Issues logging into Windows.

[Jacee]

RSIT by random/random.
Please download from HERE and save to the desktop.

• Right click on RSIT.exe > Run as Administrator to run the tool.
• Click Continue at the disclaimer screen.
• Once it finishes, two logs will open.
  • log.txt will be opened maximized
  • info.txt will be opened minimized
• Please post the contents of both logs in your next post.

***You can find manually the log at C:\rsit

 

[GilV37]

no not connected to a domain.

 

[GilV37]

here you go

 

[VistaKing]

Uninstall these programs

:ar: PC Utility Kit

:ar: PCHealthBoost

Look inside this folder location . You have some random name files

C:\Users\{User Account Name}\AppData\Roaming

   Note

AppData is a hidden folder

Enable Hidden Files and Folders

:ar: Click on the Organize button ( on any open windows explorer window )

:ar: Select Folder and Search Options

:ar: Click the View tab, and then you should select Show hidden files and folders inside Advanced settings:

:ar: Click OK

 

[GilV37]

i dont see the PC utility anywhere. and when i try to uninstall the PC HealthBoost, i get a message Cannont find PCHealthBoost kmaintennace files. Please download the setup agian.
When I showed all hidden files and folders, I went into the default\appdata\roaming and saw three folders. Macromedia, media center program and microsoft.

 

[VistaKing]

I'm referring to this folder location

:ar: C:\Users\Ferreira Family\AppData\Roaming

:ar: Files in Question

• Itdyo
• Duhae
• Yrvihu
• Rybu
• Ebril
• Qize
• Qeluo
• Kore
• Reqim
• Raegi
• Mufin
• Fiutw

 

[GilV37]

i'm looking in those folders, and they are all empty.

 

[VistaKing]

If these folders are empty you may delete them

• 
  Itdyo
  Duhae
  Yrvihu
  Rybu
  Ebril
  Qize
  Qeluo
  Kore
  Reqim
  Raegi
  Mufin
  Fiutw

 

[GilV37]

ok done

 

[VistaKing]

Those folders were left behind from the fixlist you ran with FRST . It removed the .exe file but didnt delete the folders .

 

[GilV37]

ok.

 

[Jacee]

Is this the name of your computer? Computer Name: WIN-8T841C26R3V

Computer Name: WIN-8T841C26R3V
Event Code: 4624
Message: An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: WIN-8T841C26R3V$
Account Domain: WORKGROUP
Logon ID: 0x3e7

 

[VistaKing]

GilV37

Can you locate these items in the registry ?

:ar: PC Utility Kit

:ar: PCHealthBoost

Click on the rb: button type REGEDIT inside Search programs and files box . When REGEDIT comes up under Programs (1) right-click on REGEDIT and choose Run as administrator . Click on the Yes button on the User Access Control window . Inside the registry click on COMPUTER click on Edit choose Find and type in either PC Utility Kit or PCHealthBoost and click on Find Now button if anything is located can you take a screen prnt and upload the image ?

 

[GilV37]

The computer name is supposed to be: Ferreira Family.
Attached are the two .jpeg files.

 

[cottonball]

While y'all play, I want to play also.

GilV37,

Let's take a look at a couple of Registry entries...

Please download SystemLook from one of the links below:
64-bit system:
http://jpshortstuff.247fixes.com/SystemLook_x64.exe
http://images.malwareremoval.com/jpshortstuff/SystemLook_x64.exe

Save the file to the Desktop
Double-click SystemLook.exe to run it.

Copy the content inside the following quote box into the open field:

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments]
[HKEY_Current_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments]

Click the Look button to start the scan.

When finished, a Notepad window opens with the results of the scan.

Please post the SystemLook.txt in your reply.

 

[GilV37]

Thats ok, we can all play.

 

[VistaKing]

GilV37

Looks like you still have files that go with the PC Utility Kit which is a Rogue Anti-virus program

 

[GilV37]

ok, i'll uninstall Rogue

 

[Jacee]

Gotta' go eat ... I'll "play" later, but here's a cheer from my court

 

[GilV37]

done