winzip18-lan_en.exe

C:\Windows\Installer\12c478.msi

EmptyTemp:

end

*****************

 

"C:\ProgramData\EmailNotifier" => File/Directory not found.

"C:\Users\All Users\EmailNotifier" => File/Directory not found.

"C:\ProgramData\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res" => File/Directory not found.

"C:\Users\All Users\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.res" => File/Directory not found.

"C:\Users\Papa\Documents\New Folder\winzip175-mediafire_c1.exe" => File/Directory not found.

"C:\Users\Papa\Downloads\java_installer.exe" => File/Directory not found.

"C:\Users\Papa\Downloads\winzip18-lan_en.exe" => File/Directory not found.

"C:\Windows\Installer\12c478.msi" => File/Directory not found.

 

The other items will take some time, I will have to work my way through the lists.

 

Regards,

Ian

[LiquidTension]

OK, let me know how you get on, and if you have any questions. 

[Geekimnot]

Hello Adam,

 

OK I have installed the requested programs, and uninstalled the X and some of the O 

 

Windows updates have always been scheduled

 

But please be aware that I use AOL all the time, so left that uninstall alone

cheers

 

Ian

[LiquidTension]

OK, that's good Ian.

How is the computer performing? Are there any outstandingissues?

[Geekimnot]

Hello Adam,

 

There do not seem to be any further problems. I am about to do a defrag, then I will start to remove some of the items in the Startup.

 

Otherwise all OK.

 

Regards

Ian

[LiquidTension]

Hi Ian, 

 

I see you've used MSCONFIG to manage two of your startup programmes. I would assume you intend on doing the same to manage your other programmes. Here's some information on why you should avoid using MSCONFIG as a startup manager, and an alternative method you can use. 

 

 Using MSCONFIG as a Startup Manager
From your logs I can see you are using MSCONFIG as a startup manager. I would not advise this. MSCONFIG is a system configuration utility, designed to help troubleshoot and diagnose system configuration issues in Windows. From the Microsoft article relating to MSCONFIG, "The System Configuration utility helps you find problems with your Windows configuration. It does not manage the programs that run when Windows starts."
 
Whilst the programme works as a basic startup manager, MSCONFIG should not be used to routinely disable auto-start programmes. It is a temporary solution and not a good practice for the following reasons.

• Uninstalling programmes left disabled in MSCONFIG will sometimes result in a failed uninstallation. 
• MSCONFIG will often leave orphaned entries when software is uninstalled. When used to switch back to normal startup mode, these orphan entries can result in boot-up errors.
• MSCONFIG allows malware-related items to hide in your registry which may not become apparent until switched back to normal startup mode - this could result in reinfection. 
• MSCONFIG does not list all applications loaded in all possible startup locations, as some entry points are hidden and unknown to the user. 
   

For these reasons, I recommend reversing the changes made in MSCONFIG...

• Press the Windows Key  + r on your keyboard at the same time. Type msconfig and click OK.
• If prompted for an administrator password or for confirmation, type the password, or provide confirmation.
• In the Startup tab, click Enable All, followed by OK.
• If prompted, click Restart.

...and installing the programme below. 
 
 WinPatrol is a versatile system monitoring programme (originally created by Bill Pytlovany/BillP Studios and now owned by Ruiware, LLC) that utilizes a small memory footprint and offers various features, such as:

• Takes a snapshot of critical system resources and provides alerts if any changes occur.
• Serves as a Startup Manager which works much better than MSCONFIG.
• Tracks programmes that have been installed on your system and monitor the location Windows uses to store uninstall information.
• Alerts to changes in programmes that run at startup.
• Alerts if another programme has removed a startup programme.
• Alerts if attempts are made to change (hijack) browser Home and Search pages in Internet Explorer.
• Has the ability to delay the launch of a startup programmes.
• Monitors toolbars, registry modifications, changes to file extensions and changes to the HOSTS file.

I recommend reading the documentation before installing the programme.

[Geekimnot]

Hello Adam,

 

I have followed your instructions.

 

The documentation program shows a series of links, most of them do not work, I get an "internal server error" message for most of them, but the first link does work and I should be able to use that to work out which to delete.

 

It will take me some time to do this as I will have to investigate each line separately.

 

Cheers,

Ian

[LiquidTension]

Hi Ian, 

 

The links work for me. 

http://www.winpatrol.com/startup.html

 

Most of your startup programmes can be disabled, and manually enabled after logon by double-clicking the executable if you need the programme. 

 

SynTPEnh, EKIJ5000StatusMonitor, iTunesHelper, LightScribe Control Panel, etc. None of these need to be starting up, and can be turned on manually if needed.

 

Let me know how you get on, and if you have any questions. 

Provide an update on your computer once done as well. 

[LiquidTension]

Hello Ian,

How are you getting on? Do you require additional time, or have any questions?

[Geekimnot]

Good morning Adam,

 

Sorry about the silence for the last few days. I was away for the weekend.

 

No more problems as far as I can see.

 

I still need to take some items off the startup, and also delete a number of redundant files but cannot see any further problems.

 

Thank you for all your help. it has been very kind of you to spare the time.

 

From the timing of some of your posts I suspect that you do not live in the UK

 

Best regards,

Ian

[LiquidTension]

OK, no problem Ian. 

 

Let me know when you've finished sorting your startup programmes, etc, and I will provide instructions on how to remove the tools we've used. 

[Geekimnot]

OK Adam,

 

Should finish over teh weekend

 

Cheers

Ian

[Geekimnot]

Hi Adam,

 

Have deleted all that I want to now.

 

Regards,

Ian

[LiquidTension]

Good job.

 

All Clean!
Congratulations, your computer appears clean!  
I no longer see signs of malware on your computer, and feel satisfied that our work here is done. The steps below will remove the tools we have used, and reset any settings changed. I have also provided a list of resources and tools that you may find useful. 
 
My help will always be free. But if you are happy with the help provided, and would like to support my fight against malware and/or buy me a beer, please consider a donation. 
 

 

STEP 1
 DelFix

• Please download DelFix and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset system settings
• Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
 
--- Malwarebytes Anti-Malware will still be present on your computer. I recommend keeping this programme, updating and scanning with it once a week to maintain security on your computer. If you do not wish to keep this programme on your computer, you can uninstall it by pressing the Windows Key  + r on your keyboard at the same time, typing appwiz.cpl, clicking OK and searching for Malwarebytes.
 
======================================================
 
Below I have compiled a list of resources you may find useful. The articles document information on computer security, common infection vectors and how you can stay safe on the Internet.

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
   

The following programmes come highly recommended in the security community.

•  AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
•  Emsisoft Antimalware (free) acts as an additional on-demand scanner, and can be used in conjunction with your Anti-Virus. 
•  Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
•  Malwarebytes Anti-Malware Premium (MBAM) incorporates real-time protection and is designed to run alongside your Anti-Virus. 
•  NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology. 
•  Sandboxie isolates programmes of your choice, preventing files from writing to your HDD unless you approve the file. 
•  Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
•  SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
•  Unchecky automatically removes checkmarks for additional software in programme installers, helping you avoid adware and PUPs. 
•  Web of Trust (WOT) is a browser add-on designed to alert the user before interacting with a potentially malicious website. 
   

Need a second opinion on a file or website? Scan the file/URL before clicking by using one of the following free online scanner services.

•  VirusTotal (File & URL)
•  Jotti's Malware Scan (File)
•  Dr.Web Online Check (URL)
•  Trend Micro Site Safety Center (URL)
•  Norton Safe Web (URL)

-- Please feel free to ask if you have any questions or concerns on computer security or the programmes above.
 
======================================================
 
Please confirm you have no outstanding issues, and are happy with the state of your computer. Once I have confirmation things are in order, we can wrap things up and I will close this thread. 
 
Thank you for using Geeks to Go!
 
Safe Surfing.  
Adam (LiquidTension).