[DR M]

Our search returned with no results.
 
What we can do now to confirm that there is nothing malicious left in the computer, is an online scan with Eset.

ESET Online Scanner

Download ESET Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens, click Get Started.
• Read and accept the license agreement.
• At the Welcome to ESET Online Scanner window, click Get Started.
• Select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• Click on the Full Scan option.
• Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time.
• When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
• On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

[Advertisements]

4/4/2021 17:57:24 PM

Files scanned: 1724911

Detected files: 55

Cleaned files: 55

Total scan time 08:00:09

Scan status: Finished

A:\Users\Terry\Downloads\New folder\Detection.exe a variant of Win64/SystemRequirementsLab.B potentially unwanted application cleaned by deleting

 

A:\Users\Terry\Downloads\New folder\uTorrent (1).exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

A:\Users\Terry\Downloads\New folder\uTorrent.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

A:\Utility_Powerline(v7.1.0101)\dynwrapx.dll a variant of Win32/DynamicWrapperX.A potentially unsafe application cleaned by deleting

 

C:\AdwCleaner\Quarantine\C\ProgramData\apn\APN-Stub\W3IV6-G\APNIC.dll.vir a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application cleaned by deleting

 

C:\AdwCleaner\Quarantine\C\Users\terry\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\6.6.4_0\js\contentScripts\contentScript.js.vir JS/Chromex.Agent.AP trojan cleaned by deleting

 

C:\AdwCleaner\Quarantine\files\tybyorxkchfcxlrzjkfvgtkizqkespzu\{7DD8CEAD-55C9-E044-8622-7510C7DF55D0}\YSearchUtil.dll a variant of Win32/YahooSearch.C potentially unwanted application cleaned by deleting

 

C:\AdwCleaner\Quarantine\v1\20210314.060738\28\jZip\apphelp.dll#273EC0AF1EE57844 a variant of Win32/Toolbar.SearchSuite.AH potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.4.5_41372.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.4.5_41712.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.4.5_41865.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_44994.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45146.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45225.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45231.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45271.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45341.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45365.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45395.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45505.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45574.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45608.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45628.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45672.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45704.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45724.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45776.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45790.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45838.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\FRST\Quarantine\C\Program Files (x86)\Subtype\courted.exe NSIS/TrojanDownloader.Agent.NXY trojan cleaned by deleting

 

C:\FRST\Quarantine\C\Program Files (x86)\yum\undyed.exe MSIL/Adware.Dotdo.GU application cleaned by deleting

 

C:\Program Files\DAEMON Tools Ultra\Uninstall.exe a variant of Win32/Yandex.K potentially unwanted application cleaned by deleting

 

F:\Downloads\adobe_flash_player_0004727167.exe Win32/InstallCore.Gen.B potentially unwanted application cleaned by deleting

 

F:\Downloads\jZipSetup-bc.exe Win32/Toolbar.SearchSuite.W potentially unwanted application,a variant of Win32/Toolbar.SearchSuite.AH potentially unwanted application cleaned by deleting

 

F:\Downloads\uTorrent.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

F:\Downloads\ZoomInfoContactContributor.exe Python/ZoomInfo.A potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\1431120038_GrandTheftAutoV PLUS23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+24Tr-LNG_v1.0.350.2.exe a variant of MSIL/GameHack.SZ potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\1431120038_GrandTheftAutoV PLUS23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+24Tr-LNG_v1.0.350.2_Altv.exe a variant of MSIL/GameHack.SZ potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Watch_Dogs+24Tr-LNG_v1.01\Watch_Dogs+24Tr-LNG_v1.01\Watch_Dogs+24Tr-LNG_v1.01.exe a variant of MSIL/GameHack.SZ potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\ccsetup324.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\HSS-3.32-install-e-550-plain.exe Win32/Bundled.Toolbar.Ask.L potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\icq_rfrset.exe a variant of Win32/MailRu.O potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim (1).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim (2).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim (3).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\spsetup123.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\CDownloads\oi_azmid170exe.exe a variant of Win32/OpenInstall potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\DM-238.exe Win32/HotSpotShield potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\DM-247.exe Win32/HotSpotShield potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\DM-379.exe Win32/HotSpotShield potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\utorrent.exe a variant of Win32/uTorrent.D potentially unwanted application cleaned by deleting

 

F:\Program Files\DAEMON Tools Ultra\Uninstall.exe a variant of Win32/Yandex.K potentially unwanted application cleaned by deleting

 

F:\torrents\MAGIX SOUND FORGE Pro 13.0.0.48\MAGIX.SOUND.FORGE.Pro.13.0.0.48_x64\Patch-sf13-64.exe a variant of Win32/HackTool.Patcher.AD potentially unsafe application cleaned by deleting

 

F:\torrents\MAGIX SOUND FORGE Pro 13.0.0.48\MAGIX.SOUND.FORGE.Pro.13.0.0.48_x86\Patch-sf13-32.exe a variant of Win32/HackTool.Patcher.AD potentially unsafe application cleaned by deleting

[Terryc250]

4/4/2021 17:57:24 PM

Files scanned: 1724911

Detected files: 55

Cleaned files: 55

Total scan time 08:00:09

Scan status: Finished

A:\Users\Terry\Downloads\New folder\Detection.exe a variant of Win64/SystemRequirementsLab.B potentially unwanted application cleaned by deleting

 

A:\Users\Terry\Downloads\New folder\uTorrent (1).exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

A:\Users\Terry\Downloads\New folder\uTorrent.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

A:\Utility_Powerline(v7.1.0101)\dynwrapx.dll a variant of Win32/DynamicWrapperX.A potentially unsafe application cleaned by deleting

 

C:\AdwCleaner\Quarantine\C\ProgramData\apn\APN-Stub\W3IV6-G\APNIC.dll.vir a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application cleaned by deleting

 

C:\AdwCleaner\Quarantine\C\Users\terry\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\6.6.4_0\js\contentScripts\contentScript.js.vir JS/Chromex.Agent.AP trojan cleaned by deleting

 

C:\AdwCleaner\Quarantine\files\tybyorxkchfcxlrzjkfvgtkizqkespzu\{7DD8CEAD-55C9-E044-8622-7510C7DF55D0}\YSearchUtil.dll a variant of Win32/YahooSearch.C potentially unwanted application cleaned by deleting

 

C:\AdwCleaner\Quarantine\v1\20210314.060738\28\jZip\apphelp.dll#273EC0AF1EE57844 a variant of Win32/Toolbar.SearchSuite.AH potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.4.5_41372.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.4.5_41712.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.4.5_41865.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_44994.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45146.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45225.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45231.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45271.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45341.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45365.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45395.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45505.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45574.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45608.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45628.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45672.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45704.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45724.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45776.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45790.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\Documents and Settings\other\AppData\Roaming\uTorrent\updates\3.5.5_45838.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

C:\FRST\Quarantine\C\Program Files (x86)\Subtype\courted.exe NSIS/TrojanDownloader.Agent.NXY trojan cleaned by deleting

 

C:\FRST\Quarantine\C\Program Files (x86)\yum\undyed.exe MSIL/Adware.Dotdo.GU application cleaned by deleting

 

C:\Program Files\DAEMON Tools Ultra\Uninstall.exe a variant of Win32/Yandex.K potentially unwanted application cleaned by deleting

 

F:\Downloads\adobe_flash_player_0004727167.exe Win32/InstallCore.Gen.B potentially unwanted application cleaned by deleting

 

F:\Downloads\jZipSetup-bc.exe Win32/Toolbar.SearchSuite.W potentially unwanted application,a variant of Win32/Toolbar.SearchSuite.AH potentially unwanted application cleaned by deleting

 

F:\Downloads\uTorrent.exe a variant of Win32/uTorrent.C potentially unwanted application cleaned by deleting

 

F:\Downloads\ZoomInfoContactContributor.exe Python/ZoomInfo.A potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\1431120038_GrandTheftAutoV PLUS23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+24Tr-LNG_v1.0.350.2.exe a variant of MSIL/GameHack.SZ potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\1431120038_GrandTheftAutoV PLUS23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+23Tr-LNG_v1.0.350.2_rev5\GrandTheftAutoV+24Tr-LNG_v1.0.350.2_Altv.exe a variant of MSIL/GameHack.SZ potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Watch_Dogs+24Tr-LNG_v1.01\Watch_Dogs+24Tr-LNG_v1.01\Watch_Dogs+24Tr-LNG_v1.01.exe a variant of MSIL/GameHack.SZ potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\ccsetup324.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\HSS-3.32-install-e-550-plain.exe Win32/Bundled.Toolbar.Ask.L potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\icq_rfrset.exe a variant of Win32/MailRu.O potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim (1).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim (2).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim (3).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\Shockwave_Installer_Slim.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\ADownloads\spsetup123.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\CDownloads\oi_azmid170exe.exe a variant of Win32/OpenInstall potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\DM-238.exe Win32/HotSpotShield potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\DM-247.exe Win32/HotSpotShield potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\DM-379.exe Win32/HotSpotShield potentially unwanted application cleaned by deleting

 

F:\New folder\Downloads\HTG Locker\FDownloads\utorrent.exe a variant of Win32/uTorrent.D potentially unwanted application cleaned by deleting

 

F:\Program Files\DAEMON Tools Ultra\Uninstall.exe a variant of Win32/Yandex.K potentially unwanted application cleaned by deleting

 

F:\torrents\MAGIX SOUND FORGE Pro 13.0.0.48\MAGIX.SOUND.FORGE.Pro.13.0.0.48_x64\Patch-sf13-64.exe a variant of Win32/HackTool.Patcher.AD potentially unsafe application cleaned by deleting

 

F:\torrents\MAGIX SOUND FORGE Pro 13.0.0.48\MAGIX.SOUND.FORGE.Pro.13.0.0.48_x86\Patch-sf13-32.exe a variant of Win32/HackTool.Patcher.AD potentially unsafe application cleaned by deleting

[DR M]

Hi, Terryc250.
 
Eset detected and deleted a lot of stuff.
 
Let's move on. Please note that I want you to attach the FRST logs instead of copy/paste them. It's much easier for me to review them.
 
1. Uninstall Ace Stream Media
 
Since it seems that this program is account related, please restart the computer and log in with terry account.

• Press the Windows Key + R.
• Type appwiz.cpl in the Run box and click OK.
• The Add/Remove Programs list will open. Locate the following program on the list:

Ace Stream Media 3.1.9

• Select the above program and click Uninstall.
• Restart the computer and log in with other again.

 

2. Fresh FRST logs

• Double-click on the FRST icon to run it, as you did before. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

 

3. Feedback

 

How is the computer running now?

[Terryc250]

I uninstalled it on the terry account, and it said something along the lines of it already being uninstalled, but I accidently hit Ok before I got a close look at what it said, but it was cleared off the uninstall list as soon as I hit Ok. 

Seems to be running fine.  Thank you.

Attached Files

•  FRST.txt   76.11KB   180 downloads
•  Addition.txt   170.08KB   217 downloads

[DR M]

Hi, Terryc250.
 
From what I can see right now, the computer is clean from anything malicious.
 
The next steps are for the computer's better performance.
 
1. Disk cleanup

It seems that you have a very limited hard disk space. This can have a negative impact to your computer's functionality. You will not be able to update your operating system if you haven't got enough space. Of course, you have plenty of space in other drives, but your operating system is on drive C. A good idea would be saving your files in the other drives rather than C from now on, especially those taking much space. What we can also do, is run the disk cleanup utility and free as much space as we can.

• Press the Windows icon on your keyboard, together with the letter R.
• Type in the blank area cleanmgr and then press OK.
• Select Drive C and press OK.
• Select everything you don't need in the list that will appear. Actually, you can select everything there, but be careful if you need some files in the Downloads folder.
• Press the button Clean up system files and wait a bit.
• Again, select everything you don't need, including old Windows installations, if any.
• Select the tab More options.
• Under the title System Restore and Shadow Copies, press Clean up.
• Press Delete and OK if you are asked to.
• Wait some time (depending of the items that are deleted).
• Make a restart when the process is finished.

 

2. Upgrade the operating system
 
As I already told you, you are two major upgrades behind. You are running with version 1909, and the latest one is 20H2. It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect your computer. With the method I recommend below, the operating system will get reinstalled and upgraded, any possible errors or corruptions will be fixed without you losing anything of your personal files and apps.

• Go to this Microsoft page and under the title Create Windows 10 installation media press on Download tool now.
• Save the tool on your Desktop and double click to run it.
• On the License terms page, if you accept the license terms, select Accept.
• On the What do you want to do page, select Upgrade this PC now, and then select Next.
• Follow the instructions and select Keep personal files and apps, when you are asked to.
• It might take a couple of hours, depending on your wifi speed connection, to install Windows 10. Your PC will restart a few times. Make sure you don’t turn off your PC.
• After downloading and installing, the tool will walk you through how to set up Windows 10 on your PC.

 

After the above, I will need you to attach fresh FRST logs (Addition and FRST).

[Terryc250]

I don't really have many programs installed in my C:\ drive and uninstalled as much as I could.  But I successfully updated the OS. 

Attached Files

•  Addition.txt   160.33KB   216 downloads
•  FRST.txt   119.86KB   178 downloads

[DR M]

Hi, Terryc250.

 

I hope you followed my instructions above, regarding the Disk Cleanup utility. It has nothing to do with programs uninstall. I do see that you have now 17.5GB free space in C, but please let me know if you followed my instructions in Step 1 in my previous post.

 

Do you have any remaining question/concern regarding this computer?

[Terryc250]

Yup I did, but it only freed about 55 mb.  

I don't.  Thank you so much.

[DR M]

Great.
 
Since the computer is now clean, let's get into the home straight.

The following tool will remove the tools we used as well as reset system restore points:

Download KpRm by kernel-panik and save it to your desktop.

• Right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• Please copy and paste its contents in your next reply.

[Terryc250]

# Run at 4/7/2021 12:41:46 AM

# KpRm (Kernel-panik) version 2.9

# Website https://kernel-panik.me/tool/kprm/

# Run by other from C:\Users\other\Desktop

# Computer Name: TERRY-PC

# OS: Windows 10 X64 (19042) 

# Number of passes: 1

 

- Checked options -

 

    ~ Registry Backup

    ~ Delete Tools

    ~ Restore System Settings

    ~ UAC Restore

    ~ Delete Restore Points

    ~ Create Restore Point

    ~ Delete Quarantines

 

- Create Registry Backup -

 

   ~ [OK] Hive C:\WINDOWS\System32\config\SOFTWARE backed up

   ~ [OK] Hive C:\Users\other\NTUSER.dat backed up

 

     [OK] Registry Backup: C:\KPRM\backup\2021-04-07-00-41-46

 

- Delete Tools -

 

 

  ## AdwCleaner

     [OK] C:\Users\other\Desktop\AdwCleaner.exe deleted

     [OK] C:\AdwCleaner deleted

 

  ## Combofix

     [OK] C:\ComboFix.txt deleted

     [OK] C:\Qoobox deleted

     [OK] C:\WINDOWS\grep.exe deleted

     [OK] C:\WINDOWS\MBR.exe deleted

     [OK] C:\WINDOWS\NIRCMD.exe deleted

     [OK] C:\WINDOWS\PEV.exe deleted

     [OK] C:\WINDOWS\sed.exe deleted

     [OK] C:\WINDOWS\SWREG.exe deleted

     [OK] C:\WINDOWS\SWSC.exe deleted

     [OK] C:\WINDOWS\SWXCACLS.exe deleted

     [OK] C:\WINDOWS\zip.exe deleted

     [OK] HKLM\SOFTWARE\swearware deleted

 

  ## ESET Online Scanner

     [OK] C:\Users\other\Desktop\ESET Online Scanner.lnk deleted

     [OK] C:\Users\other\Desktop\esetonlinescanner.exe deleted

 

  ## FRST

     [OK] C:\Users\other\Desktop\Addition.txt deleted

     [OK] C:\Users\other\Desktop\Fixlog.txt deleted

     [OK] C:\Users\other\Desktop\FRST-OlderVersion deleted

     [OK] C:\Users\other\Desktop\FRST.txt deleted

     [OK] C:\Users\other\Desktop\FRST64.exe deleted

     [OK] C:\FRST deleted

 

  ## Rkill

     [OK] C:\Users\other\Desktop\Rkill.txt deleted

 

- Restore System Settings -

 

     [OK] Reset WinSock

     [OK] FLUSHDNS

     [OK] Hide Hidden file.

     [OK] Show Extensions for known file types

     [OK] Hide protected operating system files

 

- Restore UAC -

 

     [OK] Set EnableLUA with default (1) value

     [OK] Set ConsentPromptBehaviorAdmin with default (5) value

     [OK] Set ConsentPromptBehaviorUser with default (3) value

     [OK] Set EnableInstallerDetection with default (0) value

     [OK] Set EnableSecureUIAPaths with default (1) value

     [OK] Set EnableUIADesktopToggle with default (0) value

     [OK] Set EnableVirtualization with default (1) value

     [OK] Set FilterAdministratorToken with default (0) value

     [OK] Set PromptOnSecureDesktop with default (1) value

     [OK] Set ValidateAdminCodeSignatures with default (0) value

 

- Clear Restore Points -

 

     [I] No system recovery points were found

 

- Create Restore Point -

 

     [OK] System Restore Point created

 

- Display System Restore Point -

 

   ~ [I] RP named KpRm created at 04/07/2021 07:42:45

 

-- KPRM finished in 78.54s --

[DR M]

Wow! You had so many old tools in there! Now they are all removed. Good! 
 

Now your computer is clean, here are some final tips about your computer's security from now on:

Some of the following, are from Klein's (2005) article, So how did I get infected in the first place. Since then, the article has been reproduced or linked to in dozens of locations. As a result, many malware experts have continued updating it, to include current operating systems and software program information. My source is Security Garden, and I marked for you the following:

1. Keep your Windows updated!
It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect your computer.

2. Update 3rd Party Software Programs
Third Party software programs have long been targets for malware creators. It has been stated that "Adobe’s Reader and Flash and all versions of Java are together responsible for a total of 66 percent of the vulnerabilities in Windows systems exploited by malware.'' It's important to keep everything updated.

3. Update the browsers you use
Many malware infections install themselves by exploiting security holes in the Internet browser that you use. So... Keep them updated.

4. Be careful about what you download and what you open!

• Many "freeware" programs come with an enormous amount of bundled spyware that will slow down your system, spawn pop-up advertisements, or just plain crash your browser or even Windows itself. Watch for pre-checked options such as toolbars that are not essential to the operation of the installed software.
• Peer-to-peer (P2P) programs like Kazaa, BearShare, Imesh, Warez P2P, and others, allow the creation of a network enabling people to connect with other users and upload or download material in a fast efficient manner. BUT even if the P2P software you are using is "clean", a large percentage of the files served on the P2P network are likely to be infected.
• Cracked or pirated programs are not only illegal, but also can make your computer a malware target. Have this in mind.
• Do not open any files without being certain of what they are!

5. Avoid questionable web sites!
Visit web sites that are trustworthy and reputable. Many disreputable sites will attempt to install malware on your system through "drive-by" exploits just by visiting the site in your browser. Lyrics sites, free software sites (especially ones that target young children), cracked software sites, and pornography sites are some of the worst offenders. Also, never give out personal information of any sort online or click "OK" to a pop-up unless it is signed by a reputable company and you know what it is.

6. Registry cleaners/driver boosters/system optimizers
I do not recommend registry cleaners, system optimizers, driver boosters and the like. It is your computer and certainly your choice. However, please consider that modifying registry keys incorrectly can cause Windows instability, or make Windows unbootable. With registry cleaner and system optimization software programs, the potential is ever present to cause more problems than they claim to fix. Do note, however, that Microsoft does not support the use of registry cleaners. See Microsoft support policy for the use of registry cleaning utilities.

7. PC means personal computer!
Don't give access to your computer to friends or family who appear to be clueless about what they are doing.

8. Back-up your work!
Make back-ups of your personal files frequently. You never know when you'll have to reformat and start from scratch. You can always reformat and reinstall programs, but you cannot replace your data if you haven't made backups.

9. Must-Have Software
An anti-virus and an anti-spyware program is a necessity for the security of your computer. Be sure that you keep them updated, and that real time protection is enabled.


If you have any questions or concerns please don't hesitate to ask!

I'm glad I was able to help you.