Youtube popup havoc

[SuzyQ]

Here is the information requested. I'm getting much faster at this. Suzy

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-09-2014 01
Ran by Computer at 2014-09-26 22:59:06 Run:3
Running from C:\Users\Computer\Desktop
Loaded Profiles: Computer & UpdatusUser (Available profiles: Computer & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKU\S-1-5-21-3631100180-372296517-2715455636-1000\...\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272840 2014-03-31] (Microsoft Corporation)
C:\Program Files (x86)\Windows Live\Messenger
2014-09-19 22:46 - 2014-09-19 22:46 - 00001305 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-09-19 22:45 - 2014-09-19 22:45 - 00002486 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-09-19 22:45 - 2014-09-19 22:45 - 00001458 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-09-19 22:45 - 2014-09-19 22:45 - 00001374 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-09-19 22:44 - 2014-09-19 22:46 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-09-19 22:44 - 2014-09-19 22:45 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-09-19 22:44 - 2014-09-19 22:44 - 00000000 ____D () C:\Program Files\Windows Live
2014-09-19 22:32 - 2014-09-22 21:26 - 00000000 ____D () C:\Users\Computer\AppData\Local\Windows Live
2014-09-19 22:29 - 2014-09-19 22:29 - 00634992 _____ (© 2014 ClientConnect Ltd.) C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX.exe
2014-09-19 22:29 - 2014-09-19 22:29 - 00000000 ____D () C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX
2014-09-19 22:46 - 2014-09-19 22:44 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-09-19 22:45 - 2014-09-19 22:45 - 00002486 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-09-19 22:45 - 2014-09-19 22:45 - 00001458 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-09-19 22:45 - 2014-09-19 22:45 - 00001374 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-09-19 22:45 - 2014-09-19 22:44 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-09-19 22:44 - 2014-09-19 22:44 - 00000000 ____D () C:\Program Files\Windows Live
2014-09-19 22:29 - 2014-09-19 22:29 - 00634992 _____ (© 2014 ClientConnect Ltd.) C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX.exe
2014-09-19 22:29 - 2014-09-19 22:29 - 00000000 ____D () C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX
HKU\S-1-5-21-3631100180-372296517-2715455636-1000\...\MountPoints2: {262e6610-a165-11e2-a6b9-806e6f6e6963} - D:\ASRSetup.exe
HKU\S-1-5-21-3631100180-372296517-2715455636-1000\...\MountPoints2: {3386465a-a169-11e2-bdde-806e6f6e6963} - D:\Autorun.exe
HKU\S-1-5-21-3631100180-372296517-2715455636-1000\...\MountPoints2: {62200ff3-090b-11e4-bab4-f84e697c68e4} - E:\MI.exe
HKU\S-1-5-21-3631100180-372296517-2715455636-1001\...\MountPoints2: {262e6610-a165-11e2-a6b9-806e6f6e6963} - D:\ASRSetup.exe
HKU\S-1-5-21-3631100180-372296517-2715455636-1001\...\MountPoints2: {3386465a-a169-11e2-bdde-806e6f6e6963} - D:\shellexe.exe Start.htm
HKU\S-1-5-21-3631100180-372296517-2715455636-1001\...\MountPoints2: {62200ff3-090b-11e4-bab4-f84e697c68e4} - E:\MI.exe
End
*****************

HKU\S-1-5-21-3631100180-372296517-2715455636-1000\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr => Value not found.
C:\Program Files (x86)\Windows Live\Messenger => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live => Moved successfully.
C:\Program Files (x86)\Windows Live => Moved successfully.
C:\Program Files\Windows Live => Moved successfully.
C:\Users\Computer\AppData\Local\Windows Live => Moved successfully.
"C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX.exe" => File/Directory not found.
C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX => Moved successfully.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live" => File/Directory not found.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk" => File/Directory not found.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk" => File/Directory not found.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk" => File/Directory not found.
"C:\Program Files (x86)\Windows Live" => File/Directory not found.
"C:\Program Files\Windows Live" => File/Directory not found.
"C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX.exe" => File/Directory not found.
"C:\Users\Computer\Downloads\Windows_Movie_Maker_TSV3CYINX" => File/Directory not found.
"HKU\S-1-5-21-3631100180-372296517-2715455636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{262e6610-a165-11e2-a6b9-806e6f6e6963}" => Key not found.
"HKCR\CLSID\{262e6610-a165-11e2-a6b9-806e6f6e6963}" => Key not found.
"HKU\S-1-5-21-3631100180-372296517-2715455636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3386465a-a169-11e2-bdde-806e6f6e6963}" => Key deleted successfully.
"HKCR\CLSID\{3386465a-a169-11e2-bdde-806e6f6e6963}" => Key not found.
"HKU\S-1-5-21-3631100180-372296517-2715455636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62200ff3-090b-11e4-bab4-f84e697c68e4}" => Key not found.
"HKCR\CLSID\{62200ff3-090b-11e4-bab4-f84e697c68e4}" => Key not found.
"HKU\S-1-5-21-3631100180-372296517-2715455636-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{262e6610-a165-11e2-a6b9-806e6f6e6963}" => Key deleted successfully.
"HKCR\CLSID\{262e6610-a165-11e2-a6b9-806e6f6e6963}" => Key not found.
"HKU\S-1-5-21-3631100180-372296517-2715455636-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3386465a-a169-11e2-bdde-806e6f6e6963}" => Key deleted successfully.
"HKCR\CLSID\{3386465a-a169-11e2-bdde-806e6f6e6963}" => Key not found.
"HKU\S-1-5-21-3631100180-372296517-2715455636-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62200ff3-090b-11e4-bab4-f84e697c68e4}" => Key deleted successfully.
"HKCR\CLSID\{62200ff3-090b-11e4-bab4-f84e697c68e4}" => Key not found.

==== End of Fixlog ====

[ken545]

Are those programs in Russian still there ?

[SuzyQ]

Are those programs in Russian still there ?

The one that said Windows Essentials 2012 appears to be gone. But the other three that are written in Russian are still at the bottom of the uninstall list. I was able to click on the first one. I was asked, "Do you wish to uninstall?" I said yes. "Please wait". Then I got a message, "Do you wish Windows Essential to make changes to your hard drive?" I stopped at that point and said cancel. Suzy

[ken545]

Go ahead and let Windows Essential make the change, just uninstall anything you can

[SuzyQ]

Go ahead and let Windows Essential make the change, just uninstall anything you can

They appear to be gone. Wonderful! You have been so long-suffering with this! There is one small remnant. On my task bar there is a Messenger Window icon that loads with my computer.

Is it safe again to log into sites without being tracked?

Suzy

[SuzyQ]

There is one small remnant. On my task bar there is a Messenger Window icon that loads with my computer.

The icon when clicked say that it can't start because the UXcore.dll is missing from your computer. Also, I won't be back until late tonight. Have to go to work so I can make a donation to this wonderful site.

Suzy

[ken545]

Suzy, UXcore is part of of the programs we just removed, lets do this

Click the Start button .
In the Search box, type command prompt.
In the list of results, right-click Command Prompt, and then click Run as administrator

Then copy and paste this in

SFC /scannow

Window may find and fix that file

[SuzyQ]

Click the Start button .
In the Search box, type command prompt.
In the list of results, right-click Command Prompt, and then click Run as administrator

Ken, There are no results - nothing listed when I search for command prompt in the box. Although when I select 'see more results', I get a list that says, 'Libraries', 'Homegroup', 'computer', 'custom', 'internet'. Selecting 'computer', there are only two choices:

C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
and
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

Selecting 'libraries', I get one of my docx files.

Nothing for the other two.

Thank you again,

Suzy

[ken545]

When you click on the Start Button you should see the Command Prompt, if not then go to the Accessories Folder and the Command Prompt will be in there, be sure to right click on it and select RUN AS ADMINISTRATOR or the tool wont work, type in or copy and paste SFC /SCANNOW The space between the C and / is needed. This will start System File Checker and it may fix or replace that missing file

[SuzyQ]

right click on it and select RUN AS ADMINISTRATOR or the tool wont work

I found it, but anywhere that I right click on it, it never says to run as admin in the options given. Also when downloading something, when I right clicked I was never given the option to run as admin. There is just 'mark', 'paste', 'select all', 'scroll', 'find.' when right clicked.

Suzy