Malware suspected

Computer running slow on quite a few sites and start up page where I put in password appears to jump to another page right after page loads up.  Would suspect google redirect virus.

Hello.

Download Farbar Recovery Scan Tool and save it to your desktop. --> IMPORTANT

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.

If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

(To attach the files, click on the More Reply Options at the bottom right of the reply area, and then choose Attach File)
 

Hello.

I'll need the FRST.txt too. It is in the same location the Addition.txt is located:

Running from C:\Users\johnj\AppData\Local\Temp\MicrosoftEdgeDownloads\12122976-3912-44b8-9855-06d8ecb04e3f

After that, please move the FRST tool directly on to your Desktop. 

Thanks for the logs. 
 
I'll ask you again these 2 things:
 
1. Move the FRST tool directly on to your Desktop.
 
2. It is easier for me to review the logs if you attach them instead of copy/paste them. As I explained to you in my first post above:
 
(To attach the files, click on the More Reply Options at the bottom right of the reply area, and then choose Attach File)
 
Please have the above in mind for your next reply.
 
=======================
 
Since we are ready to begin the process...

Please, adhere to the guidelines below, and then carefully follow, with the same order, all the instructions after:

1. Always ask before acting. Do not continue if you are not sure, or if something unexpected happens!

2. Do not run any tools unless instructed to do so. Also, do not uninstall or install any software during the procedure, unless I ask you to do so.

3. Cracked or pirated programs are not only illegal, but also can make your computer a malware target. Having such programs installed, is the easiest way to get infected. Thus, no need to clean the computer, since, soon or later, it will get infected again. If you have such programs, please uninstall them now, before we start the cleaning procedure.

4. If your computer seems to start working normally, don't abandon the topic. Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.

5. You have to reply to my posts within 3 days. If you need some additional time, just let me know. Otherwise, I will leave the topic due to lack of feedback. If you are able, I would request you to check this thread at least once per day so that we can resolve your issues effectively and efficiently.

6. Logs from malware diagnostic or removal programs can take some time to get analyzed. Also, have in mind that all the experts here are volunteers and may not be available to assist when you post. Please, be patient, while I analyze your logs.

========================

I'm currently reviewing your logs and be back to you as soon as I am ready. 

Hello, again.

1. Brave extensions

Do you need these Brave extensions?

 
2. FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
CustomCLSID: HKU\S-1-5-21-1124472054-2262804997-3086618912-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File
ContextMenuHandlers1: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers2: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers4: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContexHKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
tMenuHandlers6: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
FirewallRules: [{469CE811-5CE2-4CE5-A338-A13D69CD6001}] => (Allow) C:\Users\johnj\AppData\Local\Temp\7zS06C7\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{D5E4BBFD-1BF0-4543-BED1-8C5764B644BC}] => (Allow) C:\Users\johnj\AppData\Local\Temp\7zS06C7\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{6C0E26FA-27D9-4D5D-8486-FDC7360616B6}] => (Allow) C:\Users\johnj\AppData\Local\Temp\7zS59DA\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{9D0B987E-6668-45EF-BE04-D819FD3A70BC}] => (Allow) C:\Users\johnj\AppData\Local\Temp\7zS59DA\HPDiagnosticCoreUI.exe => No File
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1124472054-2262804997-3086618912-1001\...\MountPoints2: {b9599b80-3c17-11ee-966b-806e6f6e6963} - "D:\AUTORUN.EXE" 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2
EmptyTemp:
End::

• Right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Post the log in your next reply.

3. Explain your issue

I'll need more details about the issue you are dealing with. In your initial post, you said only a few things and I need more, so I can assist you more effectively.

In your next reply please post:

1. A reply about the Brave extensions
2. The fixlog.txt
3. Explain your issues in more detail

Hi,

Have no brace extensions that I can see.

I got sent some things from a person helping me and when it was finished I tried to remove all of them but one could not be deleted.  I removed it anyway and about the same time was getting pop ups.  I was phoning up Scammers to waste their time as part of a group ( since left) and a few weeks back one website was running slow and then more.  The scammer idea was to take them to a point of putting on a software which would give them control of my computer, but since I have no IT skills, I would give them false information.

Please, let me see the popups you are getting. Take screenshots when you see them and attach the screenshots in your next reply. 
 
Also...

1. Run Malwarebytes (scan only)

• Download Malwarebytes and save it to your Desktop.
• Once downloaded, close all programs and Windows on your computer.
• Double-click on the icon on your desktop named MBSetup.exe. This will start the installation of MBAM onto your computer.
• Follow the instructions to install the program.
• When finished, double click the program's icon created on your Desktop.
• Click the little gear on the top right (Settings) and when it opens, click the General tab. Under the title Windows Security Center, make sure the option is disabled.
• Click the Scan and Detections tab and under the Scan options title, enable Scan for rootkits option. Do not change any other option.
• Return to the Dashboard and choose Scan.
• When finished, you will see the Threat Scan Summary window open.
• If threats are not found, click View Report and proceed to the two last steps below.
  
  If threats are found, make sure that all threats are not selected,close the program and proceed to the next steps below.
  • Open Malwarebytes again, click on the Scanner, and then on the Reports tab.
  • Find the report with the most recent date and double click on it.
  • Click on Export and then Copy to Clipboard.
  • Paste its content here, in your next reply.

2. Run AdwCleaner (scan only)

Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.
• Click the Scan Now button.
• Once the scan completes, AdwCleaner shows you all detected PUPs and adware. DO NOT check anything found, and click Next.
• If any preinstalled software was detected on your device, a message notifies you that your action is requested. DO NOT check anything, and click Cancel to continue.
• Click the Log Files tab.
• Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
• A Notepad file will open containing the results of the removal.
• Please post the contents of the file in your next reply.

Note: Click Skip Basic Repair if you are asked to.


In your next reply, please post:

• The popup screenshots
• The Malwarebytes report
• The AdwCleaner[S0*].txt

Edited by DR_M, 15 April 2024 - 08:33 AM.

No pop up as they came earlier when persons e-mail could not be removed by simply pressing delete but had to be done manually.  Then one site started running slow and then a few more.  Also had start up page appear to change to a second one which looked the same.

file:///C:/Users/johnj/Documents/amazon.uk.html

file:///C:/Users/johnj/Documents/We're%20sorry.html