[vtmckoy]

 

 

I did the following:

 

C:\>Path > "%Userprofile%"\OneDrive\Desktop\Environment.txt

 

C:\>more "%Userprofile%"\OneDrive\Desktop\Environment.txt

PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL;C:\Program Files\Intel\Intel® Management Engine Components\DAL;C:\Users\vtmck\AppData\Local\Microsoft\WindowsApps

 

C:\>set

ALLUSERSPROFILE=C:\ProgramData

APPDATA=C:\Users\vtmck\AppData\Roaming

CommonProgramFiles=C:\Program Files\Common Files

CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files

CommonProgramW6432=C:\Program Files\Common Files

COMPUTERNAME=DESKTOP-SDMIR14

ComSpec=C:\WINDOWS\system32\cmd.exe

DriverData=C:\Windows\System32\Drivers\DriverData

HOMEDRIVE=C:

HOMEPATH=\Users\vtmck

LOCALAPPDATA=C:\Users\vtmck\AppData\Local

LOGONSERVER=\\DESKTOP-SDMIR14

NUMBER_OF_PROCESSORS=8

OneDrive=C:\Users\vtmck\OneDrive

OneDriveConsumer=C:\Users\vtmck\OneDrive

OS=Windows_NT

Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL;C:\Program Files\Intel\Intel® Management Engine Components\DAL;C:\Users\vtmck\AppData\Local\Microsoft\WindowsApps

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

PROCESSOR_ARCHITECTURE=AMD64

PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 142 Stepping 12, GenuineIntel

PROCESSOR_LEVEL=6

PROCESSOR_REVISION=8e0c

ProgramData=C:\ProgramData

ProgramFiles=C:\Program Files

ProgramFiles(x86)=C:\Program Files (x86)

ProgramW6432=C:\Program Files

PROMPT=$P$G

PSModulePath=C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules

PUBLIC=C:\Users\Public

SystemDrive=C:

SystemRoot=C:\WINDOWS

TEMP=C:\Users\vtmck\AppData\Local\Temp

TMP=C:\Users\vtmck\AppData\Local\Temp

USERDOMAIN=DESKTOP-SDMIR14

USERDOMAIN_ROAMINGPROFILE=DESKTOP-SDMIR14

USERNAME=vtmck

USERPROFILE=C:\Users\vtmck

VBOX_MSI_INSTALL_PATH=C:\Program Files\Oracle\VirtualBox\

windir=C:\WINDOWS

 

C:\>

 

That is odd as the variables indicates that the %Userprofile%=c:\Users\vtmck and the desktop should be under your profile.

 

Please download Farbar Service Scanner and run it.

 

Make sure All options are checked and press on scan.:

 

It will create a log (FSS.txt) in the same directory the tool is run.

 

Please copy and paste the log to your reply.

 

 

Hi,

 

I downloaded this and ran it.  It stated:  "This software is not permitted for commercial purposes".  I clicked "Yes" to continue.  Before I ran it, I checked all of the options, then clicked Scan.  Attached is the FSS.txt file.  

Attached Thumbnails

• 

Attached Files

•  FSS.txt   2.65KB   186 downloads

[Advertisements]

 

I have move the topic to the Malware forum, as I may have to use special tools to check your system.

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

• Right click FRST(64) and select Run as administrator.

• Make sure that under Optional Scans, there is a checkmark on Addition.txt.

• Press Scan button.

• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

• The tool will also produce another log (Addition.txt ). Please attach this to your reply.

 

 

 

Please run this.

[JSntgRvr]

 

I have move the topic to the Malware forum, as I may have to use special tools to check your system.

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

• Right click FRST(64) and select Run as administrator.

• Make sure that under Optional Scans, there is a checkmark on Addition.txt.

• Press Scan button.

• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

• The tool will also produce another log (Addition.txt ). Please attach this to your reply.

 

 

 

Please run this.

[vtmckoy]

I clicked on the link you provided to download the Farbar Recovery Scan Tool.  There is a 32-bit version and a 64-bit version.  When I click on the download button, I get a screen stating that "FRST.exe is not commonly downloaded and may be dangerous".    I also get the same message for the 64-bit version--FRST64.exe. It gives me the option to discard or keep.  Should I "keep" and go ahead and download both?

Attached Thumbnails

• 

[JSntgRvr]

Yes Yours is the 64bits.

[vtmckoy]

Attached are the requested files.  On a side note, my laptop is back to where it was prior to me running WinEditor yesterday. When I click START, Command Prompt App is not coming up and Control Panel is coming up, but not as an App.  When I click on it, it does execute and go to Control Panel configuration.

Attached Files

•  Addition.txt   31.26KB   232 downloads
•  FRST.txt   33.8KB   219 downloads

[JSntgRvr]

Did you perform a System Restore?
 
Lets remove some orphan entries and get more information from your computer:

• Highlight the entire content of the quote box below.

Start:: 

CloseProcesses: 

S3 mfevtp; C:\Windows\system32\mfevtps.exe [509728 2019-01-15] (McAfee, Inc. -> McAfee, LLC) 

S4 McAPExe; "C:\Program Files\Common Files\McAfee\VSCore_18_12\McApExe.exe" [X] 

S3 McAWFwk; "c:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe" [X] 

S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\3.1.160.0\\McCSPServiceHost.exe" [X] 

S3 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe" [X] 

S2 mfemms; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X] 

S2 ModuleCoreService; "C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe" [X] 

S2 PEFService; "C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe" [X] 

S3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [77144 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [510808 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [373592 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [85928 2019-04-23] (Microsoft Windows Early Launch Anti-malware Publisher -> McAfee, LLC) 

R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [516952 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [980824 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [563528 2019-04-23] (McAfee, Inc. -> McAfee LLC.) 

S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [108872 2019-04-23] (McAfee, Inc. -> McAfee LLC.) 

R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [117592 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [253784 2019-04-23] (McAfee, Inc. -> McAfee, LLC) 

S4 McAPExe; "C:\Program Files\Common Files\McAfee\VSCore_18_12\McApExe.exe" [X] 

S3 McAWFwk; "c:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe" [X] 

S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\3.1.160.0\\McCSPServiceHost.exe" [X] 

S3 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe" [X] 

S2 mfemms; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X] 

S2 ModuleCoreService; "C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe" [X] 

S2 PEFService; "C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe" [X] 

ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} =>  -> No File 

ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} =>  -> No File 

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File 

FirewallRules: [{4DD4579E-3FF6-492B-97DE-11FB49146E90}] => (Allow) C:\Users\vtmck\AppData\Roaming\Zoom\bin\airhost.exe => No File 

FirewallRules: [{824A9BFA-4A76-4028-9D86-24AE8FC04D1B}] => (Allow) C:\Users\vtmck\AppData\Roaming\Zoom\bin\airhost.exe => No File 

2020-12-02 19:09 - 2020-12-12 20:20 - 000000128 _____ () C:\Users\vtmck\AppData\Roaming\PUTTY.RND

2020-10-21 11:40 - 2020-11-15 07:04 - 000000128 ____H () C:\Users\vtmck\AppData\Local\PUTTY.RND

CMD: Dir /a:d C:\Users\vtmck\OneDrive

CMD: Dir /a:d C:\Users\vtmck

CMD: SFC /ScanNow

Zip: C:\Windows\Logs\CBS\cbs.log 

HOSTS:

CMD: Bitsadmin /Reset /Allusers

EMPTYTEMP:

End::

• Right click on the highlighted text and select Copy.
• Start FRST (FRST64) with Administrator privileges
• Press the Fix button. FRST will process the lines copied above from the clipboard.
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.

 

A .zip folder will be created on your desktop. Please have it attached to a reply.

[vtmckoy]

Hi,

 

I did not perform a system restore; however, a few months back my laptop started making noise and would not boot.  I had a warranty and I took it to Best Buy Geek Squad.  They stated that it was the fan; however, they sent it to Dell.  It took about 3 weeks before I got it back.  Dell stated that they saw nothing wrong with the laptop and they just restored it.  I never received details from Best Buy as to exactly what was wrong.  

 

As far as your steps above, you told me to copy all of the highlighted text and to start FRST64 with Admin privileges.  Then you state to press FIX.  Should I paste what I copied BEFORE I hit the FIX button?  If so, where should I paste it?  Should it be pasted in the "Search" box.  I have not used this tool before.

 

Also, will this adversely affect anything?  This is the only decent laptop I have and I am studying a lot and need this laptop to complete my studies.

 

Thanks...

[JSntgRvr]

Hi,

 

I did not perform a system restore; however, a few months back my laptop started making noise and would not boot.  I had a warranty and I took it to Best Buy Geek Squad.  They stated that it was the fan; however, they sent it to Dell.  It took about 3 weeks before I got it back.  Dell stated that they saw nothing wrong with the laptop and they just restored it.  I never received details from Best Buy as to exactly what was wrong.  

 

As far as your steps above, you told me to copy all of the highlighted text and to start FRST64 with Admin privileges.  Then you state to press FIX.  Should I paste what I copied BEFORE I hit the FIX button?  If so, where should I paste it?  Should it be pasted in the "Search" box.  I have not used this tool before.

 

Also, will this adversely affect anything?  This is the only decent laptop I have and I am studying a lot and need this laptop to complete my studies.

 

Thanks...

Copy the highlighted text. Open FRST64 and click on fix. FRST64 will get the information automatically from memory.

 

 

Try these commands:

 

(Open Control Panel in last used view)
%windir%\System32\control.exe

OR

(Always Open Control Panel in category view)
%windir%\explorer.exe shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}

OR

(Always Open Control Panel in icons view)
%windir%\explorer.exe shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}

 

Let me know which ones work, and the one you like best.

[vtmckoy]

(Open Control Panel in last used view)   and  (Always Open Control Panel in category view)  produced the same results.  I guess if I had to choose, it would be the one below:

 

(Always Open Control Panel in category view)

%windir%\explorer.exe shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}

 

Attached are the 2 requested files.  Also, after the FRST tool completed, a message popped up stating that the computer needs a restart.  I assumed changes were made; but I'm about to restart.

Attached Files

•  14.12.2020_20.46.21.zip   567.99KB   208 downloads
•  Fixlog.txt   16.29KB   208 downloads

[JSntgRvr]

Open FRST64. Copy and paste the following on the search window:

 

cmd.exe

 

Click on Search Registry.

 

Copy and paste the resulting report.

[JSntgRvr]

 

Hi,

 

I did not perform a system restore; however, a few months back my laptop started making noise and would not boot.  I had a warranty and I took it to Best Buy Geek Squad.  They stated that it was the fan; however, they sent it to Dell.  It took about 3 weeks before I got it back.  Dell stated that they saw nothing wrong with the laptop and they just restored it.  I never received details from Best Buy as to exactly what was wrong.  

 

As far as your steps above, you told me to copy all of the highlighted text and to start FRST64 with Admin privileges.  Then you state to press FIX.  Should I paste what I copied BEFORE I hit the FIX button?  If so, where should I paste it?  Should it be pasted in the "Search" box.  I have not used this tool before.

 

Also, will this adversely affect anything?  This is the only decent laptop I have and I am studying a lot and need this laptop to complete my studies.

 

Thanks...

Copy the highlighted text. Open FRST64 and click on fix. FRST64 will get the information automatically from memory.

 

 

Try these commands:

 

(Open Control Panel in last used view)
%windir%\System32\control.exe

OR

(Always Open Control Panel in category view)
%windir%\explorer.exe shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}

OR

(Always Open Control Panel in icons view)
%windir%\explorer.exe shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}

 

Let me know which ones work, and the one you like best.

 

You can create a shortcut on your desktop using any of these commands. For more icons you can browse to  C:\windows\system32\shell32.dll file and select one.

[JSntgRvr]

Time to get some ZZZZZZZ. Will check on you in the am. Good night!

[vtmckoy]

Open FRST64. Copy and paste the following on the search window:

 

cmd.exe

 

Click on Search Registry.

 

Copy and paste the resulting report.

Attached is the SearchReg.txt file.  

 

You stated the following: 

 

You can create a shortcut on your desktop using any of these commands. For more icons you can browse to  C:\windows\system32\shell32.dll file and select one.

 

I am able to get "Control Panel" via the search bar; however, as I stated in a previous post, it doesn't come up as an App.  Basically, it comes up with the label "Control Panel", then underneath it is "Control Panel" again--not App.  It has "Open" as an option in the right pane; but it doesn't have anything additional like the Recent options/settings like it use to display.  I'm okay with it though.

 

Command Prompt doesn't come up at all in the search when I click START.

Attached Files

•  SearchReg.txt   4.45KB   205 downloads

[vtmckoy]

Time to get some ZZZZZZZ. Will check on you in the am. Good night!

Good night; thanks for your help!!!

[JSntgRvr]

 

Open FRST64. Copy and paste the following on the search window:

 

cmd.exe

 

Click on Search Registry.

 

Copy and paste the resulting report.

Attached is the SearchReg.txt file.  

 

You stated the following: 

 

You can create a shortcut on your desktop using any of these commands. For more icons you can browse to  C:\windows\system32\shell32.dll file and select one.

 

I am able to get "Control Panel" via the search bar; however, as I stated in a previous post, it doesn't come up as an App.  Basically, it comes up with the label "Control Panel", then underneath it is "Control Panel" again--not App.  It has "Open" as an option in the right pane; but it doesn't have anything additional like the Recent options/settings like it use to display.  I'm okay with it though.

 

Command Prompt doesn't come up at all in the search when I click START.

 

You clicked on Search Files instead of Search Registry. Can you produce the RegSearch.txt report?