[*]Double-click SystemLook.exe to run it.
[*]Copy the content of the following codebox into the main textfield:
:regfind
aartemis.com
aartemis
[*]Click the Look button to start the scan.
[*]When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Just an FYI also, I have a program called “PDF Reader Packages” with no publisher that won’t uninstall showing up in my “Programs and Features” window. It was part of the Hippo files. When I try and uninstall it, the message says “it has already been deleted”.
Malwarebytes’ Anti-Malware
Please download Malwarebytes’ Anti-Malware from here
Double Click mbam-setup.exe to install the application.
[*]Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish,so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[*]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[*]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Attach the entire report in your next reply. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Aartemis is opening in all browsers. On MBAM scan it came up with no malicious files and no restart was necessary. I have the current update with MBAM as well as per the instructions. I still have the PDF Reader Packages showing in my Program features window for uninstall/change programs that showed up with the Hippo updates. I attached the requested document from the scan that I just ran.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please copy and paste log back here.
[*]The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
I think I got the majority of it off. I was extremely tired yesterday and hope I followed all of your instructions correctly. Thank you again for helping me get Whilokii and Aartemis off of my computer. I have attached several logs and a screen shot for you if you would take a look at them. I have some files from Adw cleaner quarantine that I don’t know what to do with. And I’ve attached the reports generated from the cleanup scans. I am no longer getting Aartemis in any browser when it loads.
