Laptop slowing and can't uninstall NowUSeeIt Player

Status
Not open for further replies.
G

gin_jammer

New member
I am noticing a laptop performance slowdown, plus IE use is almost always interrupted by Popup ads played with full audio volume. At times, I hear audio and can't tell what's running to produce it. Task Manager will open but tabs are missing.

I just ran Registry Backup and Spybot S&D (ver 2.4.40.130).

Attached are FRST.txt, Addition.txt and aswMBR.txt.

Request help with cleanup.
 

Attachments

UpdateAdmin (HKLM\...\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}) (Version: 2.0.2011 - DownloadAdmin) <==== ATTENTION
Please go to add/remove programs list and look for and uninstall if found the above.


Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


FRSTfix.JPG



start
CreateRestorePoint:
CloseProcesses:
C:\Users\Ed\AppData\Local\NowUSeeItPlayer\NowUSeeItPlayerBrowser.exe
HKU\S-1-5-21-3659970256-991337627-2867597209-1001\...\Run: [NowUSeeIt Player] => "C:\Program Files\NowUSeeItPlayer\NowUSeeItPlayer.exe" /autostart=1
S3 eapihdrv; \??\C:\Users\Ed\AppData\Local\Temp\ehdrv.sys [X]
2016-03-10 06:51 - 2016-03-10 06:52 - 00000000 ____D C:\Users\Ed\AppData\Local\NowUSeeItPlayer
C:\Users\Ed\AppData\Local\Temp\avguirn_082078590991.exe
C:\Users\Ed\AppData\Local\Temp\avguirn_08802052559.exe
C:\Users\Ed\AppData\Local\Temp\avguirn_0883239166.exe
C:\Users\Ed\AppData\Local\NowUSeeItPlayer\NowUSeeItPlayerBrowser.exe
C:\Users\Ed\AppData\Local\NowUSeeItPlayer\libcef.dll
EmptyTemp:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
End
Click to expand...

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~

BY4dvz9.png
AdwCleaner
  • Please download AdwCleaner and save the file to your Desktop.
  • Right-Click AdwCleaner.exe and select
    AVOiBNU.jpg
    Run as administrator     to run the programme.
  • Follow the prompts.
  • Click Scan.
  • Upon completion, click Report. A log (AdwCleaner[SX].txt) will open. Briefly check the log for anything you know to be legitimate.
  • Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
  • Follow the prompts and allow your computer to reboot.
  • After rebooting, a log (AdwCleaner[SX].txt) will open. Copy the contents of the log and paste in your next reply.
-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


thisisujrt.gif

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

~~~~~~~~~~~~
please post
Fixlog.txt
AdwCleaner[CX].txt
JRT.txt
 
Hi, Juliet...sorry I must meet you here again.

I found Update/Admin, but am unable to uninstall it.

I downloaded and ran the three tools. When AdwCleaner ran, it DID NOT generate ANY report for review (tried it twice), so I went ahead with Clean. Three Logs are attached, but note the log that AdwCleaner generated has a slightly different filename than expected.
 

Attachments

gin_jammer said:
Hi, Juliet...sorry I must meet you here again.

I found Update/Admin, but am unable to uninstall it.
Click to expand...
AdwCleaner went after part of it we'll search for more of it in a bit.

gin_jammer said:
AdwCleaner generated has a slightly different filename than expected.
Click to expand...
Thats my fault and have corrected it in my notes.

How's your computer?

What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
Most reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.



Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

GzlsbnV.png
ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.
  • Please download ESET Online Scan and save the file to your Desktop.
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Double-click esetsmartinstaller_enu.exe to run the programme.
  • Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
  • Agree to the Terms of Use once more and click Start. Allow components to download.
  • Place a checkmark next to Enable detection of potentially unwanted applications.
  • Click Advanced settings. Place a checkmark next to:
    • Scan archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Ensure Remove found threats is unchecked.
  • Click Start.
  • Wait for the scan to finish. Please be patient as this can take some time.
  • Upon completion, click
    esetListThreats.png
    . If no threats were found, skip the next two bullet points.
  • Click
    esetExport.png
    and save the file to your Desktop, naming it something such as "MyEsetScan".
  • Push the Back button.
  • Place a checkmark next to
    xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png
    and click
    SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png
    .
  • Re-enable your anti-virus software.
  • Copy the contents of the log and paste in your next reply.

~~~~~~~~~~~~~~~~~~~~~~

Please run a new FRST log.
  • Right-Click FRST.exe / FRST64.exe and select
    AVOiBNU.jpg
    Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
 
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
C:\Program Files\PCAPDownloader
C:\Windows\security\database\tmp.edb
EmptyTemp:
End
Click to expand...

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~``

Download Malwarebytes' Anti-Malware TO YOUR DESKTOP


  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"




    0841859c-1a35-4dbd-b41a-e720629e3e22_zpst0yckuua.png



  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan


    After the restart once you are back at your desktop, open MBAM once more.
    Click on the History tab > Application Logs.
    Double click on the scan log which shows the Date and time of the scan just performed.
    Click 'Copy to Clipboard'
    Paste the contents of the clipboard into your reply

  • Exit Malwarebytes

~~~~~~~~~~~~~

Please post these 2 logs when finished.
 
Following is the Malwarebytes Log:

Malwarebytes Anti-Malware
www.malwarebytes.org


Error, 3/14/2016 7:07 AM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 7:07 AM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 7:07 AM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:24 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:24 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:24 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:36 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:36 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:36 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Error, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, IsLicensed, 13,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopping,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Stopped,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Starting,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malware Protection, Started,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Starting,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Started,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Remediation Database, 2015.9.16.1, 2016.3.10.1,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Rootkit Database, 2015.9.18.1, 2016.3.12.1,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Domain Database, 2015.9.22.3, 2016.3.14.7,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, IP Database, 2015.9.21.2, 2016.3.14.1,
Update, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Manual, Malware Database, 2015.9.22.5, 2016.3.14.6,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Refresh, Starting,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Stopping,
Protection, 3/14/2016 3:58 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Stopped,
Protection, 3/14/2016 3:59 PM, SYSTEM, ED-PC, Protection, Refresh, Success,
Protection, 3/14/2016 3:59 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Starting,
Protection, 3/14/2016 3:59 PM, SYSTEM, ED-PC, Protection, Malicious Website Protection, Started,

(end)

Attached is the FRST fixlog

NOTE: Executing the last few instructions is difficult because the Malwarebytes Dashboard nomenclature doesn't match the instructions. However, I think I got and pasted what you're looking for. If not, let me know, and I'll try again.
 

Attachments

That was the protection log.

When you ran the scan did it find anything?, and if it did, did you allow it to quarantine it?
 
When I re-ran Malwarebytes, I got a screen that showed 7 items, all of which were already selected for quarantine. I quarantined them. The Update/Admin "Program" that once appeared in my list of installed programs no longer appears.

Following is the Malwarebytes log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/15/2016
Scan Time: 7:25 AM
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.03.15.04
Rootkit Database: v2016.03.12.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Ed

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 298244
Time Elapsed: 7 min, 8 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}, Quarantined, [13fd91f7e3b60e289a39f33d4bb99b65],
Adware.NowUSeeIt, HKU\S-1-5-21-3659970256-991337627-2867597209-1001\SOFTWARE\NowUSeeItPlayer, Quarantined, [9b75f494c1d8e84e109a9dc591738e72],
Adware.NowUSeeIt, HKU\S-1-5-21-3659970256-991337627-2867597209-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\nowuseeitplayer.com, Quarantined, [10000d7bc1d86ec8cf3e0a5f2bd9649c],
Adware.NowUSeeIt, HKU\S-1-5-21-3659970256-991337627-2867597209-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\ui.nowuseeitplayer.com, Quarantined, [69a78404178216207e8f571245bfe917],

Registry Values: 1
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}|Publisher, DownloadAdmin, Quarantined, [13fd91f7e3b60e289a39f33d4bb99b65]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.UpdateAdmin, C:\Windows\Installer\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}, Quarantined, [8d83bdcb7128ab8bc8659ed70202f30d],

Files: 1
PUP.Optional.UpdateAdmin, C:\Windows\Installer\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}\icon.ico, Quarantined, [8d83bdcb7128ab8bc8659ed70202f30d],

Physical Sectors: 0
(No malicious items detected)


(end)
 
When I re-ran Malwarebytes, I got a screen that showed 7 items, all of which were already selected for quarantine. I quarantined them. The Update/Admin "Program" that once appeared in my list of installed programs no longer appears.
Click to expand...
That one entry was finally taken out by MBAM.

I think your good to go.

AFZxnZc.jpg
DelFix
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools

  • Click the Run button.
  • -- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).


~~~~~~~~~~~~~~~~~``

The following programmes come highly recommended in the security community.
  • xKsUqI5A.png.pagespeed.ic.vn1Hlvqi8h.jpg
    AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
  • E8I37RF.png
    CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
  • EG85Vjt.png
    Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
  • x6YRrgUC.png.pagespeed.ic.HjgFxjvw2Z.jpg
    Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
  • xjv4nhMJ.png.pagespeed.ic.A5YbWn1eDO.png
    NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
  • Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
  • DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png
    Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
  • xj1OLIec.png.pagespeed.ic.k6hhwopU0q.jpg
    SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
  • xJEP5iWI.png.pagespeed.ic.4tmM1lM7DQ.png
    Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

Want to help others? Join the ClassRoom and learn how.
 
Done. I haven't heard any strange audio, or seen any popup ads, for a couple of days now.

Do you need to see the DelFix log, and should the Malwarebytes executable file be uninstalled?
 
gin_jammer said:
Done. I haven't heard any strange audio, or seen any popup ads, for a couple of days now.

Do you need to see the DelFix log, and should the Malwarebytes executable file be uninstalled?
Click to expand...

Music to my ears.

I don't need to see the Delfix log and you should keep and use Malwarebytes. Update definitions before using at least once a week.
 
Before this item is closed out, a couple of things:

In cleaning up my Desktop, I found two Malwarebytes icons, one that I just put there and another evidently left over from a previous Spybot Forum session. Programs and Features on my Control Panel shows only the most recent instance of Malwarebytes. Should I merely delete the old icon from my Desktop?

Ctrl-Alt-Del lets me Start the Task Manager, but when it opens, it's just a frame with no Tabs. I can no longer maximize/minimize it, or get to the screens it usually displayed. Any suggestion?
 
Status
Not open for further replies.
Back
Top