Jump to content

Spigot/Search Protection found on computer ~HELP please

shaggy5

By shaggy5
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Replies 58
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

shaggy5

shaggy5

Posted
  • Author
Posted

FRST - addition.txt Log: 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Shaggy at 2013-11-05 18:30:19
Running from C:\Users\Shaggy\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AS: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
 Update for Microsoft Office 2007 (KB2508958)
7-Zip 9.20
Adobe AIR (Version: 2.5.1.17730)
Adobe Bridge 1.0 (Version: 001.000.000)
Adobe Common File Installer (Version: 1.00.0000)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Help Center 1.0 (Version: 001.000.000)
Adobe Photoshop CS2 (Version: 9.0)
Adobe Reader XI (11.0.05) (Version: 11.0.05)
Adobe Stock Photos 1.0 (Version: 001.000.000)
Amazon MP3 Downloader 1.0.17 (Version: 1.0.17)
Apple Application Support (Version: 2.3)
Apple Mobile Device Support (Version: 6.0.0.59)
Apple Software Update (Version: 2.1.3.127)
AVS Image Converter 2.1.2.169
AVS Update Manager 1.0
AVS4YOU Software Navigator 1.4
Bonjour (Version: 3.0.0.10)
Canon Easy-PhotoPrint EX
Canon Easy-WebPrint EX
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon MP Navigator EX 4.0
Canon MP495 series MP Drivers
Canon MP495 series User Registration
Canon My Printer
Canon Solution Menu EX
Catalina Savings Printer (Version: 1.0.0)
Common Desktop Agent (Version: 1.62.0)
CouponPrinterPlugin (Version: 2.0.2.0)
D3DX10 (Version: 15.4.2368.0902)
Diskeeper 2010 Pro Premier (Version: 14.0.896.32)
Google Chrome (Version: 30.0.1599.101)
Google Update Helper (Version: 1.3.21.165)
GoToMeeting 5.2.0.952 (HKCU Version: 5.2.0.952)
Intel® Graphics Media Accelerator Driver (Version: 8.15.10.1930)
Intel® TV Wizard
IrfanView (remove only) (Version: 4.30)
iTunes (Version: 10.7.0.21)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
Junk Mail filter update (Version: 15.4.3502.0922)
K-Lite Mega Codec Pack 9.0.2 (Version: 9.0.2)
KODAK Share Button App (Version: 4.03.0000.0000)
LeapFrog Connect (Version: 5.1.5.17469)
LeapFrog LeapPad Explorer Plugin (Version: 5.1.10.17623)
Learning Lodge™
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
McAfee Security Scan Plus (Version: 3.8.130.8)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MotoHelper 2.0.51 Driver 5.1.0 (Version: 2.0.51)
MotoHelper MergeModules (Version: 1.2.0)
MOTOPRINT Host (Version: 2.0.0.25)
Motorola Mobile Drivers Installation 5.1.0 (Version: 5.1.0)
Mozilla Firefox 25.0 (x86 en-US) (Version: 25.0)
Mozilla Firefox Packages
Mozilla Maintenance Service (Version: 25.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nielsen
Norton PC Checkup (Version: 2.0.12.27)
QuickTime (Version: 7.73.80.64)
Samsung Easy Document Creator (Version: 1.04.06 (8/7/2012))
Samsung Easy Printer Manager (Version: 1.02.63.01(8/9/2012))
Samsung Scan Process Machine (Version: 1.00.20.02)
Samsung SCX-3400 Series (Version: 1.13 (9/17/2012))
SNS Upload for Easy Document Creator (Version: 1.0.0)
Spybot - Search & Destroy (Version: 1.6.2)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Use the entry named LeapFrog Connect to uninstall (LeapFrog LeapPad Explorer Plugin)
Visual Studio 2012 x86 Redistributables (Version: 14.0.0.1)
VTech Download Agent Library (Version: 1.00.0000)
Windows Driver Package - Eastman Kodak KODAK Digital Camera (01/29/2010 1.4.1.0) (Version: 01/29/2010 1.4.1.0)
Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net  (09/10/2009 02.03.05.012) (Version: 09/10/2009 02.03.05.012)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3508.1109)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
 
==================== Restore Points  =========================
 
05-11-2013 21:23:19 Removed Google Earth.
05-11-2013 21:27:20 Removed Microsoft Silverlight
05-11-2013 21:59:04 Removed AVG 2014
05-11-2013 22:03:43 Removed AVG 2014
 
==================== Hosts content: ==========================
 
2009-07-13 21:04 - 2013-04-11 18:09 - 00446676 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 www.123fporn.info
127.0.0.1 123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
 
There are 1000 more lines.
 
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {24FFD965-67C0-4C2F-80AE-41FE9B12A7A8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-01] (Google Inc.)
Task: {34719C8F-A37C-4A84-AB50-A799C9B0BBB5} - System32\Tasks\MotoHelper Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {34980F3B-FB2B-4F48-977C-6CF5A7B90F11} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {406C488D-8B6E-43C2-A620-980DFC759703} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
Task: {4206C39F-CD0B-40C1-83ED-DF5BF04E06AB} - System32\Tasks\MotoHelper MUM => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {49A1F15A-641E-4308-A5C2-53133DBDEC48} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-31] (Adobe Systems Incorporated)
Task: {4E4865A9-643C-4DD4-9CE0-3D35ACE8E55C} - System32\Tasks\MotoHelper Routing => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {5CF94EBC-E811-40AF-844A-EB382D3283CD} - System32\Tasks\{10EF5062-FADE-4238-95E4-4EA61663B88F}-Kodak Share Button App Camera detect => C:\Program Files\Kodak\KODAK Share Button App\Listener.exe [2012-06-26] (Eastman Kodak Company)
Task: {65A2BFBF-6DB8-4DC1-A320-C676E1ADA112} - System32\Tasks\{2EE9C130-B9B6-46FD-A712-2AA9CDE28A21} => E:\MUSIC\ITUNES\iTunes.exe
Task: {67FE4B24-75FE-489D-91DC-E51D2C14E32B} - System32\Tasks\MotoHelper Initial Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {9FADE423-7009-4A91-A493-F43936880601} - System32\Tasks\Adobe online update program => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {AD5DD799-56A8-4B39-AEDB-E1101EAC035C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {ED054F3A-C924-40F5-BCCB-96AAA5D745FB} - System32\Tasks\Google Updater and Installer => C:\Users\Shaggy\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {F8C0F968-3C94-48B9-BE70-E57E29BF5BFF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-01] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
 
==================== Loaded Modules (whitelisted) =============
 
2013-10-23 09:19 - 2013-10-09 09:01 - 00504832 _____ () C:\Program Files\NetRatingsNetSight\NetSight\meter1\communication.dll
2013-10-23 09:10 - 2013-10-09 09:06 - 00504320 _____ () C:\Program Files\NetRatingsNetSight\NetSight\nsmmc.dll
2011-06-24 21:56 - 2011-06-24 21:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 21:56 - 2011-06-24 21:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-02-20 21:22 - 2012-02-20 21:22 - 00050688 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2013-10-23 09:19 - 2013-10-09 09:03 - 01202176 _____ () C:\Program Files\NetRatingsNetSight\NetSight\meter1\npffaddons.dll
2013-10-23 09:19 - 2013-10-09 09:03 - 00756224 _____ () C:\Program Files\NetRatingsNetSight\NetSight\meter1\npfirefoxprocessor.dll
2013-10-23 09:19 - 2013-10-09 09:02 - 00150528 _____ () C:\Program Files\NetRatingsNetSight\NetSight\meter1\npsp1.dll
2013-10-23 09:19 - 2013-10-09 09:01 - 00228864 _____ () C:\Program Files\NetRatingsNetSight\NetSight\meter1\npsurvey.dll
2013-10-23 09:19 - 2013-10-09 09:02 - 00224768 _____ () C:\Program Files\NetRatingsNetSight\NetSight\meter1\npwmi.dll
2013-10-31 09:31 - 2013-10-08 19:01 - 00698832 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\libglesv2.dll
2013-10-31 09:31 - 2013-10-08 19:01 - 00099792 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\libegl.dll
2013-10-31 09:31 - 2013-10-08 19:02 - 04055504 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll
2013-10-31 09:31 - 2013-10-08 19:02 - 00415184 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll
2013-10-31 09:31 - 2013-10-08 19:01 - 01604560 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll
2013-10-31 09:31 - 2013-10-08 19:02 - 13584336 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
 
==================== Safe Mode (whitelisted) ===================
 
 
==================== Faulty Device Manager Devices =============
 
Name: Base System Device
Description: Base System Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Base System Device
Description: Base System Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (11/05/2013 05:49:00 PM) (Source: Winlogon) (User: )
Description: Windows license activation failed. Error 0x80070005.
 
Error: (11/05/2013 05:31:08 PM) (Source: Software Protection Platform Service) (User: )
Description: License Activation Scheduler (sppuinotify.dll) failed with the following error code:
0x80070005
 
Error: (11/05/2013 04:33:29 PM) (Source: Winlogon) (User: )
Description: Windows license activation failed. Error 0x80070005.
 
Error: (11/05/2013 04:16:22 PM) (Source: Software Protection Platform Service) (User: )
Description: License Activation Scheduler (sppuinotify.dll) failed with the following error code:
0x80070005
 
Error: (11/05/2013 03:16:23 PM) (Source: Software Protection Platform Service) (User: )
Description: License Activation Scheduler (sppuinotify.dll) failed with the following error code:
0x80070005
 
Error: (11/05/2013 09:34:13 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 27518
 
Error: (11/05/2013 09:34:13 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 27518
 
Error: (11/05/2013 09:34:13 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (11/05/2013 09:34:12 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 26504
 
Error: (11/05/2013 09:34:12 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 26504
 
 
System errors:
=============
Error: (11/05/2013 06:26:41 PM) (Source: Disk) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (11/05/2013 06:26:40 PM) (Source: Disk) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (11/05/2013 06:24:01 PM) (Source: Disk) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (11/05/2013 06:24:00 PM) (Source: Disk) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (11/05/2013 05:56:05 PM) (Source: bowser) (User: )
Description: The master browser has received a server announcement from the computer ELVIS-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DC8CA46A-79A7-4F8C-8836-3AC0561DE.
The master browser is stopping or an election is being forced.
 
Error: (11/05/2013 05:49:18 PM) (Source: Service Control Manager) (User: )
Description: The SBSD Security Center Service service depends the following service: wscsvc. This service might not be installed.
 
Error: (11/05/2013 05:43:54 PM) (Source: bowser) (User: )
Description: The master browser has received a server announcement from the computer ELVIS-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DC8CA46A-79A7-4F8C-8836-3AC0561DE.
The master browser is stopping or an election is being forced.
 
Error: (11/05/2013 05:31:08 PM) (Source: DCOM) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
 
Error: (11/05/2013 05:18:41 PM) (Source: bowser) (User: )
Description: The master browser has received a server announcement from the computer ELVIS-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DC8CA46A-79A7-4F8C-8836-3AC0561DE.
The master browser is stopping or an election is being forced.
 
Error: (11/05/2013 04:36:01 PM) (Source: bowser) (User: )
Description: The master browser has received a server announcement from the computer ELVIS-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DC8CA46A-79A7-4F8C-8836-3AC0561DE.
The master browser is stopping or an election is being forced.
 
 
Microsoft Office Sessions:
=========================
 
==================== Memory info =========================== 
 
Percentage of memory in use: 86%
Total physical RAM: 2038.01 MB
Available physical RAM: 282.47 MB
Total Pagefile: 4076.02 MB
Available Pagefile: 1982.08 MB
Total Virtual: 2047.88 MB
Available Virtual: 1865.85 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:217.29 GB) (Free:181.91 GB) NTFS
Drive d: (Thomas) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Drive e: (FreeAgent Drive) (Fixed) (Total:931.51 GB) (Free:561.45 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 99597EE5)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=356 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=217 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: 08C6E9D1)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================
Link to post
Share on other sites
shaggy5

shaggy5

Posted
  • Author
Posted

I am a moderator for a coupon site and need to add links to coupons. I can copy and paste the link into the box provided but once I hit the 'ok' button, nothing is happening. No one else within the site seems to be having this issue as it seems to be specific to me.  Enjoy the coffee, you earned it working with me!

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

These extensions are present in Chrome, do you recognize or need them?

 

CHR HKLM\...\Chrome\Extension: [aacbndibbcpajfgnkdkaakeiojmmgmnk] - C:\Users\Shaggy\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx
CHR HKLM\...\Chrome\Extension: [jgceplfonlgodadnpognljgdjlcnpjnh] - C:\Program Files\NetRatingsNetSight\NetSight\meter1\extension.crx
CHR HKLM\...\Chrome\Extension: [jpihmmhdcobmllpcnpfbhnipmhamldje] - C:\Users\Shaggy\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save that zip file to your Desktop.

Double click zip file and extract to your  Desktop:


Zoekd.jpg


you will now have 3 versions of the tool on the Desktop:


Zoeke.jpg

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html[/url

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:


Zoekb.jpg


Copy and paste the following script from the code box and paste into the field.


Chromelook;CHRdefaults;autoclean;emptyclsid;


Select the "Run Script" tab. The following window will open:



Zoekc.jpg



Please be patient and do not use the PC when the scan is in progress.

When complete you maybe asked to re-boot your PC, if so please do

Zoekf.jpg

Post the produced log in your next reply…..
 
Link to post
Share on other sites
shaggy5

shaggy5

Posted
  • Author
Posted

ZOEK log: 

 

Zoek.exe Version 4.0.0.5 Updated 05-November-2013
Tool run by Shaggy on Thu 11/07/2013 at  8:43:39.00.
Microsoft Windows 7 Ultimate  6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Shaggy\Desktop\zoek\zoek.com [script inserted] 
 
==== System Restore Info ======================
 
11/7/2013 8:44:39 AM Zoek.exe System Restore Point Created Succesfully.
 
==== Deleting CLSID Registry Keys ======================
 
HKEY_USERS\S-1-5-21-3575107775-580834450-4096706880-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A62BAF1A-C398-455B-AF7B-7F30A30B31BE} deleted successfully
 
==== Deleting CLSID Registry Values ======================
 
HKEY_USERS\S-1-5-21-3575107775-580834450-4096706880-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} deleted successfully
HKEY_USERS\S-1-5-21-3575107775-580834450-4096706880-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{687578b9-7132-4a7a-80e4-30ee31099e03} deleted successfully
 
==== Deleting Services ======================
 
 
==== FireFox Fix ======================
 
ProfilePath: C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default
 
user.js not found
---- Lines {687578b9-7132-4a7a-80e4-30ee31099e03} modified from prefs.js ----
 
user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"netsight@nielsen.com\":{\"descriptor\":\"C:\\\\Program Files\\\\N
---- FireFox user.js and prefs.js backups ---- 
 
prefs_20131107_0855_.backup
 
==== Deleting Files \ Folders ======================
 
C:\Users\Shaggy\AppData\Roaming\Catalina – Print Savings not found
C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03} not found
C:\ProgramData\{C3B35EBF-B1F6-4DE1-9682-ED71913E187B} deleted
C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} deleted
C:\Windows\system32\appdata deleted
C:\extensions.sqlite deleted
C:\ProgramData\InstallMate deleted
C:\Users\Shaggy\AppData\Local\BcsKtYcHW.dll deleted
C:\Users\Shaggy\Downloads\iLividSetupV1(1).exe deleted
C:\Users\Shaggy\Downloads\iLividSetupV1(2).exe deleted
C:\Users\Shaggy\Downloads\iLividSetupV1.exe deleted
C:\Users\Shaggy\Downloads\avg_free_stb_all_2012_1831_cnet.exe deleted
C:\Users\Shaggy\Downloads\avg_free_stb_all_2013_3272_cnet.exe deleted
C:\Users\Shaggy\Downloads\61468261-www-livingrichwithcoupons-com-ShopRite-Deals-8-7-11.pdf deleted
C:\Users\Shaggy\Downloads\CatalinaSavingsPrinter.exe deleted
C:\Users\Shaggy\Downloads\CouponActivator.exe deleted
C:\Users\Shaggy\Downloads\CouponPrinter.exe deleted
C:\Users\Shaggy\Downloads\COUPON_phixr.jpg deleted
C:\Users\Shaggy\Downloads\HopsterCouponPrinter.msi deleted
C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted
C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default\jetpack deleted
C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default\CT2504091 deleted
C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default\CT2786678 deleted
 
==== Firefox Extensions Registry ======================
 
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"netsight@nielsen.com"="C:\Program Files\NetRatingsNetSight\NetSight\meter1\FirefoxAddOns\netsight@nielsen.xpi" [11/06/2013 07:17 PM]
 
==== Firefox Extensions ======================
 
ProfilePath: C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default
- Undetermined - C:\Users\Shaggy\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
- Botn de Aadir a la lista de deseos Amazon > - %ProfilePath%\extensions\amznUWL2@amazon.com.xpi
- Padlock - %ProfilePath%\extensions\{d09e32df-8610-4b33-b929-1e631b764130}.xpi
 
AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
==== Firefox Plugins ======================
 
Profilepath: C:\Users\Shaggy\AppData\Roaming\Mozilla\Firefox\Profiles\mnazjd8c.default
9C717B97DAB87AC12FC12DEEDA4F7672 - C:\Program Files\NetRatingsNetSight\NetSight\meter1\FirefoxAddOns\npfirefoxtracker.dll - Nielsen FirefoxTracker Plug-in
4BF70B35B943BD73BD6E13EB7C1BA4B3 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll - Shockwave Flash
CFAF7B67C78D09D79688AEDCA3D090E2 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll - Google Update
6768C724599214E4F9ADD9F8FF5097EB - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java Platform SE 7 U45
F1CD6E22E5AE5CEEB7712E546A5FC853 - C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 7.0.450.18
69AA47F09AA281C7D3C7716CA7E283B4 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat
380F9A643A149B9030142E7171EFA91B - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
7EF7E4C1325D533F5186E7118ABB0E7C - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMSS.dll - McAfee Security Scanner +
1FFDEA3D309253A9A3D6C68AE210E3FA - C:\Users\Shaggy\AppData\Roaming\Hopster\CouponPrinterPlugin\2.0.2.0\npCouponPrinterPlugin.dll - CouponPrinterPlugin
11EF47BE3D8A4A943E10A63870C1F2C6 - C:\Program Files\QuickTime\Plugins\npqtplugin7.dll - QuickTime Plug-in 7.7.3
BB7F5F4966E76578A3EC0D11C444C545 - C:\Program Files\QuickTime\Plugins\npqtplugin6.dll - QuickTime Plug-in 7.7.3
16112E74A62381C69456566D35F9E51E - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.3
BB28A86CDFFFBB041C72AD9EFEAA00D0 - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.3
2DA7883A884BE60F9EB2810F67E0E361 - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.3
DE5507DBA44CC5B6869205871B64A587 - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.3
419680FCE774976FD752EB425D91AEDF - C:\Program Files\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.3
1224D741CE1A54D67429E04A5B1EC4E2 - E:\MUSIC\npAmazonMP3DownloaderPlugin101752.dll - AmazonMP3DownloaderPlugin
C1680C34DE8A405C8829AB93236576FD - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector
AC421A44DE902F2627F1E63793ED89CD - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery
CE252B04FB9F4F773A7DB5338BFEEA5B - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL - CANON iMAGE GATEWAY Album Plugin Utility
FA77C368D108519B3C77AE043846DAC9 - C:\Users\Shaggy\AppData\Roaming\Hopster\CouponPrinterPlugin\2.0.2.0\npPrintUtil.dll - Coupon Printer Plugin
 
 
==== Chrome Look ======================
 
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
aacbndibbcpajfgnkdkaakeiojmmgmnk - C:\Users\Shaggy\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx[]
jgceplfonlgodadnpognljgdjlcnpjnh - C:\Program Files\NetRatingsNetSight\NetSight\meter1\extension.crx[10/09/2013 09:04 AM]
jpihmmhdcobmllpcnpfbhnipmhamldje - C:\Users\Shaggy\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx[]
 
Angry Birds - Shaggy - Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj
Google Drive - Shaggy - Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Shaggy - Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Shaggy - Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Nielsen - Shaggy - Default\Extensions\jgceplfonlgodadnpognljgdjlcnpjnh
Google Wallet - Shaggy - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - Shaggy - Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia
 
==== Set IE to Default ======================
 
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page Restore"="http://www.yahoo.com/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{A62BAF1A-C398-455B-AF7B-7F30A30B31BE}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A62BAF1A-C398-455B-AF7B-7F30A30B31BE}] not found
 
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Start Page Restore"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
 
==== All HKCU SearchScopes ======================
 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{7ABD5EFD-88A6-E9CE-80AE-DBCA8C52F41C} Bing  Url="http://www.bing.com/search?q={searchTerms}&pc=Z134&form=ZGAIDF&install_date=20111228&iesrc={referrer:source}"
 
==== Reset Google Chrome ======================
 
C:\Users\Shaggy\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Shaggy\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
 
==== Deleting Registry Keys ======================
 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D2D684BE-9E65-0C8A-8418-9DC799F8EDA3} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\aacbndibbcpajfgnkdkaakeiojmmgmnk deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\jpihmmhdcobmllpcnpfbhnipmhamldje deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 deleted successfully
 
==== Empty IE Cache ======================
 
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Shaggy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Shaggy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Shaggy\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Shaggy\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
 
==== Empty FireFox Cache ======================
 
C:\Users\Shaggy\AppData\Local\Mozilla\Firefox\Profiles\mnazjd8c.default\Cache emptied successfully
 
==== Empty Chrome Cache ======================
 
C:\Users\Shaggy\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\Shaggy\AppData\Local\Google\Chrome\User Data\Default\Application Cache\Cache emptied successfully
 
==== Empty All Flash Cache ======================
 
Flash Cache Emptied Successfully
 
==== Empty All Java Cache ======================
 
Java Cache cleared successfully
 
==== After Reboot ======================
 
==== Empty Temp Folders ======================
 
C:\Windows\Temp successfully emptied
C:\Users\Shaggy\AppData\Local\Temp successfully emptied
 
==== Empty Recycle Bin ======================
 
C:\$RECYCLE.BIN successfully emptied
 
==== EOF on Thu 11/07/2013 at 10:51:00.51 ======================
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Not really 100% sure but believe a rogue setting within Chrome was to blame, using Zoek to correct the settings has made the difference. Ok we progress:

 

Delete FRST.exe from your Desktop or the folder it was saved to, navigate to and delete its folder C:\FRST

 

Next,

 

Delete Zoek from the Desktop or the folder it was saved to, also open C:\ and delete all files related to Zoek

 

Next,

 

Uninstall adwcleaner.exe

  •   Please close all open programs and internet browsers.
  •   Double click on adwcleaner.exe to run the tool.
  •   Click on Uninstall
  • Click Yes at Would you like to Uninstall Adwcleaner

 

Next,

 

Remove ESET online scanner  (Only If installed):

 


Click Start, type Uninstall a Program into the Search programs and files box, and then press ENTER.
Click to select ESET Online Scanner from the listing of installed products, and then click Uninstall/Change from the bar that displays the available tasks. Uninstall ESETonline Scanner, only re-boot if prompted.

 

Next,

 

  • Download OTC by OldTimer from here http://oldtimer.geekstogo.com/OTC.exe or here http://www.itxassociates.com/OT-Tools/OTC.exe and save to your Desktop.
  • Double click OTC_Icon.jpg icon to start the program.
    If you are using Vista or Windows 7 accept UAC
  • Then Click the big CleanUp.jpg button.
  • You will get a prompt saying "Begining Cleanup Process". Please select Yes.
  • Restart your computer when prompted.
  • This will remove tools we have used and itself.

 

Any tools/logs remaining on the Desktop or downloads folder can be deleted.

 

Finally,

 

Create a new restore point:

 

   1. Right-click on Computer and go to Properties.

   2. Next click on the System Protection link.

   3. The System Properties dialog screen opens up and you will want to click on Create.

   4. Type in a description for the restore point which will help you remember the point at which it was created. Click on create.

   5. You should see the message "The restore point was created successfully

 

To remove all but the most recent restore point do the following:

 

   1.      Open Disk Cleanup by clicking the Start button 4f6cbd09-148c-4dd8-b1f2-48f232a2fd33.jpg. In the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.

   2.      If prompted, select the drive that you want to clean up, and then click OK.

   3.      In the Disk Cleanup for (usually C:\) dialog box, click Clean up system files. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

   4.      If prompted, select the drive that you want to clean up, and then click OK.

   5.      Click the More Options tab, under System Restore and Shadow Copies, click Clean up.

   6.      In the Disk Cleanup dialog box, click Delete.

   7.      Click Delete Files, and then click OK. Re-Boot your PC.

 

Let me know if those steps complete, also if any remaining issues or concerns...

 

Kevin

Link to post
Share on other sites
shaggy5

shaggy5

Posted
  • Author
Posted

Everything looks good on this end and I can not thank you enough for helping me out as much as you did!!!

 

In case the Chrome issue happens again, what do you suggest I do as I do not want to bug you guys for something silly like that.

 

Also, I have AVG, run Malwarebytes as well as SpyBot often, is that enough or do you recommend using another as well? I ask that b/c none of those 3 snagged that sneaky little sucker. 

Link to post
Share on other sites
shaggy5

shaggy5

Posted
  • Author
Posted

I'm sorry, I don't mean to confuse you. I am having the same issues that we fixed with the scan I did early this am using Zoek.  I am back to not being able to post links as stated before and my facebook is doing the same things it was doing prior to the Zoek scan (can't 'like' things, can't see more comments, scrolling to the top when I click 'like').  It all worked great after the Zoek but reverted back after the last thing. 

 

I am soooo sorry   :(

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.