Windows Explorer

[VistaKing]

Can you upload a picture of the Documents folder

Take a look at the link below

:ar: http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[VistaKing]

HitManPro

64-Bit Version OS :ar: HitmanPro_x64

32-Bit Version OS :ar: HitmanPro

:ar: Save to the Desktop

:ar: Right click on HitmanPro.exe and choose

:ar: When HitmanPro opens up click on Settings uncheck Scan for tracking cookies . Click on OK . Then click on the Next button

:ar: Click on No, I only want to perform a one-time scan to check this computer on the Setup page . Click Next once done .

:ar: Let it scan the PC once its done Click Next

:ar: Click Activate free license to start the free 30 days trial and remove all the malicious files from your computer then click Next

Upload the log . Locate in C:\ ProgramData\Hitman Pro\Logs

 

[Mike1957]

 

[Mike1957]

View attachment HitmanPro_20130816_1733.log

 

[VistaKing]

Can you slide down so I could see all of the files inside the folder ?

Any pop ups

 

[Mike1957]

what is below is 24 registration entries and 2 items ESBK.mbb and ESBK.mb

 

[Mike1957]

do you still want the screen shot? and yes it is still popping up. Earlier today it was like a bombardment of them and i don't know why.

 

[VistaKing]

Lets see something

Go to C:\FRST inside there you will see a folder called Quarantine inside there it should have the win.lnk file can you right click on it select Properties . Inside the Properties window click on Shortcut then take a look at the Target what does it say ?

 

[Mike1957]

win 8/11/2013 6:44pm shortcut 2KB

 

[Mike1957]

C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

 

[Mike1957]

sorry about that, should have read the whole thing...

 

[VistaKing]

When you right clicked on win.lnk the target says

C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Can you delete the win.lnk folder .

 

[Mike1957]

okay i deleted it, should i restart or does that not matter, because it is still popping up.

 

[VistaKing]

Restart delete the C:\FRST folder and delete the old FRST64 files . And download a new copy of FRST

FARBAR RECOVERY SCAN TOOL x64
Drag the newly downloaded FRST64 from the Downloads folder to your Desktop
Right click on FRST64.exe and choose

When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file

 

[Mike1957]

View attachment FRST.txt

View attachment Addition.txt

 

[VistaKing]

The log isn't showing me anything . Are you still having the pop up after you deleted the FRST folder from the C drive ?

 

[Mike1957]

it is not up now, well never mind, there it is

 

[VistaKing]

Ok . Open up SystemLook
type in

:regfind
My Music



:regfind
win.lnk


Its a lower case L

Click on Look . upload the SystemLook.txt file

 

[Mike1957]

View attachment SystemLook.txt

 

[VistaKing]

Can you try

:Filefind
win.lnk

Inside SystemLook and click on the Look button .