Your running FRST64 from your Downloads folder, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to your Downloads folder and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.
Open notepad , Go to Start --> All Programs --> Accessories --> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist.txt , Save it to your desktop where you have FRST/FRST64 or the fix wont work. Right Click on FRST/FRST64 and select RUN AS ADMINISTRATOR Then click on >FIX< (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please
Code:
Start
CloseProcesses:
CreateRestorePoint:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-2633259000-3325982389-204066327-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-2633259000-3325982389-204066327-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
HKU\S-1-5-21-2633259000-3325982389-204066327-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-2633259000-3325982389-204066327-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
SearchScopes: HKLM -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM -> {E5E0719E-BCE2-47E4-B3D5-510FE1E26BC8} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001 -> DefaultScope {E5E0719E-BCE2-47E4-B3D5-510FE1E26BC8} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D122415-A21066F3E7D&form=CONBDF&conlogo=CT3334510&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://search.yahoo.com/search?fr=mcafee&type=B011US105D20141104&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001 -> {E5E0719E-BCE2-47E4-B3D5-510FE1E26BC8} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {E5E0719E-BCE2-47E4-B3D5-510FE1E26BC8} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D122415-A21066F3E7D&form=CONBDF&conlogo=CT3334510&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://search.yahoo.com/search?fr=mcafee&type=B011US105D20141104&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2633259000-3325982389-204066327-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {E5E0719E-BCE2-47E4-B3D5-510FE1E26BC8} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_dwndlm_16_07¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDyDyC0CtAyE0EyEyC0AtN0D0Tzu0StCyDtDyBtN1L2XzutAtFtCzztFtCtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0EyBtCyC0A0B0FtGtD0DtA0CtG0B0F0EyDtGtA0A0A0BtGtA0B0D0EyEtAtB0A0EyDyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DyBzz0C0DyCyEtG0AzzyCyCtGyE0A0DyEtGzz0A0B0FtG0D0AyBtDtC0CtDyDyEyC0B0B2QtN0A0LzuyE%26cr%3D1557552372%26a%3Dwncy_dwndlm_16_07%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
StartMenuInternet: FIREFOX.EXE - firefox.exe
Task: {945078EB-2B7D-4EEE-82C9-743D7100C65A} - System32\Tasks\Sixth => C:\Users\Steve\AppData\Roaming\Sixth\Sixth.exe [2015-12-05] () <==== ATTENTION
C:\Users\Steve\AppData\Roaming\Sixth\Sixth.exe
C:\Users\Steve\Downloads\Setup.exe
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
-AdwCleaner-by Xplode
Click on this link to download : ADWCleaner TO YOUR DESKTOP
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next reply.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
===============================================================================
Please download Junkware Removal Tool TO YOUR DESKTOP
- Download the one from Bleeping Computer
- Shut down your protection software now to avoid potential conflicts.
- Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete depending on your system's specifications.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
===============================================================================
Download Malwarebytes' Anti-Malware TO YOUR DESKTOP
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
- On the Dashboard click on Update Now
- Go to the Setting Tab
- Under Setting go to Detection and Protection
- Under PUP and PUM make sure both are set to show Treat Detections as Malware
- Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
- Then on the Dashboard click on Scan
- Make sure to select THREAT SCAN
- Then click on Scan
- When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard
- Please paste the log back into this thread for review
- Exit Malwarebytes
