Whitesmoke Help

[perriw]

Whenever I use Firefox, there is a Whitesmoke toolbar that I did not install and it is not under programs I have installed. Can someone help me remove it?

dds.txt

Attach.txt

[MrCharlie]

Welcome to the forum.

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

[perriw]

# AdwCleaner v2.007 - Logfile created 11/11/2012 at 16:34:30

# Updated 06/11/2012 by Xplode

# Operating system : Windows 7 Home Premium (64 bits)

# User : Amanda - AMANDA-PC

# Boot Mode : Normal

# Running from : C:\Users\Amanda\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3KZESMX\adwcleaner[1].exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\ProgramData\InstallMate

Folder Found : C:\ProgramData\Partner

Folder Found : C:\ProgramData\Premium

Folder Found : C:\Users\Amanda\AppData\Local\Ilivid Player

Folder Found : C:\Users\Amanda\AppData\Local\Temp\CT3244149

Folder Found : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\CT3244149

Folder Found : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\extensions\{462be121-2b54-4218-bf00-b9bf8135b23f}

Folder Found : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\Smartbar

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default

File : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\prefs.js

Found : user_pref("CT3244149.1000082.isDisplayHidden", "true");

Found : user_pref("CT3244149.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Found : user_pref("CT3244149.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3244149.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Found : user_pref("CT3244149.FirstTime", "true");

Found : user_pref("CT3244149.FirstTimeFF3", "true");

Found : user_pref("CT3244149.LoginRevertSettingsEnabled", true);

Found : user_pref("CT3244149.RevertSettingsEnabled", false);

Found : user_pref("CT3244149.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT324[...]

Found : user_pref("CT3244149.UserID", "UN64497428739899599");

Found : user_pref("CT3244149.UserId.enc", "MzQxMjQxNWUtZmM4OS1iY2U5LTgzNGItNjRkNWZlODRkNDkw");

Found : user_pref("CT3244149.addressBarTakeOverEnabledInHidden", "true");

Found : user_pref("CT3244149.autoDisableScopes", -1);

Found : user_pref("CT3244149.browser.search.defaultthis.engineName", true);

Found : user_pref("CT3244149.defaultSearch", "true");

Found : user_pref("CT3244149.embeddedsData", "[{\"appId\":\"129895725399351616\",\"apiPermissions\":{\"cross[...]

Found : user_pref("CT3244149.enableAlerts", "always");

Found : user_pref("CT3244149.enableSearchFromAddressBar", "true");

Found : user_pref("CT3244149.firstTimeDialogOpened", "true");

Found : user_pref("CT3244149.fixPageNotFoundError", "true");

Found : user_pref("CT3244149.fixPageNotFoundErrorInHidden", "true");

Found : user_pref("CT3244149.fixUrls", true);

Found : user_pref("CT3244149.hxxp___api19_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Found : user_pref("CT3244149.hxxp___api22_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Found : user_pref("CT3244149.hxxp___api26_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Found : user_pref("CT3244149.hxxp___api28_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_cache.enc", "WyJjODIyYzFiNjM4NTN[...]

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui.enc", "eyJndWkiOlt7In[...]

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings.enc", "eyJpbml0VXJsIjoi[...]

Found : user_pref("CT3244149.installId", "166");

Found : user_pref("CT3244149.installType", "conduitnsisintegration");

Found : user_pref("CT3244149.isCheckedStartAsHidden", true);

Found : user_pref("CT3244149.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3244149.isFirstTimeToolbarLoading", "false");

Found : user_pref("CT3244149.isNewTabEnabled", true);

Found : user_pref("CT3244149.isPerformedSmartBarTransition", "true");

Found : user_pref("CT3244149.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Found : user_pref("CT3244149.keyword", true);

Found : user_pref("CT3244149.migrateAppsAndComponents", true);

Found : user_pref("CT3244149.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

Found : user_pref("CT3244149.openThankYouPage", "false");

Found : user_pref("CT3244149.openUninstallPage", "true");

Found : user_pref("CT3244149.revertSettingsEnabled", "false");

Found : user_pref("CT3244149.search.searchAppId", "129895725399351616");

Found : user_pref("CT3244149.search.searchCount", "0");

Found : user_pref("CT3244149.searchInNewTabEnabledInHidden", "true");

Found : user_pref("CT3244149.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3244149.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Found : user_pref("CT3244149.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Found : user_pref("CT3244149.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1352352371312");

Found : user_pref("CT3244149.serviceLayer_services_appsMetadata_lastUpdate", "1352449274007");

Found : user_pref("CT3244149.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1352352372698");

Found : user_pref("CT3244149.serviceLayer_services_login_10.13.30.23_lastUpdate", "1352449274157");

Found : user_pref("CT3244149.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1352352372776");

Found : user_pref("CT3244149.serviceLayer_services_searchAPI_lastUpdate", "1352449274232");

Found : user_pref("CT3244149.serviceLayer_services_serviceMap_lastUpdate", "1352449273630");

Found : user_pref("CT3244149.serviceLayer_services_toolbarContextMenu_lastUpdate", "1352352372629");

Found : user_pref("CT3244149.serviceLayer_services_toolbarSettings_lastUpdate", "1352449273991");

Found : user_pref("CT3244149.serviceLayer_services_translation_lastUpdate", "1352449273745");

Found : user_pref("CT3244149.settingsINI", true);

Found : user_pref("CT3244149.shouldFirstTimeDialog", "false");

Found : user_pref("CT3244149.smartbar.CTID", "CT3244149");

Found : user_pref("CT3244149.smartbar.Uninstall", "0");

Found : user_pref("CT3244149.smartbar.homepage", true);

Found : user_pref("CT3244149.smartbar.toolbarName", "WhiteSmoke US New ");

Found : user_pref("CT3244149.toolbarBornServerTime", "8-11-2012");

Found : user_pref("CT3244149.toolbarCurrentServerTime", "9-11-2012");

Found : user_pref("CT3244149_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=1[...]

Found : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke US New Customized Web Search");

Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149[...]

Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3244149");

Found : user_pref("browser.search.selectedEngine", "WhiteSmoke US New Customized Web Search");

Found : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13&CUI[...]

Found : user_pref("extensions.509b44b878799.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[...]

Found : user_pref("extensions.enabledAddons", "DivXWebPlayer@divx.com:2.0.2.039,{167DB89B-D2DB-11E1-8270-B8A[...]

Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149&SearchSource=2&q=[...]

Found : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13[...]

Found : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]

*************************

AdwCleaner[R1].txt - [8731 octets] - [11/11/2012 16:34:30]

########## EOF - C:\AdwCleaner[R1].txt - [8791 octets] ##########

[MrCharlie]

Lots of adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

[perriw]

# AdwCleaner v2.007 - Logfile created 11/11/2012 at 17:07:04

# Updated 06/11/2012 by Xplode

# Operating system : Windows 7 Home Premium (64 bits)

# User : Amanda - AMANDA-PC

# Boot Mode : Normal

# Running from : C:\Users\Amanda\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3KZESMX\adwcleaner[1].exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\ProgramData\InstallMate

Folder Deleted : C:\ProgramData\Partner

Folder Deleted : C:\ProgramData\Premium

Folder Deleted : C:\Users\Amanda\AppData\Local\Ilivid Player

Folder Deleted : C:\Users\Amanda\AppData\Local\Temp\CT3244149

Folder Deleted : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\CT3244149

Folder Deleted : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\extensions\{462be121-2b54-4218-bf00-b9bf8135b23f}

Folder Deleted : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\Smartbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default

File : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\0r2v3pn8.default\prefs.js

Deleted : user_pref("CT3244149.1000082.isDisplayHidden", "true");

Deleted : user_pref("CT3244149.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Deleted : user_pref("CT3244149.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3244149.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Deleted : user_pref("CT3244149.FirstTime", "true");

Deleted : user_pref("CT3244149.FirstTimeFF3", "true");

Deleted : user_pref("CT3244149.LoginRevertSettingsEnabled", true);

Deleted : user_pref("CT3244149.RevertSettingsEnabled", false);

Deleted : user_pref("CT3244149.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT324[...]

Deleted : user_pref("CT3244149.UserID", "UN64497428739899599");

Deleted : user_pref("CT3244149.UserId.enc", "MzQxMjQxNWUtZmM4OS1iY2U5LTgzNGItNjRkNWZlODRkNDkw");

Deleted : user_pref("CT3244149.addressBarTakeOverEnabledInHidden", "true");

Deleted : user_pref("CT3244149.autoDisableScopes", -1);

Deleted : user_pref("CT3244149.browser.search.defaultthis.engineName", true);

Deleted : user_pref("CT3244149.defaultSearch", "true");

Deleted : user_pref("CT3244149.embeddedsData", "[{\"appId\":\"129895725399351616\",\"apiPermissions\":{\"cross[...]

Deleted : user_pref("CT3244149.enableAlerts", "always");

Deleted : user_pref("CT3244149.enableSearchFromAddressBar", "true");

Deleted : user_pref("CT3244149.firstTimeDialogOpened", "true");

Deleted : user_pref("CT3244149.fixPageNotFoundError", "true");

Deleted : user_pref("CT3244149.fixPageNotFoundErrorInHidden", "true");

Deleted : user_pref("CT3244149.fixUrls", true);

Deleted : user_pref("CT3244149.hxxp___api19_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Deleted : user_pref("CT3244149.hxxp___api22_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Deleted : user_pref("CT3244149.hxxp___api26_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Deleted : user_pref("CT3244149.hxxp___api28_starwebnet_com.pid2", "ZGM3Njc3M2ZjNmJiZWZjZg==");

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_cache.enc", "WyJjODIyYzFiNjM4NTN[...]

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui.enc", "eyJndWkiOlt7In[...]

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings.enc", "eyJpbml0VXJsIjoi[...]

Deleted : user_pref("CT3244149.installId", "166");

Deleted : user_pref("CT3244149.installType", "conduitnsisintegration");

Deleted : user_pref("CT3244149.isCheckedStartAsHidden", true);

Deleted : user_pref("CT3244149.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3244149.isFirstTimeToolbarLoading", "false");

Deleted : user_pref("CT3244149.isNewTabEnabled", true);

Deleted : user_pref("CT3244149.isPerformedSmartBarTransition", "true");

Deleted : user_pref("CT3244149.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Deleted : user_pref("CT3244149.keyword", true);

Deleted : user_pref("CT3244149.migrateAppsAndComponents", true);

Deleted : user_pref("CT3244149.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

Deleted : user_pref("CT3244149.openThankYouPage", "false");

Deleted : user_pref("CT3244149.openUninstallPage", "true");

Deleted : user_pref("CT3244149.revertSettingsEnabled", "false");

Deleted : user_pref("CT3244149.search.searchAppId", "129895725399351616");

Deleted : user_pref("CT3244149.search.searchCount", "0");

Deleted : user_pref("CT3244149.searchInNewTabEnabledInHidden", "true");

Deleted : user_pref("CT3244149.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3244149.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Deleted : user_pref("CT3244149.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Deleted : user_pref("CT3244149.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1352352371312");

Deleted : user_pref("CT3244149.serviceLayer_services_appsMetadata_lastUpdate", "1352449274007");

Deleted : user_pref("CT3244149.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1352352372698");

Deleted : user_pref("CT3244149.serviceLayer_services_login_10.13.30.23_lastUpdate", "1352449274157");

Deleted : user_pref("CT3244149.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1352352372776");

Deleted : user_pref("CT3244149.serviceLayer_services_searchAPI_lastUpdate", "1352449274232");

Deleted : user_pref("CT3244149.serviceLayer_services_serviceMap_lastUpdate", "1352449273630");

Deleted : user_pref("CT3244149.serviceLayer_services_toolbarContextMenu_lastUpdate", "1352352372629");

Deleted : user_pref("CT3244149.serviceLayer_services_toolbarSettings_lastUpdate", "1352449273991");

Deleted : user_pref("CT3244149.serviceLayer_services_translation_lastUpdate", "1352449273745");

Deleted : user_pref("CT3244149.settingsINI", true);

Deleted : user_pref("CT3244149.shouldFirstTimeDialog", "false");

Deleted : user_pref("CT3244149.smartbar.CTID", "CT3244149");

Deleted : user_pref("CT3244149.smartbar.Uninstall", "0");

Deleted : user_pref("CT3244149.smartbar.homepage", true);

Deleted : user_pref("CT3244149.smartbar.toolbarName", "WhiteSmoke US New ");

Deleted : user_pref("CT3244149.toolbarBornServerTime", "8-11-2012");

Deleted : user_pref("CT3244149.toolbarCurrentServerTime", "9-11-2012");

Deleted : user_pref("CT3244149_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=1[...]

Deleted : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke US New Customized Web Search");

Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149[...]

Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3244149");

Deleted : user_pref("browser.search.selectedEngine", "WhiteSmoke US New Customized Web Search");

Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13&CUI[...]

Deleted : user_pref("extensions.509b44b878799.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[...]

Deleted : user_pref("extensions.enabledAddons", "DivXWebPlayer@divx.com:2.0.2.039,{167DB89B-D2DB-11E1-8270-B8A[...]

Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149&SearchSource=2&q=[...]

Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13[...]

Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]

*************************

AdwCleaner[R1].txt - [8860 octets] - [11/11/2012 16:34:30]

AdwCleaner[R2].txt - [8920 octets] - [11/11/2012 17:03:20]

AdwCleaner[R3].txt - [8980 octets] - [11/11/2012 17:06:28]

AdwCleaner[s1].txt - [9099 octets] - [11/11/2012 17:07:04]

########## EOF - C:\AdwCleaner[s1].txt - [9159 octets] ##########

[MrCharlie]

How is it?? MrC

[perriw]

wow. its gone! thanks so much mr.C

[MrCharlie]

Great

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!