Jump to content

infected with Yontoo

kehoe3

By kehoe3
in Resolved Malware Removal Logs

 Share

Recommended Posts

kehoe3

kehoe3

Posted
Posted

Thank you for your help. DDS and Attach files below

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 12/19/2012 1:30:40 PM

System Uptime: 3/23/2013 8:07:35 AM (2 hours ago)

.

Motherboard: Dell Inc. | | 034W60

Processor: Intel® Core i5-2450M CPU @ 2.50GHz | CPU 1 | 2501/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 685 GiB total, 653.142 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Intel® Centrino® Wireless-N 1030

Device ID: PCI\VEN_8086&DEV_008A&SUBSYS_53258086&REV_34\4CEB42FFFF5AEDD000

Manufacturer: Intel Corporation

Name: Intel® Centrino® Wireless-N 1030

PNP Device ID: PCI\VEN_8086&DEV_008A&SUBSYS_53258086&REV_34\4CEB42FFFF5AEDD000

Service: NETwNs64

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.0.1)

Advanced Audio FX Engine

AVG 2013

AxCrypt 1.7.2976.0

Coupon Companion Plugin

CyberLink PowerDVD 9.6

D3DX10

Data Access Objects

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell Support Center

Dell Touchpad

Dell Webcam Central

DirectX 9 Runtime

IDT Audio

InPhase Workstation

Intel® Processor Graphics

Intel® PROSet/Wireless Software for Bluetooth® Technology

Java 7 Update 10

Java Auto Updater

Junk Mail filter update

Live! Cam Avatar Creator

LogMeIn

Malwarebytes Anti-Malware version 1.70.0.1100

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

PhotoShowExpress

PrimoPDF -- brought to you by Nitro PDF Software

Quickset64

RBVirtualFolder64Inst

Roxio Activation Module

Roxio BackOnTrack

Roxio Burn

Roxio Creator Starter

Roxio Express Labeler 3

Roxio File Backup

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

SelectionLinks

Sonic CinePlayer Decoder Pack

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Visual Studio 2010 x64 Redistributables

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Ws2k3

Yontoo 2.05

.

==== Event Viewer Messages From Past Week ========

.

3/23/2013 8:08:10 AM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

3/20/2013 5:14:15 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

3/20/2013 5:12:18 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

3/20/2013 5:09:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Bluetooth Device Monitor service.

3/20/2013 5:06:28 PM, Error: Service Control Manager [7034] - The Bluetooth Media Service service terminated unexpectedly. It has done this 1 time(s).

3/20/2013 5:06:27 PM, Error: Service Control Manager [7034] - The Bluetooth OBEX Service service terminated unexpectedly. It has done this 1 time(s).

3/19/2013 11:59:14 AM, Error: Service Control Manager [7022] - The Service Sendori service hung on starting.

3/19/2013 11:57:07 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SoftThinks Agent Service service to connect.

3/19/2013 11:57:07 AM, Error: Service Control Manager [7000] - The SoftThinks Agent Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

3/18/2013 9:11:09 PM, Error: Service Control Manager [7034] - The Application Sendori service terminated unexpectedly. It has done this 1 time(s).

3/18/2013 9:11:09 PM, Error: Service Control Manager [7031] - The Service Sendori service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1200000 milliseconds: Restart the service.

.

==== End Of File ===========================

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 12/19/2012 1:30:40 PM

System Uptime: 3/23/2013 8:07:35 AM (2 hours ago)

.

Motherboard: Dell Inc. | | 034W60

Processor: Intel® Core i5-2450M CPU @ 2.50GHz | CPU 1 | 2501/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 685 GiB total, 653.142 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Intel® Centrino® Wireless-N 1030

Device ID: PCI\VEN_8086&DEV_008A&SUBSYS_53258086&REV_34\4CEB42FFFF5AEDD000

Manufacturer: Intel Corporation

Name: Intel® Centrino® Wireless-N 1030

PNP Device ID: PCI\VEN_8086&DEV_008A&SUBSYS_53258086&REV_34\4CEB42FFFF5AEDD000

Service: NETwNs64

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.0.1)

Advanced Audio FX Engine

AVG 2013

AxCrypt 1.7.2976.0

Coupon Companion Plugin

CyberLink PowerDVD 9.6

D3DX10

Data Access Objects

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell Support Center

Dell Touchpad

Dell Webcam Central

DirectX 9 Runtime

IDT Audio

InPhase Workstation

Intel® Processor Graphics

Intel® PROSet/Wireless Software for Bluetooth® Technology

Java 7 Update 10

Java Auto Updater

Junk Mail filter update

Live! Cam Avatar Creator

LogMeIn

Malwarebytes Anti-Malware version 1.70.0.1100

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

PhotoShowExpress

PrimoPDF -- brought to you by Nitro PDF Software

Quickset64

RBVirtualFolder64Inst

Roxio Activation Module

Roxio BackOnTrack

Roxio Burn

Roxio Creator Starter

Roxio Express Labeler 3

Roxio File Backup

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

SelectionLinks

Sonic CinePlayer Decoder Pack

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Visual Studio 2010 x64 Redistributables

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Ws2k3

Yontoo 2.05

.

==== Event Viewer Messages From Past Week ========

.

3/23/2013 8:08:10 AM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

3/20/2013 5:14:15 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

3/20/2013 5:12:18 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

3/20/2013 5:09:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Bluetooth Device Monitor service.

3/20/2013 5:06:28 PM, Error: Service Control Manager [7034] - The Bluetooth Media Service service terminated unexpectedly. It has done this 1 time(s).

3/20/2013 5:06:27 PM, Error: Service Control Manager [7034] - The Bluetooth OBEX Service service terminated unexpectedly. It has done this 1 time(s).

3/19/2013 11:59:14 AM, Error: Service Control Manager [7022] - The Service Sendori service hung on starting.

3/19/2013 11:57:07 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SoftThinks Agent Service service to connect.

3/19/2013 11:57:07 AM, Error: Service Control Manager [7000] - The SoftThinks Agent Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

3/18/2013 9:11:09 PM, Error: Service Control Manager [7034] - The Application Sendori service terminated unexpectedly. It has done this 1 time(s).

3/18/2013 9:11:09 PM, Error: Service Control Manager [7031] - The Service Sendori service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1200000 milliseconds: Restart the service.

.

==== End Of File ===========================

Link to post
Share on other sites
kehoe3

kehoe3

Posted
  • Author
Posted

DDS script. sorry about previous duplication

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16521 BrowserJavaVersion: 10.10.2

Run by Dr.Denise at 10:20:33 on 2013-03-23

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6050.3717 [GMT -4:00]

.

AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

.

============== Running Processes ===============

.

C:\PROGRA~2\AVG\AVG2013\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe

C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgemca.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\DellTPad\Apoint.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\System32\rundll32.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe

C:\Users\Dr.Denise\AppData\Roaming\Yontoo\YontooDesktop.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Program Files (x86)\CyberLink\Shared files\brs.exe

C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\AVG\AVG2013\avgui.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe

C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

BHO: Coupon Companion Plugin: {11111111-1111-1111-1111-110211181104} -

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

uRun: [Yontoo Desktop] "C:\Users\Dr.Denise\AppData\Roaming\Yontoo\YontooDesktop.exe"

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"

mRun: [bDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe

mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"

mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{43F69F93-C1E0-479E-8D03-2E908C463859} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{EC22D60E-A446-4CEC-B358-C946389EC086} : DHCPNameServer = 192.168.1.1 192.168.0.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [bTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3277370&CUI=UN22204131991620872&UM=2&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - about:home

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2013-03-16 09:03; plugin@yontoo.com; C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\extensions\plugin@yontoo.com

.

---- FIREFOX POLICIES ----

user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);FF - user.js: extentions.y2layers.installId - db0790ee-9c3b-4d18-a3dd-e31098cfdcf5

FF - user.js: extentions.y2layers.defaultEnableAppsList - twittube,buzzdock,YontooNewOffers

FF - user.js: extensions.autoDisableScopes - 14

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]

R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-11-16 111968]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-12-15 55856]

R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]

R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-12-15 89600]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-16 5814904]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]

R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2010-11-3 897088]

R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2010-11-3 983104]

R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2012-12-18 376320]

R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2012-11-29 15928]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2013-1-28 72216]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-3-7 398184]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-3-7 682344]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2012-12-15 1695040]

R2 Yontoo Desktop Updater;Yontoo Desktop Updater;C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe [2013-3-16 23552]

R3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2010-11-3 1298496]

R3 bpenum;Intel® Centrino® WiMAX Enumerator;C:\Windows\System32\drivers\bpenum.sys [2012-12-15 75264]

R3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\Windows\System32\drivers\bpmp.sys [2012-12-15 173568]

R3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;C:\Windows\System32\drivers\bpusb.sys [2012-12-15 81408]

R3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\System32\drivers\btmaux.sys [2010-11-4 58128]

R3 btmhsf;btmhsf;C:\Windows\System32\drivers\btmhsf.sys [2010-10-19 274432]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2012-12-15 172704]

R3 iBtFltCoex;iBtFltCoex;C:\Windows\System32\drivers\iBtFltCoex.sys [2010-11-4 59904]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-12-15 317440]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-3-7 24176]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-12-15 406632]

R3 tihub3;TI USB3 Hub Service;C:\Windows\System32\drivers\tihub3.sys [2012-12-15 136000]

R3 tixhci;TI XHCI Service;C:\Windows\System32\drivers\tixhci.sys [2012-12-15 406336]

S2 CLKMSVC10_9EC60124;CyberLink Product - 2012/12/15 13:23:08;C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2011-8-11 248304]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

S3 AthDfu;Atheros Valkyrie USB BootROM;C:\Windows\System32\drivers\AthDfu.sys [2012-12-15 51872]

S3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\System32\drivers\btath_bus.sys [2012-12-15 28832]

S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\System32\drivers\btath_hcrp.sys [2012-12-15 201376]

S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\System32\drivers\btath_rcp.sys [2012-12-15 154272]

S3 CH341SER_A64;CH341SER_A64;C:\Windows\System32\drivers\CH341S64.SYS [2011-11-4 58368]

S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2012-12-15 158976]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2012-12-15 80384]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2012-12-15 181248]

S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2012-12-15 250984]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-12-20 1255736]

.

=============== Created Last 30 ================

.

2013-03-23 14:10:40 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\Diagnostics

2013-03-23 12:09:16 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{B04F72E8-F98F-443D-9F71-3CAD7DB9EAC9}

2013-03-22 13:24:10 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{6D8C73A6-FDCF-4DE0-B65C-371BBDD819B5}

2013-03-22 07:24:06 -------- d-sh--w- C:\$RECYCLE.BIN

2013-03-21 13:23:21 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{D55B2CEB-07DC-43F1-B011-05C7712C1131}

2013-03-20 21:08:03 98816 ----a-w- C:\Windows\sed.exe

2013-03-20 21:08:03 256000 ----a-w- C:\Windows\PEV.exe

2013-03-20 21:08:03 208896 ----a-w- C:\Windows\MBR.exe

2013-03-20 00:18:40 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{8382DEF7-E7B5-4E9F-A740-669F7366F18A}

2013-03-16 13:04:17 -------- d-sh--w- C:\Windows\SysWow64\AI_RecycleBin

2013-03-16 13:04:14 -------- d-----w- C:\ProgramData\Strongvault Online Backup

2013-03-16 13:04:09 -------- d-----w- C:\AI_RecycleBin

2013-03-16 13:03:26 -------- d-----w- C:\Users\Dr.Denise\AppData\Roaming\Yontoo

2013-03-16 13:03:26 -------- d-----w- C:\Program Files (x86)\Yontoo

2013-03-16 13:03:23 -------- d-----w- C:\ProgramData\Tarma Installer

2013-03-16 13:03:08 -------- d-----w- C:\Users\Dr.Denise\AppData\Roaming\Conduit

2013-03-14 18:47:28 -------- d-----w- C:\Program Files\Axantum

2013-03-14 18:47:21 -------- d-----w- C:\Users\Dr.Denise\AppData\Roaming\OpenCandy

2013-03-14 12:14:16 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{DA288455-5E93-46BA-A1E6-0E2B869B6C40}

2013-03-14 05:38:29 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys

2013-03-14 00:13:41 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{FCB531AB-F616-4F74-A425-6F2BBAEF7CFB}

2013-03-13 12:13:19 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{852843AE-455F-4C96-BCFB-E14A79F16BF9}

2013-03-13 00:12:57 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{6F5EC04D-E76B-4563-A9E8-01ABBC76AB8D}

2013-03-12 12:12:35 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{7FA62943-39F5-46B4-9247-F94EF3C07911}

2013-03-12 00:12:13 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{E92E3579-9830-4A99-BC69-3D83F5EF90A3}

2013-03-11 12:11:51 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{59CE31BD-D63B-4F59-9AFF-A8D6DFB5B5ED}

2013-03-11 00:11:29 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{1440513F-7732-459D-954D-4761EBAF9697}

2013-03-10 12:11:06 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{189FD092-FDAF-40E9-914A-66A6225D36F0}

2013-03-10 00:10:44 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{1E3D2A39-2605-4F3F-8030-3897E9D85EB3}

2013-03-09 12:10:22 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{C25AB087-D8B6-4494-8480-20319E57A427}

2013-03-09 00:10:00 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{AD0C1AFA-1126-449A-91CB-26684890052D}

2013-03-08 00:09:15 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{7060F469-EC66-42FB-B896-4AF4390DB5A2}

2013-03-07 19:59:16 -------- d-----w- C:\Users\Dr.Denise\AppData\Roaming\Malwarebytes

2013-03-07 19:59:09 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-03-07 19:59:09 -------- d-----w- C:\ProgramData\Malwarebytes

2013-03-07 19:59:09 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-03-07 19:58:52 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\Programs

2013-03-01 16:33:12 -------- d-----w- C:\Users\Dr.Denise\AppData\Roaming\PrimoPDF

2013-03-01 16:32:38 95008 ----a-w- C:\Windows\System32\Primomonnt.dll

2013-03-01 16:32:37 -------- d-----w- C:\Program Files (x86)\Nitro PDF

2013-03-01 00:03:54 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{D0D846FD-F582-4EA7-8D88-C4C5411D0F85}

2013-02-28 12:03:20 -------- d-----w- C:\Users\Dr.Denise\AppData\Local\{D1260281-719F-4F85-8C44-551ED92FD289}

.

==================== Find3M ====================

.

2013-03-16 13:03:03 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-03-16 13:03:03 418464 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

2013-01-13 21:17:03 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-01-13 21:17:02 2560 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-01-13 21:16:42 10752 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-01-13 21:12:46 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-01-13 21:11:21 4096 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-01-13 21:11:08 5632 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-01-13 21:11:07 5632 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-01-13 21:11:07 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-01-13 21:11:07 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-01-13 20:35:31 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-01-13 20:35:31 2560 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-01-13 20:35:18 10752 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-01-13 20:32:07 3584 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-01-13 20:31:48 4096 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-01-13 20:31:41 5632 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-01-13 20:31:40 5632 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-01-13 20:31:40 3072 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

2013-01-13 20:31:40 3072 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-01-13 20:31:00 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll

2013-01-13 20:22:22 1988096 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2013-01-13 20:20:31 293376 ----a-w- C:\Windows\SysWow64\dxgi.dll

2013-01-13 20:09:00 249856 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll

2013-01-13 20:08:43 220160 ----a-w- C:\Windows\SysWow64\d3d10core.dll

2013-01-13 20:08:35 1504768 ----a-w- C:\Windows\SysWow64\d3d11.dll

2013-01-13 19:59:04 1643520 ----a-w- C:\Windows\System32\DWrite.dll

2013-01-13 19:58:28 1175552 ----a-w- C:\Windows\System32\FntCache.dll

2013-01-13 19:54:01 604160 ----a-w- C:\Windows\SysWow64\d3d10level9.dll

2013-01-13 19:53:58 207872 ----a-w- C:\Windows\SysWow64\WindowsCodecsExt.dll

2013-01-13 19:53:14 187392 ----a-w- C:\Windows\SysWow64\UIAnimation.dll

2013-01-13 19:51:30 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll

2013-01-13 19:49:17 363008 ----a-w- C:\Windows\System32\dxgi.dll

2013-01-13 19:48:47 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll

2013-01-13 19:46:25 1080832 ----a-w- C:\Windows\SysWow64\d3d10.dll

2013-01-13 19:43:21 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll

2013-01-13 19:38:39 333312 ----a-w- C:\Windows\System32\d3d10_1core.dll

2013-01-13 19:38:32 1887232 ----a-w- C:\Windows\System32\d3d11.dll

2013-01-13 19:38:21 296960 ----a-w- C:\Windows\System32\d3d10core.dll

2013-01-13 19:37:57 3419136 ----a-w- C:\Windows\SysWow64\d2d1.dll

2013-01-13 19:25:04 245248 ----a-w- C:\Windows\System32\WindowsCodecsExt.dll

2013-01-13 19:24:33 648192 ----a-w- C:\Windows\System32\d3d10level9.dll

2013-01-13 19:24:30 221184 ----a-w- C:\Windows\System32\UIAnimation.dll

2013-01-13 19:20:42 194560 ----a-w- C:\Windows\System32\d3d10_1.dll

2013-01-13 19:20:04 1238528 ----a-w- C:\Windows\System32\d3d10.dll

2013-01-13 19:15:40 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll

2013-01-13 19:10:36 3928064 ----a-w- C:\Windows\System32\d2d1.dll

2013-01-13 19:02:06 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll

2013-01-13 18:34:58 364544 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll

2013-01-13 18:32:43 465920 ----a-w- C:\Windows\System32\WMPhoto.dll

2013-01-13 18:09:52 522752 ----a-w- C:\Windows\System32\XpsGdiConverter.dll

2013-01-13 17:26:42 1158144 ----a-w- C:\Windows\SysWow64\XpsPrint.dll

2013-01-13 17:05:09 1682432 ----a-w- C:\Windows\System32\XpsPrint.dll

2013-01-05 05:53:43 5553512 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-01-05 05:00:15 3967848 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-01-05 05:00:11 3913064 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-01-04 06:11:21 2284544 ----a-w- C:\Windows\SysWow64\msmpeg2vdec.dll

2013-01-04 06:11:13 2776576 ----a-w- C:\Windows\System32\msmpeg2vdec.dll

2013-01-04 05:46:09 215040 ----a-w- C:\Windows\System32\winsrv.dll

2013-01-04 04:51:16 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2013-01-04 04:43:21 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2013-01-04 03:26:48 3153408 ----a-w- C:\Windows\System32\win32k.sys

2013-01-04 02:47:35 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2013-01-04 02:47:34 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2013-01-04 02:47:34 2048 ----a-w- C:\Windows\SysWow64\user.exe

2013-01-04 02:47:33 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2013-01-03 20:26:45 95184 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-01-03 20:26:45 859072 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2013-01-03 20:26:45 779704 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2013-01-03 06:00:54 1913192 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-01-03 06:00:42 288088 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

.

============= FINISH: 10:20:51.62 ===============

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, that's better...Thank You

Yontoo 2.05 is listed in your add/remove programs, have you tried to uninstall it?

If not please do and then.......

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

MrC

Link to post
Share on other sites
kehoe3

kehoe3

Posted
  • Author
Posted

Thanks for the fast response. The program will not allow it to be uninstalled. It give some sort of an error message. Here is the log you requested.

# AdwCleaner v2.115 - Logfile created 03/23/2013 at 11:41:37

# Updated 17/03/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Dr.Denise - MININT-Q8NKKCV

# Boot Mode : Normal

# Running from : C:\Users\Dr.Denise\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

Found : Yontoo Desktop Updater

***** [Files / Folders] *****

File Found : C:\END

File Found : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\searchplugins\Askcom.xml

Folder Found : C:\Program Files (x86)\Coupon Companion Plugin

Folder Found : C:\Program Files (x86)\OApps

Folder Found : C:\Program Files (x86)\Yontoo

Folder Found : C:\ProgramData\Ask

Folder Found : C:\ProgramData\Tarma Installer

Folder Found : C:\Users\Dr.Denise\AppData\Local\Coupon Companion Plugin

Folder Found : C:\Users\Dr.Denise\AppData\Local\Wajam

Folder Found : C:\Users\Dr.Denise\AppData\Roaming\Conduit

Folder Found : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\extensions\plugin@selectionlinks.com

Folder Found : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\extensions\plugin@yontoo.com

Folder Found : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\Smartbar

Folder Found : C:\Users\Dr.Denise\AppData\Roaming\OpenCandy

Folder Found : C:\Users\Dr.Denise\AppData\Roaming\Yontoo

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Crossrider

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\InstalledBrowserExtensions

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110211181104}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110211181104}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO

Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox

Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox.1

Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211181104}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110211181104}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181104}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211181104}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110211181104}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16521

[OK] Registry is clean.

-\\ Mozilla Firefox v19.0.2 (en-US)

File : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\prefs.js

Found : user_pref("CT3277370.1000082.isPlayDisplay", "true");

Found : user_pref("CT3277370.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Found : user_pref("CT3277370.1000234.TWC_TMP_city", "TAMPA");

Found : user_pref("CT3277370.1000234.TWC_TMP_country", "US");

Found : user_pref("CT3277370.1000234.TWC_country", "UNITED STATES");

Found : user_pref("CT3277370.1000234.TWC_locId", "USFL0481");

Found : user_pref("CT3277370.1000234.TWC_location", "Tampa, FL");

Found : user_pref("CT3277370.1000234.TWC_region", "US");

Found : user_pref("CT3277370.1000234.TWC_temp_dis", "f");

Found : user_pref("CT3277370.1000234.TWC_wind_dis", "mph");

Found : user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"26.png\",\"temperature\":\"67°F\",\"temperat[...]

Found : user_pref("CT3277370.CT3277370ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyODcyODglMj[...]

Found : user_pref("CT3277370.CT3277370current_term.enc", "");

Found : user_pref("CT3277370.CT3277370sdate.enc", "MjA=");

Found : user_pref("CT3277370.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3277370.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Found : user_pref("CT3277370.FF19Solved", "true");

Found : user_pref("CT3277370.FirstTime", "true");

Found : user_pref("CT3277370.FirstTimeFF3", "true");

Found : user_pref("CT3277370.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT327[...]

Found : user_pref("CT3277370.UserID", "UN22204131991620872");

Found : user_pref("CT3277370.addressBarTakeOverEnabledInHidden", "true");

Found : user_pref("CT3277370.autoDisableScopes", 0);

Found : user_pref("CT3277370.browser.search.defaultthis.engineName", "true");

Found : user_pref("CT3277370.defaultSearch", "true");

Found : user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"cross[...]

Found : user_pref("CT3277370.enableAlerts", "always");

Found : user_pref("CT3277370.enableFix404ByUser", "FALSE");

Found : user_pref("CT3277370.enableSearchFromAddressBar", "true");

Found : user_pref("CT3277370.firstTimeDialogOpened", "true");

Found : user_pref("CT3277370.fixPageNotFoundError", "true");

Found : user_pref("CT3277370.fixPageNotFoundErrorByUser", "true");

Found : user_pref("CT3277370.fixPageNotFoundErrorInHidden", "true");

Found : user_pref("CT3277370.fixUrls", true);

Found : user_pref("CT3277370.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");

Found : user_pref("CT3277370.installDate", "16/3/2013 9:02:45");

Found : user_pref("CT3277370.installId", "stub.exe");

Found : user_pref("CT3277370.installType", "conduitnsisintegration");

Found : user_pref("CT3277370.installerVersion", "1.3.6.5");

Found : user_pref("CT3277370.isCheckedStartAsHidden", true);

Found : user_pref("CT3277370.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3277370.isFirstTimeToolbarLoading", "false");

Found : user_pref("CT3277370.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Found : user_pref("CT3277370.keyword", "true");

Found : user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

Found : user_pref("CT3277370.lastVersion", "10.14.65.43");

Found : user_pref("CT3277370.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Found : user_pref("CT3277370.migrateAppsAndComponents", true);

Found : user_pref("CT3277370.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

Found : user_pref("CT3277370.openThankYouPage", "false");

Found : user_pref("CT3277370.openUninstallPage", "true");

Found : user_pref("CT3277370.revertSettingsEnabled", "false");

Found : user_pref("CT3277370.search.searchAppId", "130021582164426878");

Found : user_pref("CT3277370.search.searchCount", "0");

Found : user_pref("CT3277370.searchFromAddressBarEnabledByUser", "true");

Found : user_pref("CT3277370.searchInNewTabEnabledByUser", "true");

Found : user_pref("CT3277370.searchInNewTabEnabledInHidden", "true");

Found : user_pref("CT3277370.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3277370.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Found : user_pref("CT3277370.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Found : user_pref("CT3277370.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1363438992932");

Found : user_pref("CT3277370.serviceLayer_services_appsMetadata_lastUpdate", "1363707364344");

Found : user_pref("CT3277370.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1363438992786");

Found : user_pref("CT3277370.serviceLayer_services_location_lastUpdate", "1363698276939");

Found : user_pref("CT3277370.serviceLayer_services_login_10.14.65.43_lastUpdate", "1363698204290");

Found : user_pref("CT3277370.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1363438992828");

Found : user_pref("CT3277370.serviceLayer_services_searchAPI_lastUpdate", "1363698276972");

Found : user_pref("CT3277370.serviceLayer_services_serviceMap_lastUpdate", "1363698276787");

Found : user_pref("CT3277370.serviceLayer_services_setupAPI_lastUpdate", "1363698277059");

Found : user_pref("CT3277370.serviceLayer_services_toolbarContextMenu_lastUpdate", "1363438992754");

Found : user_pref("CT3277370.serviceLayer_services_toolbarSettings_lastUpdate", "1363707364408");

Found : user_pref("CT3277370.serviceLayer_services_translation_lastUpdate", "1363698199231");

Found : user_pref("CT3277370.settingsINI", true);

Found : user_pref("CT3277370.shouldFirstTimeDialog", "false");

Found : user_pref("CT3277370.smartbar.CTID", "CT3277370");

Found : user_pref("CT3277370.smartbar.Uninstall", "0");

Found : user_pref("CT3277370.smartbar.homepage", true);

Found : user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 ");

Found : user_pref("CT3277370.startPage", "true");

Found : user_pref("CT3277370.toolbarBornServerTime", "16-3-2013");

Found : user_pref("CT3277370.toolbarCurrentServerTime", "19-3-2013");

Found : user_pref("CT3277370_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3277370&CUI=UN22204131[...]

Found : user_pref("Smartbar.ConduitSearchEngineList", "");

Found : user_pref("Smartbar.ConduitSearchUrlList", "");

Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3277370");

Found : user_pref("browser.search.defaultthis.engineName", "InternetHelper3 Customized Web Search");

Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3277370&CUI[...]

Found : user_pref("browser.search.order.1", "Ask.com");

Found : user_pref("extensions.crossriderapp21804.adsOldValue", -1);

Found : user_pref("extentions.y2layers.defaultEnableAppsList", "twittube,buzzdock,YontooNewOffers");

Found : user_pref("extentions.y2layers.installId", "db0790ee-9c3b-4d18-a3dd-e31098cfdcf5");

Found : user_pref("smartBar.searchInNewTabOwner", "CT3277370");

Found : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3277370&octid=CT3277370[...]

Found : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]

Found : user_pref("smartbar.originalHomepage", "about:home");

Found : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT327[...]

Found : user_pref("smartbar.originalSearchEngine", "Google");

*************************

AdwCleaner[R1].txt - [13780 octets] - [23/03/2013 11:41:37]

########## EOF - C:\AdwCleaner[R1].txt - [13841 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please create a new system restore point before continuing.

Lots of adware found....lets clear it out.....

  1. Please re-run AdwCleaner
  2. Click on Delete button.
  3. Confirm each time with OK if asked.
  4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

Link to post
Share on other sites
kehoe3

kehoe3

Posted
  • Author
Posted

# AdwCleaner v2.115 - Logfile created 03/23/2013 at 11:54:22

# Updated 17/03/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Dr.Denise - MININT-Q8NKKCV

# Boot Mode : Normal

# Running from : C:\Users\Dr.Denise\Downloads\adwcleaner.exe

# Option [Delete]

***** [services] *****

Stopped & Deleted : Yontoo Desktop Updater

***** [Files / Folders] *****

File Deleted : C:\END

File Deleted : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\searchplugins\Askcom.xml

Folder Deleted : C:\Program Files (x86)\Coupon Companion Plugin

Folder Deleted : C:\Program Files (x86)\OApps

Folder Deleted : C:\Program Files (x86)\Yontoo

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\Users\Dr.Denise\AppData\Local\Coupon Companion Plugin

Folder Deleted : C:\Users\Dr.Denise\AppData\Local\Wajam

Folder Deleted : C:\Users\Dr.Denise\AppData\Roaming\Conduit

Folder Deleted : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\extensions\plugin@selectionlinks.com

Folder Deleted : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\extensions\plugin@yontoo.com

Folder Deleted : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\Smartbar

Folder Deleted : C:\Users\Dr.Denise\AppData\Roaming\OpenCandy

Folder Deleted : C:\Users\Dr.Denise\AppData\Roaming\Yontoo

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\InstalledBrowserExtensions

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110211181104}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110211181104}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox.1

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211181104}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110211181104}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181104}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211181104}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110211181104}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16521

[OK] Registry is clean.

-\\ Mozilla Firefox v19.0.2 (en-US)

File : C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\prefs.js

C:\Users\Dr.Denise\AppData\Roaming\Mozilla\Firefox\Profiles\0qkjfso3.default\user.js ... Deleted !

Deleted : user_pref("CT3277370.1000082.isPlayDisplay", "true");

Deleted : user_pref("CT3277370.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Deleted : user_pref("CT3277370.1000234.TWC_TMP_city", "TAMPA");

Deleted : user_pref("CT3277370.1000234.TWC_TMP_country", "US");

Deleted : user_pref("CT3277370.1000234.TWC_country", "UNITED STATES");

Deleted : user_pref("CT3277370.1000234.TWC_locId", "USFL0481");

Deleted : user_pref("CT3277370.1000234.TWC_location", "Tampa, FL");

Deleted : user_pref("CT3277370.1000234.TWC_region", "US");

Deleted : user_pref("CT3277370.1000234.TWC_temp_dis", "f");

Deleted : user_pref("CT3277370.1000234.TWC_wind_dis", "mph");

Deleted : user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"26.png\",\"temperature\":\"67°F\",\"temperat[...]

Deleted : user_pref("CT3277370.CT3277370ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyODcyODglMj[...]

Deleted : user_pref("CT3277370.CT3277370current_term.enc", "");

Deleted : user_pref("CT3277370.CT3277370sdate.enc", "MjA=");

Deleted : user_pref("CT3277370.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3277370.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Deleted : user_pref("CT3277370.FF19Solved", "true");

Deleted : user_pref("CT3277370.FirstTime", "true");

Deleted : user_pref("CT3277370.FirstTimeFF3", "true");

Deleted : user_pref("CT3277370.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT327[...]

Deleted : user_pref("CT3277370.UserID", "UN22204131991620872");

Deleted : user_pref("CT3277370.addressBarTakeOverEnabledInHidden", "true");

Deleted : user_pref("CT3277370.autoDisableScopes", 0);

Deleted : user_pref("CT3277370.browser.search.defaultthis.engineName", "true");

Deleted : user_pref("CT3277370.defaultSearch", "true");

Deleted : user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"cross[...]

Deleted : user_pref("CT3277370.enableAlerts", "always");

Deleted : user_pref("CT3277370.enableFix404ByUser", "FALSE");

Deleted : user_pref("CT3277370.enableSearchFromAddressBar", "true");

Deleted : user_pref("CT3277370.firstTimeDialogOpened", "true");

Deleted : user_pref("CT3277370.fixPageNotFoundError", "true");

Deleted : user_pref("CT3277370.fixPageNotFoundErrorByUser", "true");

Deleted : user_pref("CT3277370.fixPageNotFoundErrorInHidden", "true");

Deleted : user_pref("CT3277370.fixUrls", true);

Deleted : user_pref("CT3277370.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");

Deleted : user_pref("CT3277370.installDate", "16/3/2013 9:02:45");

Deleted : user_pref("CT3277370.installId", "stub.exe");

Deleted : user_pref("CT3277370.installType", "conduitnsisintegration");

Deleted : user_pref("CT3277370.installerVersion", "1.3.6.5");

Deleted : user_pref("CT3277370.isCheckedStartAsHidden", true);

Deleted : user_pref("CT3277370.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3277370.isFirstTimeToolbarLoading", "false");

Deleted : user_pref("CT3277370.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Deleted : user_pref("CT3277370.keyword", "true");

Deleted : user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

Deleted : user_pref("CT3277370.lastVersion", "10.14.65.43");

Deleted : user_pref("CT3277370.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Deleted : user_pref("CT3277370.migrateAppsAndComponents", true);

Deleted : user_pref("CT3277370.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

Deleted : user_pref("CT3277370.openThankYouPage", "false");

Deleted : user_pref("CT3277370.openUninstallPage", "true");

Deleted : user_pref("CT3277370.revertSettingsEnabled", "false");

Deleted : user_pref("CT3277370.search.searchAppId", "130021582164426878");

Deleted : user_pref("CT3277370.search.searchCount", "0");

Deleted : user_pref("CT3277370.searchFromAddressBarEnabledByUser", "true");

Deleted : user_pref("CT3277370.searchInNewTabEnabledByUser", "true");

Deleted : user_pref("CT3277370.searchInNewTabEnabledInHidden", "true");

Deleted : user_pref("CT3277370.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3277370.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Deleted : user_pref("CT3277370.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Deleted : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Deleted : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Deleted : user_pref("CT3277370.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1363438992932");

Deleted : user_pref("CT3277370.serviceLayer_services_appsMetadata_lastUpdate", "1363707364344");

Deleted : user_pref("CT3277370.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1363438992786");

Deleted : user_pref("CT3277370.serviceLayer_services_location_lastUpdate", "1363698276939");

Deleted : user_pref("CT3277370.serviceLayer_services_login_10.14.65.43_lastUpdate", "1363698204290");

Deleted : user_pref("CT3277370.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1363438992828");

Deleted : user_pref("CT3277370.serviceLayer_services_searchAPI_lastUpdate", "1363698276972");

Deleted : user_pref("CT3277370.serviceLayer_services_serviceMap_lastUpdate", "1363698276787");

Deleted : user_pref("CT3277370.serviceLayer_services_setupAPI_lastUpdate", "1363698277059");

Deleted : user_pref("CT3277370.serviceLayer_services_toolbarContextMenu_lastUpdate", "1363438992754");

Deleted : user_pref("CT3277370.serviceLayer_services_toolbarSettings_lastUpdate", "1363707364408");

Deleted : user_pref("CT3277370.serviceLayer_services_translation_lastUpdate", "1363698199231");

Deleted : user_pref("CT3277370.settingsINI", true);

Deleted : user_pref("CT3277370.shouldFirstTimeDialog", "false");

Deleted : user_pref("CT3277370.smartbar.CTID", "CT3277370");

Deleted : user_pref("CT3277370.smartbar.Uninstall", "0");

Deleted : user_pref("CT3277370.smartbar.homepage", true);

Deleted : user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 ");

Deleted : user_pref("CT3277370.startPage", "true");

Deleted : user_pref("CT3277370.toolbarBornServerTime", "16-3-2013");

Deleted : user_pref("CT3277370.toolbarCurrentServerTime", "19-3-2013");

Deleted : user_pref("CT3277370_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3277370&CUI=UN22204131[...]

Deleted : user_pref("Smartbar.ConduitSearchEngineList", "");

Deleted : user_pref("Smartbar.ConduitSearchUrlList", "");

Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3277370");

Deleted : user_pref("browser.search.defaultthis.engineName", "InternetHelper3 Customized Web Search");

Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3277370&CUI[...]

Deleted : user_pref("browser.search.order.1", "Ask.com");

Deleted : user_pref("extensions.crossriderapp21804.adsOldValue", -1);

Deleted : user_pref("extentions.y2layers.defaultEnableAppsList", "twittube,buzzdock,YontooNewOffers");

Deleted : user_pref("extentions.y2layers.installId", "db0790ee-9c3b-4d18-a3dd-e31098cfdcf5");

Deleted : user_pref("smartBar.searchInNewTabOwner", "CT3277370");

Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3277370&octid=CT3277370[...]

Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]

Deleted : user_pref("smartbar.originalHomepage", "about:home");

Deleted : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT327[...]

Deleted : user_pref("smartbar.originalSearchEngine", "Google");

*************************

AdwCleaner[R1].txt - [13905 octets] - [23/03/2013 11:41:37]

AdwCleaner[s1].txt - [14001 octets] - [23/03/2013 11:54:22]

########## EOF - C:\AdwCleaner[s1].txt - [14062 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Great :)

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!

MrC

Link to post
Share on other sites
kehoe3

kehoe3

Posted
  • Author
Posted

Results of screen317's Security Check version 0.99.61

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

AVG AntiVirus Free Edition 2013

Antivirus up to date! (On Access scanning disabled!)

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.70.0.1100

Java 7 Update 10

Java version out of Date!

Adobe Flash Player 11.6.602.180

Adobe Reader 10.0.1 Adobe Reader out of Date!

Mozilla Firefox (19.0.2)

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

AVG avgwdsvc.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Java 7 Update 10 <---Please update, should be Update 17

Java version out of Date! <--------Go to control panel > Java > Update Tab > Update Now

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

If there's no update tab in Java, uninstall it and Download and install the latest version from Here

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

Adobe Reader 10.0.1 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe.

--------------------

You have out dated programs on the system which are vulnerable to malware.

Please update or uninstall them

Info on doing that can be found in my Preventive Maintenance

~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.