Globa search

[nuska]

I would appreciate some help with removing Globa search from my computer. I've tried all sorts of scans including Malwarebytes Pro and Hitman Pro, reset FF, IE and Chrome browsers to default, and there is nothing in Add/Remove. It appears when I click new tab in FF 26.

Any help would be very welcome.

[MrCharlie]

Welcome to the forum, please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[nuska]

Hello MrCharlie,

Thank you for your help. I have attached the files as requested.

dds.txt

attach.txt

RKreport0_S_12302013_162740.txt

[MrCharlie]

Please do this to start with:

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Make sure you click on download buttons that look similar to this, not "sponsored ad links":

• Double click on AdwCleaner.exe to run the tool.

  Vista/Windows 7/8 users right-click and select Run As Administrator

• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a FULL Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

MrC

[nuska]

Log file of AdwCleaner below.

I tried to run Malwarebytes Anti-Malware twice, but both times it reported a problem and had to close. This has never happened before.

.................

 

# AdwCleaner v3.016 - Report created 30/12/2013 at 18:28:12
# Updated 23/12/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Joy - JOY-PC
# Running from : C:\Documents and Settings\Joy\My Documents\Downloads\AdwCleaner(1).exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\febeprof.Febe profile\searchplugins\search.xml
Folder Found : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\uc1m7ex0.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
Folder Found : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\uc1m7ex0.default\Extensions\donottrackplus@abine.com
Folder Found : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\uc1m7ex0.default\Extensions\facebook-translate@oliver.schloebe.de
Folder Found : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\uc1m7ex0.default\Extensions\fasttrans@kemot
Folder Found : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\uc1m7ex0.default\Extensions\jyboy.yy@gmail.com
Folder Found : C:\Program Files\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Folder Found C:\Documents and Settings\All Users\Application Data\AlawarEntertainment
Folder Found C:\Documents and Settings\All Users\Application Data\Trymedia
Folder Found C:\Documents and Settings\Joy\Application Data\AlawarEntertainment
Folder Found C:\Documents and Settings\Joy\Application Data\iSafe
Folder Found C:\Documents and Settings\Joy\Local Settings\Application Data\iac
Folder Found C:\Program Files\iSafe

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Trymedia Systems

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v26.0 (en-GB)

[ File : C:\Documents and Settings\Joy\Application Data\Mozilla\Firefox\Profiles\uc1m7ex0.default\prefs.js ]

Line Found : user_pref("extensions.toolbar.mindspark._gcMembers_.lastActivePing", "1386852639190");
Line Found : user_pref("extensions.toolbar.mindspark.lastInstalled", "weatherblink@mindspark.com");

-\\ Google Chrome v31.0.1650.63

[ File : C:\Documents and Settings\Joy\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [7364 octets] - [29/12/2013 11:11:19]
AdwCleaner[R1].txt - [3500 octets] - [30/12/2013 18:28:12]
AdwCleaner[s0].txt - [3446 octets] - [29/12/2013 11:13:15]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [3620 octets] ##########
 

[MrCharlie]

Did you have AdwCleaner delete all of those???

MrC

[nuska]

I put the following items into quarantine

C:\Documents and Settings\All Users\Application Data\Trymedia\ogmcsdata.cache->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\ogmcsdata.cache.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\ogminfo.json->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\ogminfo.json.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\stats\312bbcd98840479792b60be548df047a.xml->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\stats\312bbcd98840479792b60be548df047a.xml.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\stats\545cbad67eb1ee9e584b42bb918b5880.xml->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\stats\545cbad67eb1ee9e584b42bb918b5880.xml.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\stats\8edd0778417e121c2971703966cf006b.xml->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\stats\8edd0778417e121c2971703966cf006b.xml.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\licenses\8edd0778417e121c2971703966cf006b.lcn->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\licenses\8edd0778417e121c2971703966cf006b.lcn.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{13F5B3C1-6CA5-2AAA-0291-2737ECD90309}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{13F5B3C1-6CA5-2AAA-0291-2737ECD90309}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{273BBE9D-576D-DF26-D8DD-55FA34E3BAB1}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{273BBE9D-576D-DF26-D8DD-55FA34E3BAB1}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{3A108FBF-6C43-9BBF-A3A4-E9327306DF9C}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{3A108FBF-6C43-9BBF-A3A4-E9327306DF9C}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{41EA9C91-B065-57BE-2BD3-481EF186BA19}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{41EA9C91-B065-57BE-2BD3-481EF186BA19}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4E28FD3B-6491-0046-219C-5332B46BD434}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{4E28FD3B-6491-0046-219C-5332B46BD434}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{598DCB54-2516-38D5-4F4D-8A1DB6947BFB}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{598DCB54-2516-38D5-4F4D-8A1DB6947BFB}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{75F7E79D-0A78-DD09-F194-1DDF49A57C1C}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{75F7E79D-0A78-DD09-F194-1DDF49A57C1C}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{846DD20A-3613-E0C1-16C7-B9F2E485CFA0}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{846DD20A-3613-E0C1-16C7-B9F2E485CFA0}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{892BF91F-5C93-C6C5-DB08-A0CE6D589DAF}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{892BF91F-5C93-C6C5-DB08-A0CE6D589DAF}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{8CFE6A63-7D95-1C39-43CB-E888C5E16B2F}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{8CFE6A63-7D95-1C39-43CB-E888C5E16B2F}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{C41F1115-80D0-F9A7-ED8A-E850D1B5B544}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{C41F1115-80D0-F9A7-ED8A-E850D1B5B544}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E2370C4E-0ED5-2AC0-3D5C-2397A9630AB5}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{E2370C4E-0ED5-2AC0-3D5C-2397A9630AB5}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\ogmcsdata.cache->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\ogmcsdata.cache.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\ogminfo.json->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\ogminfo.json.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\stats\8edd0778417e121c2971703966cf006b.xml->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\stats\8edd0778417e121c2971703966cf006b.xml.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\licenses\8edd0778417e121c2971703966cf006b.lcn->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\licenses\8edd0778417e121c2971703966cf006b.lcn.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{13F5B3C1-6CA5-2AAA-0291-2737ECD90309}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{13F5B3C1-6CA5-2AAA-0291-2737ECD90309}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{41EA9C91-B065-57BE-2BD3-481EF186BA19}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{41EA9C91-B065-57BE-2BD3-481EF186BA19}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{846DD20A-3613-E0C1-16C7-B9F2E485CFA0}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{846DD20A-3613-E0C1-16C7-B9F2E485CFA0}.vir
C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E2370C4E-0ED5-2AC0-3D5C-2397A9630AB5}->C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\Trymedia\data\{E2370C4E-0ED5-2AC0-3D5C-2397A9630AB5}.vir

Not sure about the rest as I clicked clean and let it go ahead

nuska

[MrCharlie]

Is there any difference???

If not.......

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

[nuska]

No there is no difference, logs attached

Farbar Addition.txt

Farbar FRST.txt

[MrCharlie]

Delete your copy of AdwCleaner and download and run a fresh copy, let it clean everything found.

Then if there's still a problem, run another scan with FRST and post the log.

MrC

[nuska]

I tried with a fresh copy of AdwCleaner, but on clicking clean the computer froze on deleting folders, and I had to use the power off button. So no results on that.

FRST files attached

 

2nd FRST.txt

2nd Addition.txt

[MrCharlie]

Please reset Internet Explorer:

http://www.mostiwant.com/blog/reset-internet-explorer-7-8-9-settings/

--------------------------------

It's still in Chrome:
CHR DefaultSearchURL: http://www.globasearch.com/?q={searchTerms}&b=1&serie=32


First make sure you have the latest version of Chrome:
Open up Chrome > Click on the 3 bars in the upper right hand corner
Click on About Google Chrome
If there's an update available it will automatically update


Next:
Go to Tools > Clear Browser Data
Put a check next to all of these:

• Clear browsing history
• Clear download history
• Delete cookies and other site and plug-in data
• Empty the cache
• Click "Clear Browsing Data"
  
  -------------------------------
  
  
  Next:
  Click the Chrome menu on the browser toolbar.
  Select Settings.
  In the "Search" section, click Manage search engines.
  Check if (Default) is displayed next to your preferred search engine. If not, mouse over it and click Make default.
  Mouse over any other suspicious search engine entries that are not familiar and click X to remove them.
  
  -------------------------------------
  
  Click the Chrome menu .
  Select Settings.
  In the "On startup" section, select Open a specific page or set of pages.
  Click Set pages. (in blue to the right)
  Remove any unfamiliar pages.
  
  -----------------------
  
  Click the Chrome menu .
  Select Settings.
  In the "Appearance" section, if the "Show Home button" checkbox is selected, see if the page listed below is the home page you’d like to use.
  If the page isn't the home page you'd like to use, click Change and select your preferred page.
  
  -------------------------
  
  
  Carefully check for any odd extensions or plugins: (it's a good idea to disable them all and see if you're still redirected and then add each one back until you find the culprit)
  
  Type the following into the address box and hit Enter:
  
  chrome:plugins
  
  Do the same for:
  
  chrome:extensions
  
  You can always reset Chrome:
  https://support.google.com/chrome/answer/3296214?hl=en <---reset
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Do you recognize this:
  
  2013-12-25 17:17 - 2013-12-25 17:17 - 00000216 ____H C:\WINDOWS\Tasks\DjYogi-PSY (http.www.bbc.co.uk.80).job
  
  -----------------------------
  
  Download the attached fixlist.txt to the same folder as FRST.
  Run FRST.exe and click Fix only once and wait
  The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.
  
  Then......
  
  Lets clean out any adware/spyware now: (this will require a reboot so save all your work)
  
  Please download AdwCleaner by Xplode and save to your Desktop.
  
  Make sure you click on download buttons that look similar to this, not "sponsored ad links":
  
  
  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
  Then..................
  
  Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.
  
  Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.
  
  Make sure that everything is checked, and click Remove Selected.
  
  Please let me know how computer is running now, MrC

[nuska]

Happy New Year!

 

Yes I think I recognise this  2013-12-25 17:17 - 2013-12-25 17:17 - 00000216 ____H C:\WINDOWS\Tasks\DjYogi-PSY (http.www.bbc.co.uk.80).job it was probably me trying to record the midnight mass for Christmas.

All the rest I have done with the exception of the AdwCleaner.exe - I had the following problems and gave up.

It stuck on deleting folders, locked the computer and I had to use the power off button as before. It was a fresh download.

I noticed a couple of items in FF -

Line Found : user_pref("extensions.toolbar.mindspark._gcMembers_.lastActivePing", "1386852639190");
Line Found : user_pref("extensions.toolbar.mindspark.lastInstalled", "weatherblink@mindspark.com");

I do not want these, but could not find a way of removing.

Globa search still comes up on opening a new tab.

1.1.14 Fixlog.txt

mbam-log-2014-01-01 (19-28-47).txt

[MrCharlie]

Create a new system restore point before you run this:

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

MrC

[nuska]

File attached

JRT.txt

[MrCharlie]

Grab a fresh copy of AdwCleaner and see if it runs now.

MrC

[nuska]

No it froze on cleaning browsers, however clicking new tab in FF no longer brings up the Globa search so that is a result at least!

[MrCharlie]

So we're OK now??? MrC

[nuska]

Sorry for delay, I have been trying to solve the problem of extremely slow start up and shut down since carrying out the above cleaning of Globa search. No luck so far.

[MrCharlie]

See if you can run ComboFix:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[nuska]

I did all the disabling of firewall, malware programmes, anti-virus etc., and ran the ComboFix from desktop. It downloaded the recovery console, and then the autoscan for infected files. I left it for more than 2 hours but nothing happened. No txt. file.

[MrCharlie]

OK, stop it and try it like this:

Delete your copy of ComboFix. Grab a fresh copy and save it to your Desktop, but do not run it yet.

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Click Start --> Run, and enter this command exactly as shown: (copy and paste)

"%userprofile%\desktop\combofix.exe" /nombr

See if it will run successfully now. MrC

[nuska]

Success at last - log file attached

ComboFix log.txt

[MrCharlie]

Looks Good.

Use your CCleaner to clean out temp files, make sure you have the latest version:

CCleaner free

Download and run StartupLite:

https://www.malwarebytes.org/startuplite/

Let me know how it is.

MrC

[nuska]

If anything it took longer, both to shut down and startup