• Please do not follow any other instructions other than mine, as they can cause conflict between my fixes.
  


• Please be patient, as you can see I have other people to assist.
  


• Please consider backing up any important files incase, (usually I will create System Restore Points if needed)
  


• Please read the instructions carefully, as it can help a lot.
  


• Do not login to valuable sites such as banking etc.
  


• It is important that you do the instructions in order. (Up to Down)
  

• Please download Junkware Removal Tool to your desktop.
  


• Shut down your protection software now to avoid potential conflicts.
  


• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  


• The tool will open and start scanning your system.
  


• Please be patient as this can take a while to complete depending on your system's specifications.
  


• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  


• Post the contents of JRT.txt into your next message.

• Double click on AdwCleaner.exe to run the tool.
  


• Click on the Scan button.
  


• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  


• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  


• Look over the log especially under Files/Folders for any program you want to save.
  


• If there's a program you may want to save, just uncheck it from AdwCleaner.
  


• If you're not sure, post the log for review in pastebin.com and paste link in next reply.
  


• If you're ready to clean it all up, click the Clean button.
  


• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  


• Copy and paste the contents of that logfile in your next reply.
  


• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  

(May 15, 2016 12:40 AM)I ST0LE YOUR GF Wrote:  ~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 10 Home x64
Ran by Matt (Administrator) on Sun 05/15/2016 at 3:24:44.10
~




File System: 8

Successfully deleted: C:\ProgramData\10866386157295603659 (Folder)
Successfully deleted: C:\ProgramData\summersoft (Folder)
Successfully deleted: C:\Users\Matt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ogminpmldncgcmokldnmmapddoccmhfl_0.localstorage (File)
Successfully deleted: C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\ojcl5u12.default\extensions\[email protected]\search.xml (File)
Successfully deleted: C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\ojcl5u12.default\Invalidprefs.js (File)
Successfully deleted: C:\WINDOWS\system32\Tasks\PCDEventLauncherTask (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\PCDoctorBackgroundMonitorTask (Task)
Successfully deleted: C:\Users\Matt\AppData\Roaming\appdataFr3.bin (File)



Registry: 2

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B301492C-4245-4078-9FC7-9F189D670FF1} (Registry Key)




~
Scan was completed on Sun 05/15/2016 at 3:26:39.76
End of JRT log
~



*** [ Files ] ***

*** [ DLLs ] ***

*** [ WMI ] ***

*** [ Shortcuts ] ***

*** [ Scheduled tasks ] ***

*** [ Registry ] ***

[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh
[x] Key Not Deleted : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
[-] Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[-] Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi
[-] Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi.1
[-] Key Deleted : HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}
[-] Key Deleted : HKCU\Software\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}
[x] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[x] Value Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Key Deleted : HKCU\Software\WEBAPP
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Key Deleted : HKU\S-1-5-21-2977089736-950357887-4028935304-1002\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Crossrider
[-] Key Deleted : HKU\S-1-5-21-2977089736-950357887-4028935304-1002\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\The weDownload Manager
*** [ Web browsers ] ***

[x] [C:\Users\Matt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Not Deleted : fcfenmboojpjinhpgggodefccipikbpd
***********************

:: "Tracing" keys deleted
:: Winsock settings cleared
***********************

C:\AdwCleaner\AdwCleaner[C1].txt - [2431 bytes] - [15/05/2016 03:33:45]
C:\AdwCleaner\AdwCleaner[S1].txt - [2540 bytes] - [15/05/2016 03:29:17]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2577 bytes] ##########

• Please download RougeKiller and save the file to your Desktop.
  


• Right-Click RougeKiller.exe and select Run as Administrator
  


• Click Scan. Do not use the computer during the scan.
  


• A log will be created and saved to the root directory. Paste the file contents to pastebin.com and post the link in your next reply.
  

(May 15, 2016 06:08 PM)I ST0LE YOUR GF Wrote:  RogueKiller V12.2.0.0 [May 10 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.10586) 64 bits version
Started in : Normal mode
User : Matt [Administrator]
Started from : C:\Users\Matt\Downloads\RogueKiller.exe
Mode : Scan -- Date : 05/15/2016 21:07:31

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2977089736-950357887-4028935304-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2977089736-950357887-4028935304-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 1 ¤¤¤
[File.Forged|VT.Unknown][File] C:\Windows\System32\drivers\hxxMVmor.sys -> Found

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS727575A9E364 +++++
--- User ---
[MBR] 2ce049b17bb975a7964002ffd869d691
[BSP] 55f171ca5eefd1b4137c12723b6e6095 : Empty|VT.Unknown MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 500 MB
1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1026048 | Size: 40 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 1107968 | Size: 128 MB
3 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1370112 | Size: 490 MB
4 - Basic data partition | Offset (sectors): 2373632 | Size: 703269 MB
5 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 1442670592 | Size: 820 MB
6 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 1444349952 | Size: 350 MB
7 - [SYSTEM][MAN-MOUNT] Microsoft recovery partition | Offset (sectors): 1445066752 | Size: 9804 MB
User = LL1 ... OK
User = LL2 ... OK

=================================================

Thank you so much for helping me by the way

• Turn off the real time scanner of any existing antivirus program while performing the online scan.
  


• Tick the box next to YES, I accept the Terms of Use.
  


• Click Start
  


• Make sure that the option Remove found threats is unticked
  


• Click on Advanced Settings and ensure these options are ticked
  


• 1) Scan for potentially unwanted applications
  


• 2) Scan for potentially unsafe applications
  


• 3) Enable Anti-Stealth Technology
  


• Click Scan
  


• Wait for the scan to finish
  


• If any threats were found, click the 'List of found threats' , then click Export to text file....
  


• Save it to your desktop, then please copy and paste that log to pastebin and paste the pastebin link to your next reply.
  

(May 16, 2016 10:54 AM)I ST0LE YOUR GF Wrote:  http://pastebin.com/nnL7mj2i

• Double-click on the Rkill icon to run the tool.
  


• If using Vista or Windows 7/8/10, right-click on it and Run As Administrator.
  


• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  


• A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply (pastebin link)
  


• If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs.
  

(May 17, 2016 10:59 PM)I ST0LE YOUR GF Wrote:  Only occasionally, for example if I shut it down to take it to a friend's house it will freeze on first boot, then after I force reset it a few times it will start up. Could it be a hardware malfunction?