Double circumflex accent on Windows 10

I did the scan with NO32 but I have no report to send you because it found absolutely nothing.
Why do we need to uninstall Spybot?
What can I do to get rid of this accent ^e problem?

Thank you for your help and your patience.

1/
Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

Open Notepad: Windows key + R,
In the "Run" field, type notepad and press OK.
Copy/Paste the following into it:

CreateRestorePoint:
CloseProcesses:
C:\Program Files (x86)\Common Files\Wondershare
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:

Once the text is pasted in Notepad,
Go to the "File" menu and then "Save As",
On the left, select Desktop,
In the field at the bottom, file name enter: fixlist.txt
Click on "Save", this will create fixlist.txt on the Desktop.

Restart FRST and click on the "Fix" button
A restart may be necessary ( not mandatory )
A text file will appear, copy/paste the content here in a new message.

Restart the computer.

2/
Perform a NOD32 online scan and save the report. Send it to https://pjjoint.malekal.com/ and provide the link here.

ok as mentioned above, I don't think the computer is infected.
What does it do in safe mode?

Hi,

Yeah, infected by a trojan,




You have programs that were installed when the computer was purchased or installed later that are not necessarily useful.
They clutter Windows and can slow it down.
You can therefore uninstall them.
Go to the Control Panel
then to Programs and Features.
Uninstall:

App Explorer
iCloud
McAfee WebAdvisor (useless)
Web Companion (spyware)


PS: CCleaner is not really useful, even if it's recommended everywhere.
If you want to keep it, disable the monitoring of CCleaner, unnecessary, as it starts up with Windows and slows it down with its constant cleanups, see: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/


Here is the fix to perform with FRST. You can refer to this explanatory note with screenshots.
Restart FRST and then press CTRL + Y on your keyboard.
The notepad will open, copy/paste this.

Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-880212356-1352285994-680412756-1001\...\Run: [WinW] => "C:\Users\hoffl\AppData\Roaming\Microsoft\AutoIt3.exe" "C:\Users\hoffl\AppData\Roaming\Microsoft\WinW"
2019-05-20 23:15 - 2019-05-23 09:04 - 000000000 ____D C:\Users\hoffl\AppData\Roaming\WinF
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [298296 2018-03-25] (Apple Inc. -> Apple Inc.)
2019-05-21 17:33 - 2018-09-07 00:35 - 000567192 _____ C:\Users\hoffl\Desktop\cacaoweb.exe
2019-05-20 23:12 - 2019-05-20 23:12 - 000893608 _____ (AutoIt Team) C:\Users\hoffl\AppData\Roaming\Microsoft\AutoIt3.exe
2019-05-20 23:12 - 2019-05-20 23:12 - 000186112 _____ () C:\Users\hoffl\AppData\Roaming\Microsoft\WinW
EmptyTemp:
RemoveProxy:
Reboot:
End

Save the content via the file menu and then save.

Close the notepad, return to FRST and click the "Fix" button
A restart may be necessary and automatic.
A text file will appear, copy/paste the content here in a new message.

Restart the computer.

Hi,

Yep infected.

If you can, send C:\Users\Nico\svchook.exe to https://upload.malekal.com

then:

Here is the FRST fix to execute.
You can use this explanatory note with screenshots.

1- Open FRST -
2 - Copy the entire script from the box below:

Start:
CloseProcesses:
CreateRestorePoint:
Task: {3E900A02-0D40-447F-9F03-12CEE9474543} - System32\Tasks\ZLCK2QZ7 => C:\Users\Nico\svchook.exe [1013928 2020-02-20] (AutoIt Consulting Ltd -> AutoIt Team)
Task: {41D4D599-0FCA-4FE6-B26B-7F301F92F506} - System32\Tasks\0XEYA5RD => C:\Users\Nico\svchook.exe [1013928 2020-02-20] (AutoIt Consulting Ltd -> AutoIt Team)
Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jarvee.lnk [2019-05-27]
ShortcutTarget: Jarvee.lnk -> C:\Users\Nico\AppData\Roaming\Jarvee\Jarvee.exe (File not found)
2020-04-19 10:18 - 2020-04-21 09:25 - 000000000 ____D C:\Users\Nico\AppData\Roaming\news
2020-02-20 15:12 - 2020-02-20 15:12 - 001013928 _____ (AutoIt Team) C:\Users\Nico\svchook.exe
EmptyTemp:
RemoveProxy:
Reboot:
End::

3- Once the script is copied, click on Fix.

Let the fix complete, once it’s done you will be asked to restart your PC, do it as soon as prompted, see below.
Then once your computer has restarted:
4- You will have a Fixlog file on your desktop, send it via https://pjjoint.malekal.com/ then put the link generated by Pjoint in your next message.
5- CHECK AND LET ME KNOW IF YOUR ISSUE IS STILL PRESENT.