Virus? Can't find files and can't uninstall or reinstall anything!

Viruses and worms
1

HP Desktop running on Windows Vista Home Premium using avast! Pro

Early June, my Avast located a virus on my computer and moved it to the Chest. I clicked to have the virus removed and walked away from my computer. When I came back, my Avast is no longer working but neither are most of my programs. Desktop and Start Menu Icons are generic and I keep getting an error message anytime I try to use anything which reads:

“The item ‘program.exe’ that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly. Do you want to delete this shortcut?”

I can’t even uninstall or reinstall any programs. If I try to find them through “Programs and Features” and click on the program with a blank icon, it reads:

“It appears this program has already been uninstalled. Would you like to remove it from the list?”

Trying to install or reinstall any programs triggers “SmartWebPrinting” with an error message that reads:

"The feature you are trying to use is on a network resource that is unavailable. Click OK to try again, or enter an alternate path to a folder containing the installation package ‘SmartWebPrinting.msi’ in the box below. Use source: C:\Users\KPDRAF~1\AppData\Local\Temp\7zS355A\setup\WebPrinting"

Followed by:

"An installation package for the product SmartWebPrinting cannot be found. Try the installation again using a valid copy of the installation package ‘SmartWebPrinting.msi’.

What is SmartWebPrinting? It’s not showing up in my “Programs and Features”.

I got an email stating that I haven’t used my avast! Pro in a while. That’s how I figured out even my avast! isn’t working. My current avast! message only says:

“Fatal error: current avast! installer is not trusted by avast! Self Defense module. Try to launch the installer again.”

A friend of my husband’s wanted me to install Microsoft Security Essentials. But I can’t install anything! I’m at a complete loss and I have school starting back up again next month so I really need my computer back up and working. I haven’t knowingly downloaded anything lately and my Task Manager isn’t showing anything running in the background. I’m nervous to even reboot my computer for fear this virus will become permanent and I will lose a lot of files and programs I really need.

I’m not very computer literate, but I really appreciate any advice! Thank you!

2

I saw most recommendations on other boards are to download Farbar Recovery Scan Tool. So I did.

Here are the logs:

3

also attach Malwarebytes and aswMBR logs https://forum.avast.com/index.php?topic=53253.0

the guys in removal team is in bed now, but will be back online tomorrow

4

Thank you!! I can wait until tomorrow morning. Much better than the guy I hired who never showed after a month of phone calls and texts. >:(

Malwarebytes isn’t showing up very well, but it found 26 threats. All quarantined.

Thank you again!! I look forward to hearing from you soon!

5
Thank you again!! I look forward to hearing from you soon!
Well it wont be me working your case, it will be one of the guys listed in the guide
Malwarebytes isn't showing up very well, but it found 26 threats. All quarantined.
Hmmm......nothing in the log you attached
6

I know it won’t be you. I’m thankful to anyone who answers at this point. Anything is better than nothing. :slight_smile:

I figured on the Malware. Will this help? Screenshot.

7

Looking at the log I can say you really managed to mess your system up big time.
I recommend to start from scratch, but if you don’t want to do so fix at least the following with frst:


HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [Messenger (Yahoo!)] => "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet 
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [WeatherBugAlert] => "C:\Program Files\AWS\WeatherBug Alert\WeatherBugAlert.exe" /st 
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [swg] => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [Facebook Update] => C:\Users\KP Drafting & Design\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-11-23] (Facebook Inc.)
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [GameXN GO] => C:\ProgramData\GameXN\GameXNGO.exe [347008 2012-04-07] (EasyBits Software AS)
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\Policies\Explorer: [NoLogOff] 0
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {0ab6bb02-119c-11e3-a16a-f226445b8c58} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {34d730cd-cb2a-11e1-89a9-001fc6dac826} - K:\MotoCastSetup.exe -a
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {36557ec5-f707-11e2-a897-001fc6dac826} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {36557ee3-f707-11e2-a897-001fc6dac826} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {45e70741-97ce-11e0-8cdd-0017ee6b79aa} - K:\setup.exe -a
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {55aa35c0-d9c9-11e2-9516-001fc6dac826} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {55aa35c6-d9c9-11e2-9516-001fc6dac826} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {56b0fe58-eeb2-11dd-bc2a-0017ee860285} - J:\Nextar.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {87ded327-0429-11e1-ad18-0017ee6b79aa} - K:\iStudio.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {8bd2f23a-3382-11de-a425-0017ee860285} - K:\LaunchU3.exe -a
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {cba80d56-b1c2-11e2-b161-001fc6dac826} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {cba80d97-b1c2-11e2-b161-001fc6dac826} - L:\TL-Bootstrap.exe
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {cd9afff1-600a-11e1-b25c-0017ee6b79aa} - L:\MotoCastSetup.exe -a
HKU\S-1-5-21-2262456525-793264486-11752347-1000\...\MountPoints2: {ebf942c7-b837-11e3-a308-0002721d7195} - K:\VZW_Software_upgrade_assistant.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (No File)
HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80012
HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_customize.aspx?tbid=80012
URLSearchHook: HKCU - (No Name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll No File
URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn14\yt.dll No File
URLSearchHook: HKCU - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn14\yt.dll No File
SearchScopes: HKLM - {8b0d31e7-0331-43cc-87cd-a472317f1305} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNzfb002YYUS_ZKxdm144YYUS&ptb=7A6D6D14-B00A-432E-8815-25410AEC09CE&psa=&ind=2010120621&ptnrS=ZNzfb002YYUS_ZKxdm144YYUS&si=&st=sb&n=77d001ad&searchfor={searchTerms}
SearchScopes: HKCU - {080FBDF6-B230-4e4d-A4E7-7C7A56D7BABC} URL = http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry={searchTerms}&type=Web&orig=IMC-IE
SearchScopes: HKCU - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} URL = http://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=60071
SearchScopes: HKCU - {8b0d31e7-0331-43cc-87cd-a472317f1305} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNzfb002YYUS_ZKxdm144YYUS&ptb=7A6D6D14-B00A-432E-8815-25410AEC09CE&psa=&ind=2010120621&ptnrS=ZNzfb002YYUS_ZKxdm144YYUS&si=&st=sb&n=77d001ad&searchfor={searchTerms}
SearchScopes: HKCU - {8b0d31e7-0331-43cc-87cd-a472317f1305} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNzfb002YYUS_ZKxdm144YYUS&ptb=7A6D6D14-B00A-432E-8815-25410AEC09CE&psa=&ind=2010120621&ptnrS=ZNzfb002YYUS_ZKxdm144YYUS&si=&st=sb&n=77d001ad&searchfor={searchTerms}
SearchScopes: HKCU - {9A06BCAF-76B6-4182-A2CD-9819C9D0BA24} URL = http://delicious.com/search?p={searchTerms}
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80012
BHO: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files\Yahoo!\Companion\Installs\cpn14\yt.dll No File
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll No File
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll No File
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL No File
BHO: No Name -> {D3D233D5-9F6D-436C-B6C7-E63F77503B30} -> C:\PROGRA~1\INBOXT~1\Inbox.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files\Yahoo!\Companion\Installs\cpn5\YTSingleInstance.dll No File
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll No File
Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn14\yt.dll No File
Toolbar: HKLM - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll No File
Toolbar: HKCU - No Name - {A057A204-BACC-4D26-9990-79A187E2698E} -  No File
Toolbar: HKCU - No Name - {2787EA8E-8D87-48AF-88AD-B30246C917AB} -  No File
Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} -  No File
Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll No File
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\PROGRA~1\INBOXT~1\Inbox.dll No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll No File
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\PROGRA~1\INBOXT~1\Inbox.dll No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll No File
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll No File
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll No File [ ]
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll File Not found ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files\Yahoo!\Shared\npYState.dll No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL No File
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL No File
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll No File
FF Plugin: @skyhookwireless.com/LokiPlugin,version=3.1.0.05 - C:\Program Files\Skyhook Wireless\Loki ActiveX Component\versions\3.1.0.05\loki.dll No File
FF Plugin: @viewpoint.com/VMP - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\KP Drafting & Design\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Updater) - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Facebook Desktop) - C:\Users\KP Drafting & Design\AppData\Local\Facebook\Messenger\2.1.4554.0\npFbDesktopPlugin.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
2014-07-25 15:59 - 2014-07-25 15:59 - 00000000 ____D () C:\24296bfb4b43641d2214d43fe8
8

Would agree with a bit of a mess

First we will use an automated tool to remove adware/orphans etc.

Then we will run a check for any hidden services drivers. After that we will see where we are

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

THEN

Please download Junkware Removal Tool to your desktop.

[]Right-mouse click JRT.exe and select “Run as Administrator” the tool will open and start scanning your system
[]please be patient as this can take a while to complete depending on your system’s specifications
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]post the contents of JRT.txt into your next message.

FINALLY

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

9

Thank you both! I can’t tell you how much your replies and help mean to me!

I was afraid it would be a mess. I’ve had this computer since 2007 so I knew there would be some issues. Especially with so many people using it over the years from family to friends and exes, it was bound to have some problems.

Can you tell if the programs that I’ve lost are repairable or will I have to redownload or reinstall them? I have CDs for programs like my AutoCAD and I’m sure I could reload them. But I do have a lot of school projects (architecture student) and a few thousand pictures of my 4 yr old only child on my hard drive that I don’t want to lose. I’m not totally against starting over as long as I can save the major important things. I’ve been thinking about upgrading to Windows 8 anyway and I’m not sure what that entails. Thoughts?

I’ll run those programs and post the results within the hour. Thanks again!

10

If we cannot fix it for some reason then you will need to back up any files/programmes that you need … However lets cross that bridge if we get to it :slight_smile:

If you upgrade to windows 8 then again you will need to back up any documents and pictures. Programmes will need to be reloaded

11
But I do have a lot of school projects (architecture student) and a few thousand pictures of my 4 yr old only child on my hard drive that I don't want to lose.
outlook (hotmail) and Gmail offer free online storage for pic/doc and then there is also droppbox ...... and many similar
12

No matter if it is about money or personal feelings, always have a backup of things that are important to you as user.
Never keep a backup in the same house as the system is.
It will be useless e.g. if there is a fire.
Nowadays there a free services where you can place a backup.
Pondus mentioned a couple of them.

There is also the option to create a backup on cd/dvd/external (usb)disk etc and keep it in a safe at a bank/post office.

13

Here are the logs:

Junkware Removal wouldn’t generate a log for some reason. I can try again.

I’m guessing I have a large combination of viruses, malware, and spyware? Any idea what the latest one was that really screwed my computer up?

My computer is running much more smoothly and faster. Programs are still missing and the icons are still generic. Shortcuts still aren’t working. But start up is much faster. I’ll take it at this point.

I know I need to back up my really important stuff. We’re a military family and moving every 2-4 years makes a bigger risk of my computer either being stolen or broken during a move. I know there are websites, I’m just not sure who I can trust. Then there’s always the possibility of their systems crashing and losing everything. But I can get a bunch of flash drives and keep them in a bank near our families so they’re not one more thing we have to remember to move. Thank you gentlemen very much.

14
I know there are websites, I'm just not sure who I can trust. Then there's always the possibility of their systems crashing and losing everything
They have several backup systems placed around the world
15

OK that removed a lot

Now we will reset Avast

Download Avast Uninstall Utility to your Desktop.
Download the correct version of Avast
Avast Free
Avast Pro
Avast Internet Security
Avast Premier
Disconnect from the net
Uninstall Avast via control panel

[]Run the uninstall tool and accept the reboot to safe mode
[]Once complete reboot your system
[*]Reinstall Avast

Once that has completed could you run a fresh FRST scan for me please and let me know how the computer is behaving

16

Still running smoothly!

Here are the logs:

17

Getting there, it looks like MBAM will have to be uninstalled and then re-installed

Download the attached fixlist.txt to the same location as FRST
Run FRST and press fix
On completion a log will be generated, please attach that

THEN

Uninstall MBAM via control panel
Then download and run this small programme http://www.malwarebytes.org/mbam-clean.exe
It will ask for a reboot
Now download and install a fresh copy of MBAM from here http://www.malwarebytes.org

How is the computer behaving now ?

18

Avast tells me the annoying SmartWebPrinting is a browser add on. I had it removed so now I’ll play around a bit to see if it’s fixed.

Here are logs for after removing that add on. Don’t know if it’ll be different or not but:

19

Oops could you see my previous post as there are some more tasks for you :slight_smile: )

20

I saw your reply and was working on it

After the first reboot, I got a few automatic messages about 2 programs not working. Then avast through up an error about walls not being turned on. I tried to turn them on, but nothing happened. So I tried the Internet. Not working either. I uninstalled MBAM through the control panel. Tried the Internet again, no luck. So I rebooted. Now I’m stuck after the main log in screen and the desktop starting up. Just a black screen with my mouse cursor. I pressed the power button and it says shutting down and powers off. But rebooting goes back to the black screen after logging on. I’m on my phone now. What did I do wrong?

*It sits on the ‘Welcome’ screen for a min and a half, then fades to black like the desktop is going to appear next. But it doesn’t. I can move the mouse cursor around. But it’s not budging. No lights flashing or sounds from the CPU. I’m completely lost now. Maybe the SmartWebPrinting was essential?