I have contracted a Virus that shows many Ads

Writer said:

I did not disable any of those you have listed; I'll put a check in their boxes to enable them when I open CCleaner shortly.

Here is the Programs List:

Programs List 11-18-2015.txt

Thanks.

Please do NOT enable any of them until we are finished - they could muddy up the waters at this point.

Please UNINSTALL the following:
Java 8 Update 31 Oracle Corporation 1/22/2015 6.07 MB 8.0.310
Java(TM) 6 Update 24 Oracle 10/13/2014 96.9 MB 6.0.240

lx07 said:

I don't mean to sidetrack or duplicate what @simrick is doing but with regards to one minor part, the C:\users\AppData\Local\PluginBus\xBin\PluginBus.dll problem at startup, you could download autoruns from here Autoruns for Windows, run it and right click and delete the entry where it is found in the Image path...

It was from a scheduled task to add adware apparently pluginbus.dll and the problem dll has probably already been cleaned up just leaving the start-up item.

Attachment 49069

Yes, thanks for mentioning that - another way to accomplish it! :)

lx07 said:

Hope I didn't confuse anything...

No no, not at all. If we are unable to resolve with the Ccleaner method, that is next on the list!

@Writer, please advise when you have completed the Ccleaner instructions and rebooted the machine.

- did the DLL error go away?

- is Defender still turned off?

Writer said:

I completed the changes for CCleaner and rebooted.

The DLL Error still appears.

Defender is still turned off.

Concerning Realtek Audio: It is still installed. I'll try to check to see if it is disabled. If it is, I didn't disable it; I don't think.

The small DWM Notification window in the Task-bar didn't reappear.

Okay, we can enable Realtek Audio from within Ccleaner later.

Let's have a look at Windows Defender.

Type Defender in the search box and select Windows Defender in the search results to open the program interface. Advise whether it is still turned off or not.

If it is still turned off, see if you can enable it from there.

If not, open Task Manager (search box) > Services Tab, click on the Name column to sort by service name. Scroll down to WinDefend


Right-click and select STOP. Then right-click and select RESTART.

Is it running now?
If not, click OPEN SERVICES at the very bottom of that window. In the new window that opens, scroll down to Windows Defender Network Inspection and Windows Defender Service.



Double-click each one and compare your setting to the ones shown below. Determine if they match the screenshots below:






If they don't match, and Defender is still not running, we will try editing the registry.

Editing the registry is risky business for anyone not familiar with what they're doing. Please be extra cautious following these instructions. Mistakes in the registry could cause your system to become unstable or even un-bootable.

search regedit.exe
open the registry editor
expand the appropriate arrows on the left to see where we are going.

The path is

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

Click once on Windows Defender to highlight it in the left pane. Notice the keys that show up in the right pane.

Disable AntiSpyware and Disable AntiVirus are the two we are interested in. If the DWORD value = 0, they are not disabled. If the DWORD value = 1, they are disabled.

Double click on each key to change the value from 1 to 0.




Select FILE>EXIT to exit the registry editor.

Reboot the computer. Open Windows Defender and see if it is now running.

Writer said:

Here is an updated Program List from CCleaner:

Programs List #2 11-18-2015.txt

Thanks. The only other program I would uninstall is this one:

Adobe Shockwave Player 12.1 Adobe Systems, Inc. 8/21/2015 12.1.3.153

Unless you need it for a specific game, I would get rid of it. It's just like Flash and Java - too many security holes, too many updates, too dangerous to have if you don't need it.

Everything else looks good.