Solved Error when right clicking: C:\users\owner\appdata\local\tmp\stpraxi...

[mcnamakj]

I recently installed 7-zip, and downloaded a few other things, and now when I right click on files, the error message

There was a problem starting
C:\users\owner\appdata\local\tmp\stpraxi\serohnp\wow.dll
The specified module could not be found.

appears. It also crashes windows explorer in occasion. I see many others have had this problem, and everyone seems to have a slightly different fix. I should also note I do not have any virus protection or anything of the sort right now.

Thanks for reading.

 

[VistaKing]

Run Farbar Recovery Scan Tool

64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[mcnamakj]

I also forgot to mention that i did a system restore to three days ago, and that did not fix the problem. I ran the program as you said, and the files are attached.

 

[VistaKing]

Open Notepad . Inside Notepad paste the highlighted text below


start
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Users\Owner\AppData\Local\Temp\stpraxi\serohnp\wow64.dll ATTENTION! ====> ZeroAccess?
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1561768 2012-05-04] (Ask)
2013-08-12 20:29 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
C:\Users\Owner\jagex_cl_runescape_LIVE.dat
C:\Users\Owner\random.dat
end


Click on File select Save As

Save To : Desktop

File Name : Fixlist.txt

Save as type : All Files

Click on Save button . Close Notepad

Open FRST64.exe and click on [Fix] button . Once done it will create a new log called Fixlog.txt . Upload the log

Then run

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Delete and confirm the prompt.

:ar: Your computer will be rebooted automatically. A text file will open after the restart.

Upload the log : The log file is at C:\AdwCleaner[Sn].txt


Download Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

 

[mcnamakj]

Here is the fixlog

 

[mcnamakj]

I should also note that the right click problem has been fixed. seemingly at least. should i still run the adware cleaner?

 

[VistaKing]

Yes run both of those AdwCleaner and Junkware

 

[mcnamakj]

Here is the adware log

 

[VistaKing]

Run Junkware Removal Tool then run Malwarebytes

Run

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

Log looks like this : mbam-log-yyyy-mm-dd

Log located : C:\Users\{Your UserName}\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs or C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs

 

[mcnamakj]

And here is the JRT log. Thank you so much for the help. This is a life saver.

 

[VistaKing]

Looking good . Lets see what Malwarebytes locates .

 

[mcnamakj]

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.08.12.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Owner :: OWNER-HP [administrator]

8/12/2013 11:19:03 PM
MBAM-log-2013-08-13 (06-08-26).txt

Scan type: Full scan (C:\|D:\|E:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 437216
Time elapsed: 1 hour(s), 21 minute(s), 36 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Owner\AppData\Local\Temp\.exe (Trojan.Agent) -> No action taken.

(end)

 

[VistaKing]

Rerun malwarebytes and select the items it locates and click remove selected .