Laptop slowing and can't uninstall NowUSeeIt Player

[gin_jammer]

I am noticing a laptop performance slowdown, plus IE use is almost always interrupted by Popup ads played with full audio volume. At times, I hear audio and can't tell what's running to produce it. Task Manager will open but tabs are missing.

I just ran Registry Backup and Spybot S&D (ver 2.4.40.130).

Attached are FRST.txt, Addition.txt and aswMBR.txt.

Request help with cleanup.

[Juliet]

UpdateAdmin (HKLM\...\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}) (Version: 2.0.2011 - DownloadAdmin) <==== ATTENTION
Please go to add/remove programs list and look for and uninstall if found the above.


Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
C:\Users\Ed\AppData\Local\NowUSeeItPlayer\NowUSeeItPlayerBrowser.exe
HKU\S-1-5-21-3659970256-991337627-2867597209-1001\...\Run: [NowUSeeIt Player] => "C:\Program Files\NowUSeeItPlayer\NowUSeeItPlayer.exe" /autostart=1
S3 eapihdrv; \??\C:\Users\Ed\AppData\Local\Temp\ehdrv.sys [X]
2016-03-10 06:51 - 2016-03-10 06:52 - 00000000 ____D C:\Users\Ed\AppData\Local\NowUSeeItPlayer
C:\Users\Ed\AppData\Local\Temp\avguirn_082078590991.exe
C:\Users\Ed\AppData\Local\Temp\avguirn_08802052559.exe
C:\Users\Ed\AppData\Local\Temp\avguirn_0883239166.exe
C:\Users\Ed\AppData\Local\NowUSeeItPlayer\NowUSeeItPlayerBrowser.exe
C:\Users\Ed\AppData\Local\NowUSeeItPlayer\libcef.dll
EmptyTemp:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~

AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner[SX].txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner[SX].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~~~~~~~~~~
please post
Fixlog.txt
AdwCleaner[CX].txt
JRT.txt

[gin_jammer]

Hi, Juliet...sorry I must meet you here again.

I found Update/Admin, but am unable to uninstall it.

I downloaded and ran the three tools. When AdwCleaner ran, it DID NOT generate ANY report for review (tried it twice), so I went ahead with Clean. Three Logs are attached, but note the log that AdwCleaner generated has a slightly different filename than expected.

[Juliet]

Hi, Juliet...sorry I must meet you here again.

I found Update/Admin, but am unable to uninstall it.

AdwCleaner went after part of it we'll search for more of it in a bit.

AdwCleaner generated has a slightly different filename than expected.

Thats my fault and have corrected it in my notes.

How's your computer?

What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
Most reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.



Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme.
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
  
  
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click . If no threats were found, skip the next two bullet points.
• Click and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to and click .
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.

~~~~~~~~~~~~~~~~~~~~~~

Please run a new FRST log.

• Right-Click FRST.exe / FRST64.exe and select Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  

[gin_jammer]

Re: How's your computer? I'm no longer hearing unidentified audio or seeing popup ads with audio.

Attached are logs from Eset and FRST rerun.

[Juliet]

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
C:\Program Files\PCAPDownloader
C:\Windows\security\database\tmp.edb
EmptyTemp:
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~``

Download Malwarebytes' Anti-Malware TO YOUR DESKTOP

• Windows XP : Double click on the icon to run it.
• Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
  
  
  
  
  
  
  
  
• On the Dashboard click on Update Now
  
• Go to the Setting Tab
  
• Under Setting go to Detection and Protection
  
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
  
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  
• Then on the Dashboard click on Scan
  
• Make sure to select THREAT SCAN
  
• Then click on Scan
  
  
  After the restart once you are back at your desktop, open MBAM once more.
  Click on the History tab > Application Logs.
  Double click on the scan log which shows the Date and time of the scan just performed.
  Click 'Copy to Clipboard'
  Paste the contents of the clipboard into your reply
  
  
• Exit Malwarebytes

~~~~~~~~~~~~~

Please post these 2 logs when finished.

[gin_jammer]

Following is the Malwarebytes Log:

Malwarebytes Anti-Malware
www.malwarebytes.org


Error, 3/14/2016 7:07 AM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 7:07 AM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 7:07 AM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:24 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:24 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:24 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:36 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:36 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:36 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Starting,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Started,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Starting,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Started,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Remediation Database, 2015.9.16.1, 2016.3.10.1,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Rootkit Database, 2015.9.18.1, 2016.3.12.1,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Domain Database, 2015.9.22.3, 2016.3.14.7,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, IP Database, 2015.9.21.2, 2016.3.14.1,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Malware Database, 2015.9.22.5, 2016.3.14.6,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Refresh, Starting,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Stopping,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Stopped,
Protection, 3/14/2016 3:59 PM, SYSTEM, ED-PC, Protection, Refresh, Success,
Protection, 3/14/2016 3:59 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Starting,
Protection, 3/14/2016 3:59 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Started,

(end)

Attached is the FRST fixlog

NOTE: Executing the last few instructions is difficult because the Malwarebytes Dashboard nomenclature doesn't match the instructions. However, I think I got and pasted what you're looking for. If not, let me know, and I'll try again.

[Juliet]

That was the protection log.

When you ran the scan did it find anything?, and if it did, did you allow it to quarantine it?

[gin_jammer]

I'm not sure I saw an option to Quarantine. I probably missed it, or misunderstood it. Should I run it again?

[Juliet]

Since it's a quick scan yes.