Windows 10 Trojan message

Thank you.

Click Start, type cmd, then select Run as administrator
type sfc /scannow and hit Enter
When completed, let me know what the results say, i.e no integrity violations, could not repair files, etc.

Hi Gary.    So sorry I did not see your reply until now.   It was put on a 3rd page by it self.

 

Hi Gary.  I am having cataract surgery on my left eye tomorrow.  I will have my tablet with me.  However, I will have a hard time reading. I will do the best I can.

Will be staying with my brother, so I won't have access to my computer until Thursday.  If you need something done on my computer let me know.  I may be able 

to get a ride back.

Take care of yourself first and we can wait on all of this until you are up to it.

TY

Gary,

The surgery went well yesterday.  I am seeing well enough to read with reading glasses.

I am ready to start again when you are.

 

Mike

Glad to hear that Mike.

Are you able to run a FRST scan in normal boot?

Yes ran FRST from desktop.

Great, can you copy and paste both reports in your reply?

Please do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
CreateRestorePoint:
CloseProcesses:
S3 WinRing0_1_2_0; \??\C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClient.sys [X] 
Task: {EDDB656E-CDE0-4982-8992-D90A71B5CD64} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION 
Task: {941D26F4-957D-47CA-950D-E1979845F466} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe /DeviceScanR6 (No File) 
Task: {0E0EC0F5-D9AA-4804-842F-DF6A371F7B4D} - System32\Tasks\Microsoft\Windows\rempl\shell => %ProgramFiles%\rempl\sedlauncher.exe (No File) 
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File 
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) 
2024-06-27 12:03 - 2020-11-06 08:09 - 000008192 ___SH C:\DumpStack.log.tmp 
2024-06-21 09:23 - 2024-06-21 09:23 - 002395648 _____ (Farbar) C:\Users\Main\Downloads\Unconfirmed 172091.crdownload 
ShortcutTarget: HP Audio Switch.lnk -> C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitchLC.vbs () [File not signed] 
2024-06-21 09:23 - 2024-06-21 09:23 - 002395648 _____ (Farbar) C:\Users\Main\Downloads\Unconfirmed 172091.crdownload
Zip: C:\WINDOWS\Minidump
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• The tool will create a zipped folder on the Desktop with today's date, example: 07.30.2023_13.24.50.zip. Please upload the file here.

===================================================

Please run Windows Update until there are no more updates available or you receive an error message. If your receive an error, provide the error information in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Uploaded zip file
• Windows Update results

Ok Gary. I copied the code you posted.

And ran FRST64.

You are a great and mighty cyber warrior.

it did not give me the option to click fix.

Edited by husky1954, Yesterday, 01:22 AM.

Thank you for your kindness.

You need to right click on FRST64.exe, select Run as administrator, copy the text from Start:: to End:: then click Fix on the FRST window. Are you saying you did that, in that order, but you didn't see a Fix button on the FRST window?

yes

 

I will try to run it again if you want.  I think i clicked scan.

Edited by husky1954, Yesterday, 08:38 AM.