Spyhunter4

Its been awhile since I asked for help so, I'll ask again.
My computer is infected by a malware (?), Spyhunter4 and resists all of my attempts to get rid of it. I have already tried all of the anti-malware programs which have previously been suggested. I have no clue where to look next. I am operating Firefox in Safe Mode which makes no difference what so ever. Spyhunter comes up as soon as my system boots yet, it does not appear in the Start-up menu.
Help. please.
Jim

 

Hello Jim,

Run the following and post the two produced logs:

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Thanks,

Kevin....

 

Kevin,
I guess I'm one of the biggest doofuses in the system. I have no clue how to attach either FRST.txt or Addition.txt. Right clicking should do it but Copy is grayed out. How should I attach the file? I have both of them ready to go. Suggestions, please.
Jim

 

Open a reply, scroll below the opened reply box, select "Manage Attachments" In the new window select "Browse" to navigate to the file in question, double click on the file to load, then select "Upload" to upload the file as an attachment,

Repeat for any subsequent files, when finished select "Close this window" to close the upload tool.

post your reply....

 

OK, Kevin,
It took a bit of looking but I found them. Hopefully when you get them they contain what you want.
Addition.txt FRST.txt
Jim

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link
When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.


Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.


In most cases, a restart will be required.


Wait for the prompt to restart the computer to appear, then click on Yes.


When the scan is completed from the main GUI click on History > Application Logs. Find your Scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"
Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.

• Double click on Adwcleaner.exe to run the tool.
• Click on Scan
• Once the scan is done, click on the Clean button. <<<--- Ensure this option is completed
• You will get a prompt asking to close all programs. Click OK.
• Click OK again to reboot your computer.
• A text file will open after the restart. Please post the content of that logfile in your reply.
• You can also find the logfile at C:\AdwCleaner[Sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts. (re-enable when done)
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop
Ensure to get the correct version for your system....
32 Bit version:
https://www.microsoft.com/downloads...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
64 Bit version:
https://www.microsoft.com/downloads...DE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.
Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Let me see those logs, also give an update on any remaining issues or concerns...

Thank you,

Kevin...

 

Hey, Kevin,
Little help, please.
FRST64.exe, Fixlist.txt and FRST.txt are all on Desktop yet, when I hit Fix on FRST64.exe it tells me that it can't find Fixlist.txt. What am I doing wrong?
Jim

 

According to the log from the first run of FRST it was in the downloads folder, not the desktop?

 

Kevin,
All three are in C:\users\jim\desktop.Does it matter that they are different types of files? FRST64 is app.exe, Fixlist is Internet shortcut.url and FRST.txt is shortcut.lnk. Sometning odd is going on. When I right click any of the three I get an error message telling me that it can't find the WD file I have selected. When I close that message it takes me to the file I selected which is no way related to WD, my back up drive manufacturer. More help, please.
Jim

 

The default folder for anything you download is C:\Users\gpoetsma\Downloads That folder is where the tool FRST64.exe was saved to and ran from at the start.

So I do not understand why you now tell me it is on the Desktop.... Go back to reply #6 download and save Fixlist.txt to the same folder as the tool FRST64.exe do not open the file, just make sure they are together, not shortcuts or links......

Double click on FRST.exe to open the tool then select the "Fix" tab.

 

Kevin,
It seems as though we are in two different computer "worlds". I can find no record of c:\users\gpoetsma\downloads. In fact when I Google that file, or gpoetsma for that matter, it shows not found. When I check Properties of FRST64 it shows the location as C:\users\Jim\downloads. Apparently "We have a failure to communicate" to quote the movie Cool Hand Luke, just before Cool Hand Luke/Paul Newman gets the crap beat out of him.
Where should I look in my system to find gpoetsma?
Jim

 

Hiya Jim,

Not sure where I got that navigational address from, just looked back over the first log from FRST and sure enough the folder it was run from is C:\Users\Jim\Downloads

So in order to get the fix to work we must have FRST64.exe and Fixlist.txt in the same folder. It is no good having shortcuts or url`s

Open FRST64.exe then select the fix tab once, FRST64.exe will run to the script in the closed file Fixlist.txt.

 

Kevin,
Whew, I was worried that I had done something seriously wrong.
I forgot how to attach files to this reply. I thought that I would be able to manage add-ons when I began typing in the reply window.
Help please, I've got both files ready in the downloads folder.
Jim

 

Open reply, in the new window make your response, to attach a file scroll down to the "Additional Options" section. In that section you will see "Manage Attachments" select that, In the new window select "Browse" do that to locate the file, select the file and then select the "Upload" option. When the file is uploaded select "Close this Window" top right corner of the Manage Attachements....

 

Kevin,
Here I go again. Let's see what happens this time.
Jim
I dragged both of them to this message. Wish me luck.
Additional options never opened. Give me a clue what I should do.
Jim