[Keyboardclick]

Wow, I am so sorry. I had no idea my post would be taken the way it was. I was in a hurry and had something else pressing to take care of. I should have taken the time to speak more clearly. I really do apologize.

 

I do not at all feel like I am blindly following instructions at the mercy of Dr. M. You have been very helpful, and I am very grateful.

I know a lot of people who's attitude seems to be "Oh my gosh! Something is wrong! Fix it for me!" and they hand their problem over, and that is that. I am not that way. If someone else can fix it, I'd like to know how, too. I know you all went through years of training, and I am so grateful because I don't have the time to do so. But, I want to learn where I can.

 

I know you are a volunteer, and I really, really appreciate you taking the time to help me.

 

Please accept my apology.

 

Here is the fixlog. After doing this, and restarting her laptop, the exclamation on her Windows Security Shield was back. I checked the Ransomware thing for the One Drive thing, but it was still dismissed. I finally found under App & Browser Control, and her Reputation Based Protection was off. It was on before the restart. Why would this randomly shut itself off? I took the screenshot after I turned it back on, but figured I would attach it anyway just to make sure you knew what I meant.

 

She wants me to see about updating Windows 10, so I will be working on that for the next few hours.

 

Thanks.

Attached Thumbnails

• 

Attached Files

•  Fixlog.txt   3.41KB   196 downloads

[Advertisements]

I do not at all feel like I am blindly following instructions at the mercy of Dr. M.

Please accept my apology.

 

Well, it seemed to me that you wasn't confident/sure with my instructions from the beginning and at the end you said that about the "blindly following instructions" etc. That's why I had to clarify what we are doing here.

 

Anyway, apologies accepted.

 

Since you decided to proceed with the system's upgrade, wait for it to finish.

 

After that, make the same checks regarding the Windows Security (see here: http://www.geekstogo...#entry2660646),in case something has changed. Also, check at the Security at a glance window if anything needs an action (including dismissing).

 

If the yellow exclamation returns, disable both, Avast and Spybot, and check at the Security at a glance window if anything needs an action (including dismissing). After that, enable Avast again.

 

Have in mind that you are trying to deal with 3 antivirus programs, so problems/conflicts/this kind of problems are expected. No matter you have the same programs in your computer and you don't get any errors (yet). That's why we recommend the usage of one antivirus and one antimalware. 

[DR M]

I do not at all feel like I am blindly following instructions at the mercy of Dr. M.

Please accept my apology.

 

Well, it seemed to me that you wasn't confident/sure with my instructions from the beginning and at the end you said that about the "blindly following instructions" etc. That's why I had to clarify what we are doing here.

 

Anyway, apologies accepted.

 

Since you decided to proceed with the system's upgrade, wait for it to finish.

 

After that, make the same checks regarding the Windows Security (see here: http://www.geekstogo...#entry2660646),in case something has changed. Also, check at the Security at a glance window if anything needs an action (including dismissing).

 

If the yellow exclamation returns, disable both, Avast and Spybot, and check at the Security at a glance window if anything needs an action (including dismissing). After that, enable Avast again.

 

Have in mind that you are trying to deal with 3 antivirus programs, so problems/conflicts/this kind of problems are expected. No matter you have the same programs in your computer and you don't get any errors (yet). That's why we recommend the usage of one antivirus and one antimalware. 

[Keyboardclick]

When it comes to computers, I am not confident about anything. I just wanted to make sure I understood your instructions in hopes that I would be less likely to mess something up.

 

After the Windows Update, all of her security options are on and fine, with no exclamation or recommended actions. Do you think there is something messing with her settings, or is it normal for security settings to go on and off like they have been?

 

Since she is using Avast instead of Windows Defender, and since it doesn't seem like the free version of Spybot has live protection (plus, I disabled it at start up), and she has Malwarebytes, does all of that equal one antivirus and one antimalware? Or will the three still interfere with the settings as they are?

 

Again, thanks for your help.

[Keyboardclick]

Another question,

 

I am unable to find any of the programs (FRST etc) in the Apps and Features section where I usually uninstall things. I thought if I just deleted something from the desktop, this did not necessarily uninstall the program. Where do I go to remove these now that they are not needed?

 

Is it okay to remove the Media Creation Tool? If so, how do I do this too?

 

Thanks.

[DR M]

When it comes to computers, I am not confident about anything. I just wanted to make sure I understood your instructions in hopes that I would be less likely to mess something up.

 
  All is good.
 

After the Windows Update, all of her security options are on and fine, with no exclamation or recommended actions. Do you think there is something messing with her settings, or is it normal for security settings to go on and off like they have been?

 
Third-party security programs many times interferes with Windows Security settings. Perhaps that is the case. 
 

Since she is using Avast instead of Windows Defender, and since it doesn't seem like the free version of Spybot has live protection (plus, I disabled it at start up), and she has Malwarebytes, does all of that equal one antivirus and one antimalware? Or will the three still interfere with the settings as they are?

 
So she has Avast and Malwarebytes, Windows Defender disabled and Spybot as an on-demand scanner. It's fine, although too much for me. Personally, I use only Windows Defender and Malwarebytes Premium (it offers real time protection) and I'm happy with them.
 

I am unable to find any of the programs (FRST etc) in the Apps and Features section where I usually uninstall things. I thought if I just deleted something from the desktop, this did not necessarily uninstall the program. Where do I go to remove these now that they are not needed?
 
Is it okay to remove the Media Creation Tool? If so, how do I do this too?

 
Yes, you can delete the media tool.
 
As for the tools we used, and the created logs, let's remove them now.

The following tool will remove the tools we used as well as reset system restore points:

Download KpRm by kernel-panik and save it to your desktop.

• Right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• Please copy and paste its contents in your next reply.

[Keyboardclick]

Just to make sure I am understanding correctly, do you want me to right click the media creation tool and select "delete" before downloading KpRm?

 

I deleted logs from the desk top already, figuring I couldn't delete a text file wrong. I hope this is okay.

[DR M]

Yes, delete the media tool like any file.

 

Then, run KpRm. 

[Keyboardclick]

Plus, then wouldn't we have to delete KpRm? I sense a infinite cycle coming on...

Downloading now...

[Keyboardclick]

Hum, now my computer is freaking out... I posted the same post twice. User error I think

Edited by Keyboardclick, 21 August 2021 - 12:47 PM.

[DR M]

Download it, run it and ... you will see! 

[Keyboardclick]

# Run at 8/21/2021 1:50:05 PM
# KpRm (Kernel-panik) version 2.9.2
# Website https://kernel-panik.me/tool/kprm/
# Run by User from C:\Users\User\Desktop
# Computer Name: LAPTOP-DDK31LC2
# OS: Windows 10 X64 (19043)
# Number of passes: 1

- Checked options -

    ~ Registry Backup
    ~ Delete Tools
    ~ Restore System Settings
    ~ UAC Restore
    ~ Delete Restore Points
    ~ Create Restore Point
    ~ Delete Quarantines

- Create Registry Backup -

   ~ [OK] Hive C:\WINDOWS\System32\config\SOFTWARE backed up
   ~ [OK] Hive C:\Users\User\NTUSER.dat backed up

     [OK] Registry Backup: C:\KPRM\backup\2021-08-21-13-50-05

- Delete Tools -

  ## AdwCleaner
     [OK] C:\Users\User\Desktop\AdwCleaner.exe deleted
     [OK] C:\AdwCleaner deleted

  ## ESET Online Scanner
     [OK] C:\Users\User\Desktop\ESET Online Scanner.lnk deleted
     [OK] C:\Users\User\Desktop\esetonlinescanner.exe deleted
     [OK] C:\Users\User\AppData\Local\ESET\ESETOnlineScanner deleted

  ## FRST
     [OK] C:\Users\User\Desktop\FRST-OlderVersion deleted
     [OK] C:\Users\User\Desktop\FRST64.exe deleted
     [OK] C:\FRST deleted

- Restore System Settings -

     [OK] Reset WinSock
     [OK] FLUSHDNS
     [OK] Hide Hidden file.
     [OK] Show Extensions for known file types
     [OK] Hide protected operating system files

- Restore UAC -

     [OK] Set EnableLUA with default (1) value
     [OK] Set ConsentPromptBehaviorAdmin with default (5) value
     [OK] Set ConsentPromptBehaviorUser with default (3) value
     [OK] Set EnableInstallerDetection with default (0) value
     [OK] Set EnableSecureUIAPaths with default (1) value
     [OK] Set EnableUIADesktopToggle with default (0) value
     [OK] Set EnableVirtualization with default (1) value
     [OK] Set FilterAdministratorToken with default (0) value
     [OK] Set PromptOnSecureDesktop with default (1) value
     [OK] Set ValidateAdminCodeSignatures with default (0) value

- Clear Restore Points -

     [I] No system recovery points were found

- Create Restore Point -

     [OK] System Restore Point created

- Display System Restore Point -

   ~ [I] RP named KpRm created at 08/21/2021 18:50:54

-- KPRM finished in 98.03s --

[Keyboardclick]

Whoo! Everything is gone! Should I delete the KpRm log?

[DR M]

Good. 

 

Yes, you can delete that too.


Since the computer is clean and since there are no other questions, here are some final tips about your (and your mother's) computer's security from now on:

Some of the following, are from Klein's (2005) article, So how did I get infected in the first place. Since then, the article has been reproduced or linked to in dozens of locations. As a result, many malware experts have continued updating it, to include current operating systems and software program information. My source is Security Garden, and I marked for you the following:

1. Keep your Windows updated!
It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect your computer.

2. Update 3rd Party Software Programs
Third Party software programs have long been targets for malware creators. It has been stated that "Adobe’s Reader and Flash and all versions of Java are together responsible for a total of 66 percent of the vulnerabilities in Windows systems exploited by malware.'' It's important to keep everything updated.

3. Update the browsers you use
Many malware infections install themselves by exploiting security holes in the Internet browser that you use. So... Keep them updated.

4. Be careful about what you download and what you open!

• Many "freeware" programs come with an enormous amount of bundled spyware that will slow down your system, spawn pop-up advertisements, or just plain crash your browser or even Windows itself. Watch for pre-checked options such as toolbars that are not essential to the operation of the installed software.
• Peer-to-peer (P2P) programs like Kazaa, BearShare, Imesh, Warez P2P, and others, allow the creation of a network enabling people to connect with other users and upload or download material in a fast efficient manner. BUT even if the P2P software you are using is "clean", a large percentage of the files served on the P2P network are likely to be infected.
• Cracked or pirated programs are not only illegal, but also can make your computer a malware target. Have this in mind.
• Do not open any files without being certain of what they are!

5. Avoid questionable web sites!
Visit web sites that are trustworthy and reputable. Many disreputable sites will attempt to install malware on your system through "drive-by" exploits just by visiting the site in your browser. Lyrics sites, free software sites (especially ones that target young children), cracked software sites, and pornography sites are some of the worst offenders. Also, never give out personal information of any sort online or click "OK" to a pop-up unless it is signed by a reputable company and you know what it is.

6. Registry cleaners/driver boosters/system optimizers
I do not recommend registry cleaners, system optimizers, driver boosters and the like. It is your computer and certainly your choice. However, please consider that modifying registry keys incorrectly can cause Windows instability, or make Windows unbootable. With registry cleaner and system optimization software programs, the potential is ever present to cause more problems than they claim to fix. Do note, however, that Microsoft does not support the use of registry cleaners. See Microsoft support policy for the use of registry cleaning utilities.

7. PC means personal computer!
Don't give access to your computer to friends or family who appear to be clueless about what they are doing.

8. Back-up your work!
Make back-ups of your personal files frequently. You never know when you'll have to reformat and start from scratch. You can always reformat and reinstall programs, but you cannot replace your data if you haven't made backups.

9. Must-Have Software
An anti-virus and an anti-spyware program is a necessity for the security of your computer. Be sure that you keep them updated. You have now Avast and that, together with Malwarebytes if you run it occasionally, depending on how often you use your computer, can keep you safe.

Happy safe computing.



I'm glad I was able to help you.
 

[Keyboardclick]

Thank you!

[DR M]

Thank you!

 

You are most welcome.