major help.. Hearing ads..but not seeing them..

[PennsylvaniaMercury]

I hear random audio of ads playing on my computer. i only built this thing in oct... please help. it's random and getting extremly annoying.. i can be trying to play a game and all of a sudden i hear. "please click on an image" over and over, then ads for sears and smartphones... but yet when i go to desktop, there are no ads... just the audio from them...

blah. help.

Windows 7

AMD triple core processor..

can give all specs if needed..

[MrCharlie]

Welcome to the forum, please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic:

Click on the

Follow This Topic Button

(at the top right of this page), make sure that the

Receive notification

box is checked and that it is set to

Instantly

Removing malware can be unpredictable

...things can go very wrong!

Backup

any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>

Please stick with me until I give you the "all clear" and

Please don't waste my time by leaving before that

.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[PennsylvaniaMercury]

first is the malwarebytes log.

second is DDS log

attached as a zip is attach.txt.

2013/06/12 22:18:16 -0500 JUSTIN-PC Justin MESSAGE Starting protection

2013/06/12 22:18:16 -0500 JUSTIN-PC Justin MESSAGE Protection started successfully

2013/06/12 22:18:16 -0500 JUSTIN-PC Justin MESSAGE Starting IP protection

2013/06/12 22:19:07 -0500 JUSTIN-PC Justin MESSAGE IP Protection started successfully

2013/06/12 22:19:21 -0500 JUSTIN-PC Justin MESSAGE Starting database refresh

2013/06/12 22:19:21 -0500 JUSTIN-PC Justin MESSAGE Stopping IP protection

2013/06/12 22:19:30 -0500 JUSTIN-PC Justin MESSAGE IP Protection stopped successfully

2013/06/12 22:19:34 -0500 JUSTIN-PC Justin MESSAGE Database refreshed successfully

2013/06/12 22:19:34 -0500 JUSTIN-PC Justin MESSAGE Starting IP protection

2013/06/12 22:19:43 -0500 JUSTIN-PC Justin MESSAGE IP Protection started successfully

2013/06/12 22:21:14 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.185 (Type: outgoing, Port: 53821, Process: svchost.exe)

2013/06/12 22:21:22 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.191 (Type: outgoing, Port: 53822, Process: svchost.exe)

2013/06/12 22:21:30 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.189 (Type: outgoing, Port: 53823, Process: svchost.exe)

2013/06/12 22:21:38 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.188 (Type: outgoing, Port: 53824, Process: svchost.exe)

2013/06/12 22:21:55 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 53825, Process: svchost.exe)

2013/06/12 22:22:03 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.94 (Type: outgoing, Port: 53826, Process: svchost.exe)

2013/06/12 22:22:11 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.191 (Type: outgoing, Port: 53827, Process: svchost.exe)

2013/06/12 22:22:19 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.192 (Type: outgoing, Port: 53828, Process: svchost.exe)

2013/06/12 22:22:35 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.186 (Type: outgoing, Port: 53829, Process: svchost.exe)

2013/06/12 22:22:43 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.87 (Type: outgoing, Port: 53830, Process: svchost.exe)

2013/06/12 22:22:51 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.185 (Type: outgoing, Port: 53831, Process: svchost.exe)

2013/06/12 22:22:59 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.88 (Type: outgoing, Port: 53832, Process: svchost.exe)

2013/06/12 22:23:16 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.89 (Type: outgoing, Port: 53834, Process: svchost.exe)

2013/06/12 22:23:24 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 53835, Process: svchost.exe)

2013/06/12 22:23:32 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.185 (Type: outgoing, Port: 53836, Process: svchost.exe)

2013/06/12 22:23:40 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.186 (Type: outgoing, Port: 53837, Process: svchost.exe)

2013/06/12 22:23:56 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.190 (Type: outgoing, Port: 53838, Process: svchost.exe)

2013/06/12 22:24:04 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.190 (Type: outgoing, Port: 53839, Process: svchost.exe)

2013/06/12 22:24:12 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.91 (Type: outgoing, Port: 53840, Process: svchost.exe)

2013/06/12 22:24:21 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.91 (Type: outgoing, Port: 53873, Process: svchost.exe)

2013/06/12 22:24:37 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.189 (Type: outgoing, Port: 53876, Process: svchost.exe)

2013/06/12 22:24:45 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.88 (Type: outgoing, Port: 53885, Process: svchost.exe)

2013/06/12 22:24:53 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.191 (Type: outgoing, Port: 53940, Process: svchost.exe)

2013/06/12 22:25:01 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.185 (Type: outgoing, Port: 54011, Process: svchost.exe)

2013/06/12 22:25:17 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 54012, Process: svchost.exe)

2013/06/12 22:25:25 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.87 (Type: outgoing, Port: 54013, Process: svchost.exe)

2013/06/12 22:25:34 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.192 (Type: outgoing, Port: 54014, Process: svchost.exe)

2013/06/12 22:25:42 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 54019, Process: svchost.exe)

2013/06/12 22:25:50 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 54021, Process: svchost.exe)

2013/06/12 22:26:06 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 54025, Process: svchost.exe)

2013/06/12 22:26:14 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 54026, Process: svchost.exe)

2013/06/12 22:26:22 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.91 (Type: outgoing, Port: 54027, Process: svchost.exe)

2013/06/12 22:26:30 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.94 (Type: outgoing, Port: 54028, Process: svchost.exe)

2013/06/12 22:26:46 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.86 (Type: outgoing, Port: 54029, Process: svchost.exe)

2013/06/12 22:26:54 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.87 (Type: outgoing, Port: 54030, Process: svchost.exe)

2013/06/12 22:27:03 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.89 (Type: outgoing, Port: 54033, Process: svchost.exe)

2013/06/12 22:27:11 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.86 (Type: outgoing, Port: 54041, Process: svchost.exe)

2013/06/12 22:27:27 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.85 (Type: outgoing, Port: 54042, Process: svchost.exe)

2013/06/12 22:27:37 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.189 (Type: outgoing, Port: 54043, Process: svchost.exe)

2013/06/12 22:27:45 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.190 (Type: outgoing, Port: 54044, Process: svchost.exe)

2013/06/12 22:27:53 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.161 (Type: outgoing, Port: 54045, Process: svchost.exe)

2013/06/12 22:28:01 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.91 (Type: outgoing, Port: 54049, Process: svchost.exe)

2013/06/12 22:28:17 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 54050, Process: svchost.exe)

2013/06/12 22:28:25 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.84 (Type: outgoing, Port: 54051, Process: svchost.exe)

2013/06/12 22:28:33 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.94 (Type: outgoing, Port: 54052, Process: svchost.exe)

2013/06/12 22:28:41 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.86 (Type: outgoing, Port: 54057, Process: svchost.exe)

2013/06/12 22:28:57 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 54058, Process: svchost.exe)

2013/06/12 22:29:05 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.83 (Type: outgoing, Port: 54061, Process: svchost.exe)

2013/06/12 22:29:13 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.161 (Type: outgoing, Port: 54062, Process: svchost.exe)

2013/06/12 22:29:21 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 54063, Process: svchost.exe)

2013/06/12 22:29:38 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.89 (Type: outgoing, Port: 54064, Process: svchost.exe)

2013/06/12 22:29:46 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.190 (Type: outgoing, Port: 54065, Process: svchost.exe)

2013/06/12 22:29:54 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.85 (Type: outgoing, Port: 54066, Process: svchost.exe)

2013/06/12 22:30:02 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.89 (Type: outgoing, Port: 54070, Process: svchost.exe)

2013/06/12 22:30:18 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.90 (Type: outgoing, Port: 54071, Process: svchost.exe)

2013/06/12 22:30:26 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.190 (Type: outgoing, Port: 54072, Process: svchost.exe)

2013/06/12 22:30:34 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.191 (Type: outgoing, Port: 54074, Process: svchost.exe)

2013/06/12 22:30:42 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.83 (Type: outgoing, Port: 54077, Process: svchost.exe)

2013/06/12 22:30:58 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.92 (Type: outgoing, Port: 54078, Process: svchost.exe)

2013/06/12 22:31:06 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.161 (Type: outgoing, Port: 54081, Process: svchost.exe)

2013/06/12 22:31:15 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.186 (Type: outgoing, Port: 54082, Process: svchost.exe)

2013/06/12 22:31:23 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.187 (Type: outgoing, Port: 54083, Process: svchost.exe)

2013/06/12 22:31:39 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.187 (Type: outgoing, Port: 54084, Process: svchost.exe)

2013/06/12 22:31:47 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.185 (Type: outgoing, Port: 54085, Process: svchost.exe)

2013/06/12 22:31:55 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.92 (Type: outgoing, Port: 54086, Process: svchost.exe)

2013/06/12 22:32:03 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.189 (Type: outgoing, Port: 54089, Process: svchost.exe)

2013/06/12 22:32:19 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.89 (Type: outgoing, Port: 54090, Process: svchost.exe)

2013/06/12 22:32:27 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.92 (Type: outgoing, Port: 54091, Process: svchost.exe)

2013/06/12 22:32:35 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.192 (Type: outgoing, Port: 54092, Process: svchost.exe)

2013/06/12 22:32:43 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 54093, Process: svchost.exe)

2013/06/12 22:32:51 -0500 JUSTIN-PC Justin MESSAGE Executing scheduled update: Daily

2013/06/12 22:32:52 -0500 JUSTIN-PC Justin MESSAGE Database already up-to-date

2013/06/12 22:32:59 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.186 (Type: outgoing, Port: 54097, Process: svchost.exe)

2013/06/12 22:33:07 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.91 (Type: outgoing, Port: 54105, Process: svchost.exe)

2013/06/12 22:33:15 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.92 (Type: outgoing, Port: 54106, Process: svchost.exe)

2013/06/12 22:33:23 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.192 (Type: outgoing, Port: 54107, Process: svchost.exe)

2013/06/12 22:33:39 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 54108, Process: svchost.exe)

2013/06/12 22:33:47 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.94 (Type: outgoing, Port: 54112, Process: svchost.exe)

2013/06/12 22:33:55 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.184 (Type: outgoing, Port: 54113, Process: svchost.exe)

2013/06/12 22:34:03 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.192 (Type: outgoing, Port: 54122, Process: svchost.exe)

2013/06/12 22:34:27 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.84 (Type: outgoing, Port: 54124, Process: svchost.exe)

2013/06/12 22:34:35 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.42.190 (Type: outgoing, Port: 54127, Process: svchost.exe)

2013/06/12 22:34:43 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.86 (Type: outgoing, Port: 54128, Process: svchost.exe)

2013/06/12 22:34:51 -0500 JUSTIN-PC Justin IP-BLOCK 46.249.61.85 (Type: outgoing, Port: 54129, Process: svchost.exe)

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 9.0.8112.16448 BrowserJavaVersion: 10.7.2

Run by Justin at 22:30:46 on 2013-06-12

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3326.1609 [GMT -5:00]

.

AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}

FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\SearchProtect\bin\CltMngSvc.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

C:\ProgramData\Search Protection\SearchProtection.exe

C:\Users\Justin\AppData\Roaming\SearchProtect\bin\cltmng.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\DllHost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\config\systemprofile\AppData\Local\svcxdcl32.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k HPService

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.conduit.com/?ctid=CT3298566&octid=CT3298566&SearchSource=61&CUI=UN31536682011716921&UM=2&UP=SPA124526E-1DC6-40DA-98BE-A8BD05E2C1C8

uSearch Bar = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

uSearch Page = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

uSearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll

BHO: Ad-Aware Security Add-on: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll

BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file>

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Ad-Aware Security Add-on: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [searchProtect] c:\users\justin\appdata\roaming\searchprotect\bin\cltmng.exe

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [searchProtectAll] c:\program files\searchprotect\bin\cltmng.exe

mRun: [PCFixSpeed] "c:\program files\pcfixspeed\PCFixTray.exe" /startup

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Ad-Aware Browsing Protection] "c:\programdata\ad-aware browsing protection\adawarebp.exe"

mRun: [search Protection] c:\programdata\search protection\SearchProtection.exe

mRun: [Ad-Aware Antivirus] "c:\program files\ad-aware antivirus\AdAwareLauncher" --windows-run

mRun: [sBRegRebootCleaner] "c:\program files\ad-aware antivirus\SBRC.exe"

mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

dRun: [svc2dll] c:\windows\system32\config\systemprofile\appdata\local\svcxdcl32.exe

StartupFolder: c:\users\justin\appdata\roaming\microsoft\windows\start menu\programs\startup\8ef6e5fbcf93c20a9c240921a52d8776.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.318\SSScheduler.exe

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: Download with Xilisoft Download YouTube Video - c:\program files\xilisoft\download youtube video\upod_link.HTM

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TCP: NameServer = 75.75.76.76 75.75.75.75

TCP: Interfaces\{DEC9E41B-F26D-4781-97A0-FE223B874FBB} : DHCPNameServer = 75.75.76.76 75.75.75.75

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\27.0.1453.110\installer\chrmstp.exe" --configure-user-settings --

verbose-logging --system-level --multi-install --chrome

.

============= SERVICES / DRIVERS ===============

.

R0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-6-12 13560]

R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [2012-10-3 19056]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-10-3 242240]

R2 Ad-Aware Service;Ad-Aware Service;c:\program files\ad-aware antivirus\AdAwareService.exe [2013-3-18 1236336]

R2 CltMngSvc;Search Protect by Conduit Updater;c:\program files\searchprotect\bin\CltMngSvc.exe [2013-5-8 97056]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-6-12 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-6-12 701512]

R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2012-9-12 66344]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2009-9-27 240232]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2012-10-3 88176]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-6-12 22856]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-6-12 40776]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912]

S2 SBAMSvc;Ad-Aware;c:\program files\ad-aware antivirus\SBAMSvc.exe [2012-9-20 3677000]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]

S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [2013-5-13 25728]

S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]

S3 gfiark;gfiark;c:\windows\system32\drivers\gfiark.sys [2013-6-12 41584]

S3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [2013-5-13 9216]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.318\McCHSvc.exe [2013-2-5 235216]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]

S3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\Synth3dVsc.sys [2010-11-20 77184]

S3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-20 52224]

S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]

S3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2012-9-13 1343400]

.

=============== Created Last 30 ================

.

2013-06-13 03:18:01 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-06-13 03:18:01 -------- d-----w- c:\users\justin\appdata\roaming\Malwarebytes

2013-06-13 03:17:48 -------- d-----w- c:\programdata\Malwarebytes

2013-06-13 03:17:47 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-06-13 03:17:47 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware

2013-06-13 03:17:26 -------- d-----w- c:\users\justin\appdata\local\Programs

2013-06-13 03:15:26 140288 -c--a-w- C:\2589202.exe

2013-06-13 02:50:23 41584 ----a-w- c:\windows\system32\drivers\gfiark.sys

2013-06-13 02:38:57 -------- d-----w- c:\users\justin\appdata\local\ElevatedDiagnostics

2013-06-13 02:37:33 -------- d-----w- c:\programdata\Ad-Aware Antivirus

2013-06-11 06:54:23 -------- dc----w- c:\program files\SpeedFan

2013-06-11 06:54:10 -------- d-----w- c:\windows\system32\searchplugins

2013-06-11 06:54:10 -------- d-----w- c:\windows\system32\Extensions

2013-06-08 21:17:39 -------- d-----w- c:\programdata\McAfee Security Scan

2013-06-08 21:17:34 -------- dc----w- c:\program files\McAfee Security Scan

2013-06-08 20:08:25 -------- d-----w- c:\users\justin\appdata\local\Rockstar Games

2013-06-08 19:41:19 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2013-05-30 03:46:56 -------- d-----w- c:\users\justin\.thumbnails

2013-05-30 03:25:04 -------- d-----w- c:\users\justin\appdata\local\fontconfig

2013-05-30 03:25:02 -------- d-----w- c:\users\justin\appdata\local\gegl-0.2

2013-05-30 03:25:02 -------- d-----w- c:\users\justin\.gimp-2.8

2013-05-30 03:23:58 -------- dc----w- c:\program files\GimpShop

2013-05-30 03:22:44 -------- d-----w- c:\users\justin\appdata\roaming\PCFixSpeed

2013-05-30 03:22:43 -------- d-----w- c:\programdata\PCFixSpeed

2013-05-30 03:21:50 -------- dc----w- c:\program files\Conduit

2013-05-30 03:21:42 -------- d-----w- c:\users\justin\appdata\local\Conduit

2013-05-30 03:21:23 -------- dc----w- c:\program files\SearchProtect

2013-05-30 03:21:05 -------- d-----w- c:\users\justin\appdata\roaming\SearchProtect

2013-05-30 03:21:03 -------- d-----w- c:\users\justin\appdata\local\CRE

2013-05-26 21:45:42 -------- d-----w- c:\users\justin\appdata\roaming\VampireSagaHL

2013-05-26 21:45:41 -------- d-----w- c:\programdata\AlawarWrapper

2013-05-26 21:02:15 -------- dc----w- c:\program files\Viva Media Game Center

2013-05-23 18:34:20 -------- dc----w- c:\program files\Street Legal Racing - Redline

2013-05-23 18:27:27 -------- d-----w- c:\users\justin\appdata\local\NFS Underground 2

2013-05-23 18:09:47 -------- dc----w- c:\program files\EA GAMES

2013-05-23 17:26:45 -------- d-----w- c:\programdata\NFS Underground

2013-05-23 17:21:46 -------- dc----w- c:\program files\Portable

2013-05-19 11:23:19 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{552a706f-1fe4-47d3-b061-402197b885ba}\offreg.dll

2013-05-15 21:03:16 -------- d-----w- c:\users\justin\appdata\local\Nancy Drew

2013-05-15 20:57:14 -------- dc----w- c:\program files\Nancy Drew

.

==================== Find3M ====================

.

2013-06-13 02:28:02 13560 ----a-w- c:\windows\system32\drivers\gfibto.sys

.

============= FINISH: 22:31:11.66 ===============

Attach.zip

[PennsylvaniaMercury]

RougeKiller log..

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : Justin [Admin rights]

Mode : Scan -- Date : 06/12/2013 22:40:43

| ARK || FAK || MBR |

¤¤¤ Bad processes : 3 ¤¤¤

[sUSP PATH] SearchProtection.exe -- C:\ProgramData\Search Protection\SearchProtection.exe [7] -> KILLED [TermProc]

[sUSP PATH] cltmng.exe -- C:\Users\Justin\AppData\Roaming\SearchProtect\bin\cltmng.exe [7] -> KILLED [TermProc]

[sUSP PATH] svcxdcl32.exe -- C:\Windows\System32\config\systemprofile\AppData\Local\svcxdcl32.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 9 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : SearchProtect (C:\Users\Justin\AppData\Roaming\SearchProtect\bin\cltmng.exe) [7] -> FOUND

[RUN][sUSP PATH] HKLM\[...]\Run : Search Protection (C:\ProgramData\Search Protection\SearchProtection.exe) [7] -> FOUND

[RUN][sUSP PATH] HKUS\.DEFAULT[...]\Run : Svc2dll (C:\Windows\System32\config\systemprofile\AppData\Local\svcxdcl32.exe) [-] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-2796156219-500140081-3362875990-1000[...]\Run : SearchProtect (C:\Users\Justin\AppData\Roaming\SearchProtect\bin\cltmng.exe) [7] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-18[...]\Run : Svc2dll (C:\Windows\System32\config\systemprofile\AppData\Local\svcxdcl32.exe) [-] -> FOUND

[TASK][sUSP PATH] DSite.job : C:\Users\Justin\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe /Check [-] -> FOUND

[TASK][sUSP PATH] DSite : C:\Users\Justin\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe /Check [-] -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG SP2004C ATA Device +++++

--- User ---

[MBR] ca0ecb331c9083ef23465ae312b02d5b

[bSP] 66ea49a97b20ef3eecde3787a2414395 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 190680 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] e14fefbe84fae9cd0008e82d7c7da3f5

[bSP] 5d025e3736f1a099bde4170d58df41a2 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 190680 Mo

+++++ PhysicalDrive1: +++++

Error reading User MBR!

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_06122013_02d2240.txt >>

RKreport[1]_S_06122013_02d2240.txt

[MrCharlie]

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKCU\[...]\Run : SearchProtect (C:\Users\Justin\AppData\Roaming\SearchProtect\bin\cltmng.exe) [7] -> FOUND

[RUN][sUSP PATH] HKLM\[...]\Run : Search Protection (C:\ProgramData\Search Protection\SearchProtection.exe) [7] -> FOUND

[RUN][sUSP PATH] HKUS\.DEFAULT[...]\Run : Svc2dll (C:\Windows\System32\config\systemprofile\AppData\Local\svcxdcl32.exe) [-] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-2796156219-500140081-3362875990-1000[...]\Run : SearchProtect (C:\Users\Justin\AppData\Roaming\SearchProtect\bin\cltmng.exe) [7] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-18[...]\Run : Svc2dll (C:\Windows\System32\config\systemprofile\AppData\Local\svcxdcl32.exe) [-] -> FOUND

[TASK][sUSP PATH] DSite.job : C:\Users\Justin\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe /Check [-] -> FOUND

[TASK][sUSP PATH] DSite : C:\Users\Justin\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe /Check [-] -> FOUND

Now click Delete on the right hand column under Options

-------------

Next:

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

[PennsylvaniaMercury]

everything seems ok now. logs attached.

Anyway you can tell me what i had and how i got it so it doesn't happen again?

mbar-log-2013-06-13 (12-46-31).txt

system-log.txt

[MrCharlie]

OK...Next:

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.

You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:

/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

[PennsylvaniaMercury]

only thing i see it targeting that i question is Adaware?

# AdwCleaner v2.303 - Logfile created 06/13/2013 at 14:01:09

# Updated 08/06/2013 by Xplode

# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)

# User : Justin - JUSTIN-PC

# Boot Mode : Normal

# Running from : C:\Users\Justin\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

Found : CltMngSvc

***** [Files / Folders] *****

File Found : C:\END

File Found : C:\Users\Justin\AppData\Local\Temp\Uninstall.exe

Folder Found : C:\Program Files\adawaretb

Folder Found : C:\Program Files\Conduit

Folder Found : C:\Program Files\SearchProtect

Folder Found : C:\ProgramData\adawaretb

Folder Found : C:\ProgramData\Babylon

Folder Found : C:\ProgramData\blekko toolbars

Folder Found : C:\ProgramData\boost_interprocess

Folder Found : C:\ProgramData\Browser Manager

Folder Found : C:\ProgramData\search protection

Folder Found : C:\ProgramData\Tarma Installer

Folder Found : C:\Users\Justin\AppData\Local\Conduit

Folder Found : C:\Users\Justin\AppData\Local\Temp\Industriya

Folder Found : C:\Users\Justin\AppData\LocalLow\adawaretb

Folder Found : C:\Users\Justin\AppData\LocalLow\Conduit

Folder Found : C:\Users\Justin\AppData\LocalLow\Industriya

Folder Found : C:\Users\Justin\AppData\Roaming\Babylon

Folder Found : C:\Users\Justin\AppData\Roaming\DSite

Folder Found : C:\Users\Justin\AppData\Roaming\SearchProtect

***** [Registry] *****

Key Found : HKCU\Software\5b2dcd8e53de845

Key Found : HKCU\Software\8ef6e5fbcf93c20a9c240921a52d8776

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Found : HKCU\Software\AppDataLow\Software\Crossrider

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\BabylonToolbar

Key Found : HKCU\Software\DataMngr

Key Found : HKCU\Software\DataMngr_Toolbar

Key Found : HKCU\Software\InstallCore

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F2D6C718-7E52-428E-8852-365C4B1A6E36}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKCU\Software\SearchProtect

Key Found : HKCU\Software\StartSearch

Key Found : HKLM\SOFTWARE\5b2dcd8e53de845

Key Found : HKLM\Software\adawaretb

Key Found : HKLM\Software\Babylon

Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : HKLM\SOFTWARE\Classes\Prod.cap

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3298566

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\DataMngr

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adawaretb

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

Key Found : HKLM\Software\SearchProtect

Key Found : HKLM\Software\Tarma Installer

Key Found : HKU\S-1-5-21-2796156219-500140081-3362875990-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Found : HKU\S-1-5-21-2796156219-500140081-3362875990-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Found : HKU\S-1-5-21-2796156219-500140081-3362875990-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchProtectAll]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16448

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com/?ctid=CT3298566&octid=CT3298566&SearchSource=61&CUI=UN31536682011716921&UM=2&UP=SPA124526E-1DC6-40DA-98BE-A8BD05E2C1C8

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

[HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

[HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

[HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoEMon&co=US&userid=37a807ed-5208-47c6-9d63-e5a497687e7e&searchtype=ds&q={searchTerms}

-\\ Google Chrome v27.0.1453.110

File : C:\Users\Justin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.4654] : urls_to_restore_on_startup = [ "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_0&ent=hp&u=19DA8C8D633ADFA8598C5251B92047D3", "hxxp://search.conduit.com/?ctid=CT3298566&SearchSource=48&CUI=UN14225358331909721&UM=2" ]

*************************

AdwCleaner[R1].txt - [9215 octets] - [13/06/2013 14:01:09]

########## EOF - C:\AdwCleaner[R1].txt - [9275 octets] ##########

[MrCharlie]

It's adware:

http://www.shouldiblockit.com/adawaretb.dll-15100.aspx

You can't pick and choose with AdwCleaner, delete it all or none.

Let me know.....MrC

[PennsylvaniaMercury]

lets get rid of it then. always thought Adaware was a good program.

[MrCharlie]

Lots of adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC

[PennsylvaniaMercury]

# AdwCleaner v2.303 - Logfile created 06/13/2013 at 15:21:15

# Updated 08/06/2013 by Xplode

# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)

# User : Justin - JUSTIN-PC

# Boot Mode : Normal

# Running from : C:\Users\Justin\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\ProgramData\Browser Manager

***** [Registry] *****

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16448

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.110

File : C:\Users\Justin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.4654] : urls_to_restore_on_startup = [ "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_0&ent=hp&u=19DA8C8D633ADFA8598C5251B92047D3", "hxxp://search.conduit.com/?ctid=CT3298566&SearchSource=48&CUI=UN14225358331909721&UM=2" ]

*************************

AdwCleaner[R1].txt - [9344 octets] - [13/06/2013 14:01:09]

AdwCleaner[R2].txt - [9404 octets] - [13/06/2013 14:01:32]

AdwCleaner[R3].txt - [9464 octets] - [13/06/2013 15:09:29]

AdwCleaner[R4].txt - [1313 octets] - [13/06/2013 15:18:50]

AdwCleaner[R5].txt - [1181 octets] - [13/06/2013 15:21:15]

AdwCleaner[s1].txt - [8920 octets] - [13/06/2013 15:09:55]

########## EOF - C:\AdwCleaner[R5].txt - [1301 octets] ##########

Results of screen317's Security Check version 0.99.64

Windows 7 Service Pack 1 x86 (UAC is enabled)

Internet Explorer 10

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Windows Firewall Disabled!

Lavasoft Ad-Aware

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Ad-Aware

Malwarebytes Anti-Malware version 1.75.0.1300

Java 7 Update 7

Java version out of Date!

Adobe Reader XI

Google Chrome 27.0.1453.110

Google Chrome 27.0.1453.94

````````Process Check: objlist.exe by Laurent````````

Ad-Aware AAWService.exe is disabled!

Ad-Aware AAWTray.exe is disabled!

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Ad-Aware Antivirus AdAwareService.exe

Ad-Aware Antivirus SBAMSvc.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 34% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

[MrCharlie]

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Java 7 Update 7 <---please update, should be Update 21

Java version out of Date! <--------Go to control panel > Java > Update Tab > Update Now

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

If there's no update tab in Java, uninstall it and Download and install the latest version from Here

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

----------------------------------------

Google Chrome 26.0.1453.94 <-----OLD

Google Chrome 27.0.1453.110<-----OK

You have traces of old versions of Google Chrome on the system.

Please download and run OldChromeRemover.

@Windows Vista/Windows 7-8 users must use “Run As Administrator.”

-------------------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTC to your desktop.

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[PennsylvaniaMercury]

Thank you so much. hadn't realized how slow the computer had gotten...

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!