Trojan ZBot problem

norton 360 keeps giving pop-up notifications saying it is blocking this threat. Have tried to remove with norton - malware bytes with no luck - can't be found - notification keeps coming.

 

thanks in advance for your assistance

 

Edited by dyann, 24 March 2017 - 01:35 PM.

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.
 

Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM-x32\...\Run: [] => [X]
GroupPolicyScripts: Restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
Toolbar: HKU\S-1-5-21-3849212312-1164681820-1494648361-1112 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
CHR Extension: (Chrome Media Router) - C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Chrome Media Router) - C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-11-30]
CHR Extension: (Chrome Media Router) - C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-30]
CHR HKLM-x32\...\Chrome\Extension: [eoalfhodgifhbkgmbbdafcihjpdldpll] - hxxps://clients2.google.com/service/update2/crx
U3 idsvc; no ImagePath
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam64.sys [X]
CustomCLSID: HKU\S-1-5-21-3849212312-1164681820-1494648361-1112_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Pat\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3849212312-1164681820-1494648361-1112_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Pat\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File
Task: {00468C49-981E-4E2E-B2E7-B80B1D216743} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {011BA60A-C6B3-4525-86ED-218644B1AF16} - \Microsoft\Windows\SideShow\SessionAgent -> No File <==== ATTENTION
Task: {01F17D11-3208-490D-930F-AD7D3D67E554} - \Microsoft\Windows\WindowsBackup\Windows Backup Monitor -> No File <==== ATTENTION
Task: {0252511E-04DC-463F-93E4-7384B53AD7E3} - \Microsoft\Windows\Media Center\InstallPlayReady -> No File <==== ATTENTION
Task: {05005922-945E-4E0F-952F-DB3DAA467BD1} - \pat DBAgent 2 0 -> No File <==== ATTENTION
Task: {0644CF0D-A423-43C2-8859-F94004ACBF89} - \{B2E7B6E6-DC1B-4493-830D-941418CB8C7F} -> No File <==== ATTENTION
Task: {06B2E227-9EFD-410C-9255-83BC340D2AFA} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {088482FA-65B8-4E17-9ABF-1DCD48E8D373} - \Microsoft\Windows\Tcpip\IpAddressConflict1 -> No File <==== ATTENTION
Task: {09012386-9C45-46AC-9089-8628CC2AA097} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {09F06BFE-A3C8-40E3-846A-6E6F4000C238} - \Microsoft\Windows\Tcpip\IpAddressConflict2 -> No File <==== ATTENTION
Task: {0BF43D25-5F69-415C-AD16-A46EBF853961} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {1127B670-F6BB-43A3-9AB4-2DCE780EB21A} - \Hewlett-Packard\HP Support Assistant\GetAssistance Maintenance Events -> No File <==== ATTENTION
Task: {136DE61B-B54F-4A51-AC67-23A67C10539B} - \Microsoft\Windows\Media Center\OCURActivate -> No File <==== ATTENTION
Task: {22545E0D-66B1-419C-B909-CDC725227D50} - \{A56DC5E4-BEFE-4F1C-AA3D-330B17C0EC33} -> No File <==== ATTENTION
Task: {24114BF4-4F24-4235-ADC1-14B19ABEC91F} - \Microsoft\Windows\Media Center\mcupdate -> No File <==== ATTENTION
Task: {24A43306-8CC1-490E-AB50-DBBF3C3F0EDD} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {25135D22-1B4D-4AEA-9EDB-A8D599858DD1} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot -> No File <==== ATTENTION
Task: {268CD9F6-33F5-43D5-B5CA-B028F0BE02B9} - \{91FA9B62-E7C9-435C-A547-939B75DE3A44} -> No File <==== ATTENTION
Task: {277097C0-4931-46E8-9FF8-C3F6B152388C} - \{66C41B27-A435-40B3-8363-96987875863D} -> No File <==== ATTENTION
Task: {2E27D9F0-D1ED-49B0-AFC3-DBB38BD4D5D7} - \Microsoft\Windows\PLA\System\{443BC4C6-F472-441D-88DE-8669F048A50E}_System Diagnostics -> No File <==== ATTENTION
Task: {33C2BFF2-D391-484F-B2A8-72B8AC741E31} - \Microsoft\Office\OfficeTelemetryAgentFallBack2016 -> No File <==== ATTENTION
Task: {33D11032-4C3E-4C7B-B1DA-75A22D2278D9} - \Microsoft\Windows\Media Center\mcupdate_scheduled -> No File <==== ATTENTION
Task: {36AF6A62-E51D-4AF5-AAF9-C18E2D987E28} - \Microsoft\Windows Live\SOXE\Extractor Definitions Update Task -> No File <==== ATTENTION
Task: {3BE40D73-40B8-459A-9893-761CCE0C075A} - \Seagate_Install_Launch -> No File <==== ATTENTION
Task: {3D12DF07-3992-488F-A7E0-A914963EECCA} - \GoogleUpdateTaskUserS-1-5-21-3849212312-1164681820-1494648361-1112UA -> No File <==== ATTENTION
Task: {3F0E9C02-6C95-417C-8F70-294E0538E7EF} - \{8187220C-067C-4E3B-8A13-97FFBA16170C} -> No File <==== ATTENTION
Task: {486D715E-6AA2-44CF-BC48-B6990CBB53C6} - \Microsoft\Windows\Shell\WindowsParentalControlsMigration -> No File <==== ATTENTION
Task: {4882E769-EA24-4A51-82C9-7F3F04D51EEB} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display -> No File <==== ATTENTION
Task: {4C097A90-020E-461B-BA5A-2D73B072B5AF} - \{F7D0D45C-F278-481C-8C4A-BA1E77D8B6BF} -> No File <==== ATTENTION
Task: {4DAA2D97-8D28-49D2-8FE5-46AACF3B8887} - \Microsoft\Office\Office Automatic Updates -> No File <==== ATTENTION
Task: {4DB274A6-83E6-4402-986B-AE8AEF21D5DB} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4FE8BCCF-52AE-4B71-BFB0-FD111B283394} - \Microsoft\Windows\SideShow\SystemDataProviders -> No File <==== ATTENTION
Task: {51F47D41-E325-4703-A510-A94F3ECF6E22} - \{166454D3-A83C-44EF-AD73-EEB10A659377} -> No File <==== ATTENTION
Task: {5A24D427-7F46-4072-8D55-91DFFCDCE6B7} - \AdobeAAMUpdater-1.0-LOX-pat -> No File <==== ATTENTION
Task: {5B42DD9C-5A26-4F27-BB95-34603F0997E5} - \Microsoft\Windows\Shell\WindowsParentalControls -> No File <==== ATTENTION
Task: {5E71FA4A-CACC-4066-A215-F811BA5EA67C} - \Microsoft\Windows\WindowsBackup\AutomaticBackup -> No File <==== ATTENTION
Task: {60942A7B-C322-4F0E-AB26-6499E3369E41} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {6112C0C7-8DB1-4D72-BC0F-F091F0F1E918} - \Norton WSC Integration -> No File <==== ATTENTION
Task: {647226B9-5A90-4C08-9352-071E52ED369E} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {6C2FC1EB-21BC-44B3-9859-64550F81D2F7} - \Microsoft\Windows\Media Center\ActivateWindowsSearch -> No File <==== ATTENTION
Task: {6C4E8829-304F-4EC6-8E00-AC0D536FDB20} - \{283F2C9C-CEE8-4E89-87C5-6ADDF7CEBAA5} -> No File <==== ATTENTION
Task: {6D4442B6-C21E-47D7-923E-64517630DF47} - \DropboxUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {713D40D2-8CB3-43D3-A6B2-A9C149168598} - \Microsoft\Windows\Media Center\OCURDiscovery -> No File <==== ATTENTION
Task: {7171D518-2E37-4B0C-BB5A-49A7DC1FC926} - \pat -> No File <==== ATTENTION
Task: {72A37E36-7725-41CE-89C0-C080C00CFBB4} - \Microsoft\Windows\SideShow\AutoWake -> No File <==== ATTENTION
Task: {74642FDC-94A4-42D4-BB69-465E0182CDBF} - \Microsoft\Windows\SyncCenter\S-1-5-21-3849212312-1164681820-1494648361-1112\{750FDF10-2A26-11D1-A3EA-080036587F03}\Offline Files Sync Schedule 1 -> No File <==== ATTENTION
Task: {760F8F85-4DF9-48E1-97D1-EB84FDD1F823} - \{907581B4-1B1B-40A0-B4CF-1E5B45688AFF} -> No File <==== ATTENTION
Task: {784218A3-7C91-4747-9425-153E5109ADF5} - \Adobe Acrobat Update Task -> No File <==== ATTENTION
Task: {7A060BBE-F1F6-481D-BC0E-13779F225A09} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {7DF10749-9498-4366-BE68-6CB163765E33} - \Microsoft\Windows\Media Center\RegisterSearch -> No File <==== ATTENTION
Task: {7E90F34A-A5D1-4A3C-816F-3B9F4653DBED} - \Microsoft\Office\Office ClickToRun Service Monitor -> No File <==== ATTENTION
Task: {829C42BB-BB61-4881-9AF4-9213E3612AFB} - \Microsoft\Windows\Media Center\UpdateRecordPath -> No File <==== ATTENTION
Task: {8B129AEB-13CE-4484-BE03-31B59850BD0A} - \HPCeeScheduleForpat -> No File <==== ATTENTION
Task: {8B82BE3E-CC80-43A1-B8B0-214004E5516D} - \Microsoft\Windows\Media Center\PBDADiscoveryW2 -> No File <==== ATTENTION
Task: {8B912408-F61D-4672-87A1-82ACC3621266} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {8E6C396A-5F73-445C-950E-CBC6A36AB76A} - \Microsoft\Windows\MobilePC\HotStart -> No File <==== ATTENTION
Task: {8EA27DCE-0F94-42E6-A405-9F5C2A83FA6A} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {95582A46-15D7-465B-B687-0C0E949A095E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {99437FB8-C244-467D-8E95-A64BA1292241} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {995EC485-8FA4-4024-A34E-3EC5643C9024} - \{9DF301EB-710A-413D-BEF5-893D7CAF23AD} -> No File <==== ATTENTION
Task: {A34F2F54-F33E-4260-BF72-2F9BC39C00F4} - \Microsoft\Windows\Media Center\PvrScheduleTask -> No File <==== ATTENTION
Task: {A5A65D4F-6011-4378-A84C-0BC1A3D13E0F} - \Microsoft\Windows\Setup\EOONotify -> No File <==== ATTENTION
Task: {A7DDEA0B-C283-43E7-9FD5-D517AB5EDCD2} - \Microsoft\Windows\Media Center\PvrRecoveryTask -> No File <==== ATTENTION
Task: {A8525828-2938-45F7-93A5-094F1135C6D2} - \Microsoft\Windows\UpdateOrchestrator\Policy Install -> No File <==== ATTENTION
Task: {AA45E3A0-1239-49AE-A5DE-613C362092FB} - \Microsoft\Windows\Media Center\ReindexSearchRoot -> No File <==== ATTENTION
Task: {AB4E9704-E885-4FD5-BBD3-D707D2139846} - \Remediation\AntimalwareMigrationTask -> No File <==== ATTENTION
Task: {AD875435-D7CB-48C9-A2A6-1FA381F706CE} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {AE5DC6FE-A0DF-45A6-A095-C291D41690B4} - \{8840FC39-7D16-462F-B321-2EDBEDE6B2FD} -> No File <==== ATTENTION
Task: {AEB3004E-0AD3-444D-8E7A-ED365314A0D2} - \HPCeeScheduleForMANAGER-01$ -> No File <==== ATTENTION
Task: {B0A3177B-2FA9-451F-A8DA-419F65FA6C5B} - \pat Merge -> No File <==== ATTENTION
Task: {B0CBAB43-44FC-469B-A4CE-87426761FDCE} - \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor -> No File <==== ATTENTION
Task: {B424073A-3257-400F-9222-4918CC0D2252} - \DropboxUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {B682458F-C5E9-4DC0-9D15-FB8D95E794C2} - \Microsoft\Windows\Media Center\PBDADiscovery -> No File <==== ATTENTION
Task: {B77865C6-E0C7-4155-AF68-F55BC57EA806} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {B999B34B-E321-4AB3-8A4E-4DE23FD305D0} - \Microsoft\Windows\Media Center\RecordingRestart -> No File <==== ATTENTION
Task: {BA35F7A1-9AAA-4EF3-9901-B9B8C4BA7F0A} - \DST -> No File <==== ATTENTION
Task: {BAF07BF2-7D6F-4B81-A6C3-ADBE7A8247DF} - \Apple\AppleSoftwareUpdate -> No File <==== ATTENTION
Task: {BBB7B0A5-F11C-434D-B64C-2FA1612A0CE4} - \Microsoft\Windows\Media Center\ehDRMInit -> No File <==== ATTENTION
Task: {BF10F2D6-6F40-4D8C-89EF-9086C641140D} - \Microsoft\Windows\Media Center\DispatchRecoveryTasks -> No File <==== ATTENTION
Task: {C16D68E2-9AB9-41B3-A5F8-404307457E61} - \User_Feed_Synchronization-{66CBBC5D-2665-4155-A2E1-7FC3EED251FA} -> No File <==== ATTENTION
Task: {CD409933-614E-46F0-8B2F-DE0859FB9117} - \Microsoft\Windows\Media Center\MediaCenterRecoveryTask -> No File <==== ATTENTION
Task: {CE22E558-A9D2-4282-B140-916F9F68EBEB} - \SDMsgUpdate (SD) -> No File <==== ATTENTION
Task: {D12B3694-88F5-42F6-B21B-7746B05D4ED6} - \{D50E820A-D92E-4603-820F-05D6E6E05983} -> No File <==== ATTENTION
Task: {D20F560E-B2A5-4B09-8296-CE562E60C1F1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {D2A8243D-7435-48C4-B5B9-E54CF09B5E38} - \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask -> No File <==== ATTENTION
Task: {D440DF8F-A883-46A5-9FB9-65A339FF838F} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {D78EAFC7-C5B2-4743-99F2-4EEF633999B7} - \Microsoft\Windows\Media Center\SqlLiteRecoveryTask -> No File <==== ATTENTION
Task: {DAACF283-3403-44F3-B640-370883C7564D} - \Microsoft\Windows\Media Center\PeriodicScanRetry -> No File <==== ATTENTION
Task: {E0600D0A-D1FD-451B-B792-64B5F663AEAD} - \Microsoft\Windows\SideShow\GadgetManager -> No File <==== ATTENTION
Task: {E1F0B936-FD51-4394-BCC9-9F218373D198} - \Adobe Flash Player Updater -> No File <==== ATTENTION
Task: {E58474FB-C48A-46E1-BB6D-45B4EC65E7DC} - \Registration -> No File <==== ATTENTION
Task: {EA8FAAD0-9486-48B6-AC49-89D1C83A10A0} - \Microsoft\Office\OfficeTelemetryAgentLogOn2016 -> No File <==== ATTENTION
Task: {EACA24FF-236C-401D-A1E7-B3D5267B8A50} - \Microsoft\Windows\RAC\RacTask -> No File <==== ATTENTION
Task: {EC0005F6-90C7-4825-ADF2-EF5F730C6285} - \Microsoft\Windows\Media Center\PBDADiscoveryW1 -> No File <==== ATTENTION
Task: {F31F0712-28DB-46E4-9FBA-ECA03F201FDF} - \Microsoft\Windows\Media Center\StartRecording -> No File <==== ATTENTION
Task: {F5976982-3198-4A29-929B-CBD269DC1536} - \GoogleUpdateTaskUserS-1-5-21-3849212312-1164681820-1494648361-1112Core -> No File <==== ATTENTION
Task: {FBA74822-4C7E-4B96-8471-123F768AE723} - \Microsoft\Windows\Media Center\ConfigureInternetTimeService -> No File <==== ATTENTION
Task: {FC91976C-130D-4018-A9F6-D3ED597687D5} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
AlternateDataStreams: C:\Windows:nlsPreferences [0]
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchProtect
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchProtectAll
C:\Users\Pat\AppData\Roaming\SearchProtect
C:\Program Files (x86)\SearchProtect

End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.

Please let me know if the problem persists with this computer.

thank you for your help below is the text and I attached the file also 

 

Has the problem been solved?

no the issue has not been solved -

Norton still shows pop-up with "Auto-Protect blocked security risk Trojon.Zbot. Your computer is secure."

Temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zoek tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(Give it a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:

createsrpoint;
autoclean;
emptyclsid;
emptyffcache;
FFdefaults;
emptyiecache;
iedefaults;
emptychrcache;
CHRdefaults;
emptyalltemp;
emptyfolderscheck;delete
ipconfig /flushdns;b

Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Please attach the zoek-results.log in your reply.
===

Also, please provide an update on how the computer is behaving after running the above script.

p.s.
Other than this error reported by Norton is the computer running well?

when clicking on link to download Zoek I get the following

 

Gateway Anti-Virus Alert
  This request is blocked by the SonicWALL Gateway Anti-Virus Service. Name: Banker.C_3 (Trojan)

 

not sure how to proceed I can disable Norton on my desktop but can't disable the Sonicwall  

 

on your ps the computer function is good just user hesitation to do any internet activity with the Zbot notification

Trust the download.

You will probably found it in the Quarantine folder of the Sonic application.

Or Disable the firewall while downloading. It should no take very long to download.

Enable your firewall.

sorry for delay I wanted to give you an update

I was able to download and run Zoek - during the run I got an error message "DaS21 has stopped working" I hit the close program button on the error box and Zoek seemed to continue ok. Zoek finished and gave me message reboot required. Windows did shutdown but during the restart it FROZE - after waiting for 10 mins I forced a 2nd restart (holding power switch) I selected the advanced Windows options on the restart and chose repair windows it ran a check disk and now is sitting on the attempting repairs screen with the rotating balls (time on this screen about 30mins)

 

Have to leave to attend meeting so I will let you know final restart results in morning

Just as I was leaving the repair finished with the message Startup Repair couldn't repair your pc it gave a log file location so i started the pc in dos mode and when looking through the repair txt doc from the cmd prompt everything completed successfully except the following:

 

Root cause found:

- - - - - - - - - -  - - - - - - - - - -

unspecified changes to system configuration might have caused the problem,

 

repair action:

result: Failed error code = 0x32

time taken 3656 ms

 

repair action: system restore

result: Failed error code = 0x1f

time taken = 1791922 ms

 

re[pair  action: system files integrity check and repair

result: Failed error code = 0x490

time taken = 1977156 ms

Do you have this program?

http://www.freefixer.com/library/file/DaS_21.exe-169694/

Is it located in a \Temp folder?
===

Sophos Virus Removal Tool

Please download Sophos Virus Removal Tool and save it to your computer's Desktop.

• Right-click the icon and select Run as administrator.
• Click Yes to accept any security warnings that may appear.
• Click the Next button.
• Select 'I accept the terms in the license agreement', then click Next twice.
• Click the Install button and wait until the installation is complete.
• Click the Finish button. The tool created a shortcut icon on the Desktop of your computer.
• Now, double-click the Sophos Virus Removal Tool shortcut icon to run the tool.
• Click Yes to accept any security warnings that may appear.
• After it updates and a "Start Scanning" button appears in the lower right:
  • Disconnect from the Internet or physically unplug your Internet cable connection.
  • Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  • Temporarily disable your anti-virus and real-time anti-spyware protection.

• Click the "Start Scanning" button in the lower right to start the scan.
• After starting the scan, do not use the computer until the scan has completed.
• When finished, if it detected anything there will be a "Start Clean-up" button, click it and allow it to finish.
• When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.
• If any threats are found click Details, then View Log file (bottom left-hand corner).
• Copy and paste its contents in your next reply and note any errors encountered.
• Close the Notepad document, close the Threat Details screen, then click Start cleanup.
• Click Exit to close the program.
• If no threats were found, please confirm that result.

Note: Whenever necessary, the log will be in the following location:

Windows Vista and above:
C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log
 
Windows XP:
C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log
 
Please post the contents of the log in your next reply and note any errors encountered.
===

Any issues with this computer?

Yes big issue with computer ... computer will not start up in windows from the command prompt I looked in the d:\temp dir and the file is not there again 

I am only able to start the computer in dos or command prompt mode the computer will not start windows

Until this is resolved I can not do anything further see my previsous post for the reported errors

Can you start the computer in Safe Mode with Networking?
How to.
https://support.microsoft.com/en-ca/help/12376/windows-10-start-your-pc-in-safe-mode

no unable to start in safe mode

during boot up hold F8 key - selected safe mode with network

goes to next step and freezes never loads just sits with black screen and blue 4 square windows flag and does nothing

Edited by dyann, 29 March 2017 - 02:23 PM.

I suggest you start a new topic in the Windows 10 forum.

A technician should be able to suggest a programs or means to restore the computer.

https://www.bleepingcomputer.com/forums/f/229/windows-10-support/

I will leave this topic open for 6 days.