Computer Hope

# -------------------------------
# Malwarebytes AdwCleaner 7.2.2.0
# -------------------------------
# Build:    07-17-2018
# Database: 2018-07-25.1
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    07-26-2018
# Duration: 00:00:29
# OS:       Windows 10 Home Single Language
# Scanned:  41737
# Detected: 2


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

PUP.Optional.SpyHunter          C:\Users\Jowong\Downloads\SpyHunter-Installer.exe

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

PUP.Optional.BrowseToSave       SaveFrom.net helper

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

________________________________________________________________________________________________
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/26/18
Scan Time: 5:20 PM
Log File: 2101acd8-90b5-11e8-abe1-704d7bc363ce.json
Administrator: Yes

-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.391
Update Package Version: 1.0.6075
License: Trial

-System Information-
OS: Windows 10 (Build 17134.165)
CPU: x64
File System: NTFS
User: DESKTOP-TCIEPC9\Jowong

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 291524
Threats Detected: 1
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 6 min, 31 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
PUP.Optional.ParetoLogic, C:\USERS\JOWONG\DOWNLOADS\UNCONFIRMED 292642.CRDOWNLOAD, No Action By User, [1257], [457647],1.0.6075

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

____________________________________________________________
Results of screen317's Security Check version 1.014 --- 12/23/15 
   x64 (UAC is enabled) 
Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Enabled! 
Windows Defender   
McAfee VirusScan   
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````[/u]
SpyHunter 5   
Google Chrome (67.0.3396.99)
Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````[/u] 
Windows Defender MSMpEng.exe
Malwarebytes Anti-Malware mbamservice.exe 
Malwarebytes Anti-Malware mbamtray.exe 
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````[/u]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please run MBAM again and, this time, clean the infection.
The Security log shows you have two AV's active on your computer: Windows Defender and McAfee. WD is the resident AV that comes with Windows 10. You should de-activate one of these AV's as they can cause conflicts. You should also uninstall Spyhunter 5.
What program is warning you about Win32Azden?

Hi Dave, thank you for your response. I have scanned the computer again and removed conflicting AVs. It was Windows Defender that detected the Win32Azden.

Here is the log from MBAM.

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/30/18
Scan Time: 7:11 AM
Log File: b73bdb02-9384-11e8-870d-704d7bc363ce.json
Administrator: Yes

-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.391
Update Package Version: 1.0.6119
License: Trial

-System Information-
OS: Windows 10 (Build 17134.165)
CPU: x64
File System: NTFS
User: DESKTOP-TCIEPC9\Jowong

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 289327
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 2 min, 17 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

ESET Online Scanner
Note : If you use Internet Explorer to get the ESET Online Scanner, you won't have to download, nor install the tool, as everything will be ran in a contextual (pop-up) window of Internet Explorer. However, for every other browsers, you will have to download and install ESET Online Scanner. In this set of instruction, I'll use Google Chrome to download it and run it (since a lot of people will do it), however, except for the download and installation procedure, the same instructions applies if you use Internet Explorer. Please note that two or three prompts will appear if you use Internet Explorer asking you to reload the page, authorize the application, execute it, etc. Accept all of them in order to run ESET Online Scanner.

    Download and execute ESET OnlineScan (on this window, click on ESET Smart Installer to trigger the download). People accessing this URL via Internet Explorer will start the integration process of ESET Online Scanner in their browser;
    Once the installation is done (it requires Admin Rights), check the following settings (two of them are under Advanced Settings, click on it to display them) :

        Enable detection of potentially unwanted applications;
        Scan archives;
        Scan for potentially unsafe applications;
        Optional : If you want to scan more drives, click on Change... and select the drives you want to include in the scan;

   

    After you're done checking these options, click on Start and ESET Online Scanner will download it's virus signature database before starting the scan;
   

    Once done, the scan will start automatically. Detections will appear at the bottom of the window. ESET Online Scanner can have an extremely long scan time that can last between 2 or 3 hours. So if you start the scan, do not interrupt it, let it complete until the end;
   

    After the scan is finished, a summary window will appear to give you the information about the scan. Then you'll have to the option to see what threads were found and to manage the threats that were quarantined;
   


    Click on List of found threats, it'll display every threat identified during that scan, their type and what action was taken against them. Click on Copy to clipboard to copy these results on our clipboard and post them in your next reply;
   


    Once you're done, click on the Back button;
    Check both checkboxes at the bottom: Uninstall application on close and Delete quarantined files before clicking on the Finish button;

Eset Onlin Scanner Results.

C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5247\wtoolex\wpsnotify.exe   a variant of Win32/KingSoft.D potentially unwanted application   cleaned by deleting
C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5247\wtoolex\wpsupdate.exe   a variant of Win32/KingSoft.D potentially unwanted application   cleaned by deleting
C:\Users\Jowong\AppData\Roaming\Mozilla\Firefox\Profiles\n0tk48fw.default\sessionstore.js   JS/Adware.Agent.AA application   cleaned by deleting
C:\Users\Jowong\Downloads\ccsetup545pro.exe   Win32/Bundled.Toolbar.Google.D potentially unsafe application   cleaned by deleting
C:\Users\Jowong\Downloads\Installer\FreemakeVideoDownloaderSetup.exe   a variant of Win32/Freemake.A potentially unwanted application   cleaned by deleting

Please give me an update on how your computer is working now.

Hi Dave, I am no longer receiving a warning message from Windows Defender. Things seem fine with my computer as of now and hopefully going forward. Thank you so much for your help.

You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.