[mcooley]

Still with you! Ok that's done. What next?

[Advertisements]

Two things are next

Turn your windows Firewall off we don't want Two running Norton's already has one running.
Follow the simple directions Here

Then

• Copy all text in the quote box (below)...to Notepad.
  

  @echo off
  rd /s /q "C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}"
  rd /s /q "C:\sh4ldr"
  rd /s /q "C:\Users\michelle cooley\MetricCollection.dll"
  rd /s /q "C:\Program Files\Enigma Software Group"
  rd /s /q "C:\Program Files\Common Files\mcafee"
  del %0

• Save the Notepad file on your desktop...as delfile.bat... save type as "All Files"
  It should look like this:
• Double click on delfile.bat to execute it.
  A black CMD window will flash, then disappear...this is normal.
• The files and folders, if found...will have been deleted and the "delfile.bat" file will also be deleted.

[zep516]

Two things are next

Turn your windows Firewall off we don't want Two running Norton's already has one running.
Follow the simple directions Here

Then

• Copy all text in the quote box (below)...to Notepad.
  

  @echo off
  rd /s /q "C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}"
  rd /s /q "C:\sh4ldr"
  rd /s /q "C:\Users\michelle cooley\MetricCollection.dll"
  rd /s /q "C:\Program Files\Enigma Software Group"
  rd /s /q "C:\Program Files\Common Files\mcafee"
  del %0

• Save the Notepad file on your desktop...as delfile.bat... save type as "All Files"
  It should look like this:
• Double click on delfile.bat to execute it.
  A black CMD window will flash, then disappear...this is normal.
• The files and folders, if found...will have been deleted and the "delfile.bat" file will also be deleted.

[mcooley]

ok that now has been completed

[zep516]

Are there any more issues or browser problems ?

[mcooley]

there don't seem to be. I'm able to do all the usual things & open files in a normal & timely manner

[zep516]

It looks like you fixed it then.

We need to remove all the tools now and log files by running Defix, then we close the topic.

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report.
  Paste it for my review.

[mcooley]

Hi Joe -

 

Once again, thank you for all your help this weekend! I'll be sure to recommend your site. Here's the final log you requested. Have a good one!

 

- Michelle

 

# DelFix v1.011 - Logfile created 07/09/2015 at 19:26:08
# Updated 18/08/2015 by Xplode
# Username : michelle cooley - COOLEYMOM-PC
# Operating System : Windows 8.1  (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\michelle cooley\Downloads\FRST-OlderVersion
Deleted : C:\TDSSKiller.3.1.0.5_05.09.2015_22.16.02_log.txt
Deleted : C:\TDSSKiller.3.1.0.5_05.09.2015_22.29.35_log.txt
Deleted : C:\Users\michelle cooley\Desktop\JRT.txt
Deleted : C:\Users\michelle cooley\Downloads\Addition.txt
Deleted : C:\Users\michelle cooley\Downloads\Fixlog.txt
Deleted : C:\Users\michelle cooley\Downloads\FRST.txt
Deleted : C:\Users\michelle cooley\Downloads\FRST64.exe
Deleted : C:\Users\michelle cooley\Downloads\JRT (1).exe
Deleted : C:\Users\michelle cooley\Downloads\JRT.exe
Deleted : C:\Users\michelle cooley\Downloads\tdsskiller.exe
Deleted : C:\Users\michelle cooley\Downloads\TFC.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\AdwCleaner

########## - EOF - ##########

[zep516]

It's been Cooley working with you

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

Safe Computing Practices please read Here


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe