Computer is streaming internet audio on it's own - ads and such

Sarge · January 3, 2014

I use MBAM and MS Security Essentials......neither program finds anything. TDSKiller also finds nothing.

Any suggestions on how to proceed in effort to kill this hijack would be appreciated.

kevinf80 · January 3, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin

Sarge · January 3, 2014

Thanks for jumping in here to try to help me out with this Kevin.

This isn't my computer....I don't think the owner is using any P2P stuff....

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2014

Ran by Mike (administrator) on MIKE-LAPTOP on 03-01-2014 15:12:00

Running from F:\Installers\Security stuff

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\ Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\ Anti-Malware\mbamservice.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe

(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\ccSvcHst.exe

(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

(Malwarebytes Corporation) C:\Program Files (x86)\ Anti-Malware\mbamgui.exe

(Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\ccSvcHst.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\ Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\System32\prevhost.exe

(Farbar) F:\Installers\Security stuff\Farbar Recovery Scan Tool 64 bit.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)

HKLM-x32\...\Run: [] - [x]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND

URLSearchHook: HKCU - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.)

URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {AB24098B-097E-4C74-9B74-F62E1C7EE681} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSND

SearchScopes: HKLM - {AB24098B-097E-4C74-9B74-F62E1C7EE681} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSND

SearchScopes: HKLM-x32 - DefaultScope {6D28AC79-6CB6-4353-BECA-68A9B4D234BB} URL =

SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3266331&CUI=UN32971446690606397

SearchScopes: HKLM-x32 - {E4DA871F-7464-4470-B935-689287BCDAC3} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSND

SearchScopes: HKCU - DefaultScope {6D28AC79-6CB6-4353-BECA-68A9B4D234BB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN35296702811049218&UM=2

SearchScopes: HKCU - {2F26DE85-003F-4E51-8E1C-DC78FA758670} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSND_enUS433US433

SearchScopes: HKCU - {41177629-3DF9-447E-AC4A-E327F00E5DF0} URL = http://www.bing.com/search?FORM=VE3D01&q={searchTerms}&src={referrer:source?}

SearchScopes: HKCU - {63140ECF-C629-BE59-8F0E-90B4FF340C03} URL = http://www.bing.com/search?q={searchTerms}&pc=Z128&form=ZGAIDF&install_date=20111220&iesrc={referrer:source}

SearchScopes: HKCU - {6D28AC79-6CB6-4353-BECA-68A9B4D234BB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN35296702811049218&UM=2

SearchScopes: HKCU - {88C1006C-7B45-47F7-AC2F-E160DCC4D0DD} URL = http://www.search.ask.com/web?tpid=BCPAV7-SAT&o=APN11001&pf=V7&p2=%5EB3N%5EYYYYYY%5EYY%5EUS&gct=sb&itbv=12.7.0.2464&apn_uid=6F84AB4B-733D-4859-8ABE-F33B799E8893&apn_ptnrs=%5EB3N&apn_dtid=%5EYYYYYY%5EYY%5EUS&apn_dbr=ie_8.0.7600.17267&doi=2013-12-03&trgb=IE&q={searchTerms}&psv=

SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = http://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=82396&iwk=250&lng=en

SearchScopes: HKCU - {E4DA871F-7464-4470-B935-689287BCDAC3} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSND

BHO: Ask Toolbar - {42435041-332D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPA3-V7C\Passport_x64.dll (APN LLC.)

BHO: Ask Shopping Toolbar - {42435041-5637-2D53-4154-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPAV7-SAT\Passport_x64.dll (APN LLC.)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Ask Toolbar - {42435041-332D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPA3-V7C\Passport.dll (APN LLC.)

BHO-x32: Ask Shopping Toolbar - {42435041-5637-2D53-4154-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPAV7-SAT\Passport.dll (APN LLC.)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Ask Toolbar - {42435041-332D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPA3-V7C\Passport_x64.dll (APN LLC.)

Toolbar: HKLM - Ask Shopping Toolbar - {42435041-5637-2D53-4154-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPAV7-SAT\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Ask Toolbar - {42435041-332D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPA3-V7C\Passport.dll (APN LLC.)

Toolbar: HKLM-x32 - Ask Shopping Toolbar - {42435041-5637-2D53-4154-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPAV7-SAT\Passport.dll (APN LLC.)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

Toolbar: HKCU - Ask Toolbar - {42435041-332D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPA3-V7C\Passport_x64.dll (APN LLC.)

Toolbar: HKCU - Ask Shopping Toolbar - {42435041-5637-2D53-4154-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\BCPAV7-SAT\Passport_x64.dll (APN LLC.)

DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}

DPF: HKLM-x32 {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab

Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - No File

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler-x32: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QB Enterprise\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File

Tcpip\Parameters: [DhcpNameServer] 192.168.99.2

Tcpip\..\Interfaces\{0C85C0F4-B6F7-417E-AA3B-3295EF88C83E}: [NameServer]24.92.226.11,24.92.226.12

Tcpip\..\Interfaces\{296556BD-6FA7-40DD-BC8D-4977E22657F2}: [NameServer]24.92.226.11,24.92.226.12

Chrome:

=======

CHR DefaultSearchKeyword: search.conduit.com

CHR DefaultSearchProvider: Conduit

CHR DefaultSearchURL: http://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN25998847682792614&ctid=CT3289663&UM=2

CHR Extension: (Google Docs) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1

CHR Extension: (Google Search) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1

CHR Extension: (Free Ride Games Short) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeedhehdfjahfpjhaedmaohbfcdkoolg\10.13.20.29_0

CHR Extension: (Skype Click to Call) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.11.0.13348_1

CHR Extension: (InternetHelper3.1) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nemfjadlboooiffmcelkafilagddogim\10.19.2.5_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

CHR Extension: (Gmail) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2

CHR HKLM-x32\...\Chrome\Extension: [dcmagccbogebndpoodhhhafmofelpffh] - C:\Users\Mike\AppData\Local\RewardsArcade\498\Chrome\rewardsarcade.crx

CHR HKLM-x32\...\Chrome\Extension: [jeedhehdfjahfpjhaedmaohbfcdkoolg] - C:\Users\Mike\AppData\Local\CRE\jeedhehdfjahfpjhaedmaohbfcdkoolg.crx

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

CHR HKLM-x32\...\Chrome\Extension: [nemfjadlboooiffmcelkafilagddogim] - C:\Users\Mike\AppData\Local\CRE\nemfjadlboooiffmcelkafilagddogim.crx

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-11-08] (APN LLC.)

R2 MBAMScheduler; C:\Program Files (x86)\ Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\ Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)

R2 MSSQLSERVER; c:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [61916000 2011-04-23] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-07-19] ()

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)

R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\ccSvcHst.exe [126392 2009-08-24] (Symantec Corporation)

S4 SQLSERVERAGENT; c:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [428384 2011-04-23] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-01-03 15:11 - 2014-01-03 15:11 - 00000000 ____D C:\FRST

2014-01-03 13:26 - 2014-01-03 13:51 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-03 13:26 - 2014-01-03 13:26 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-01-03 13:25 - 2014-01-03 13:25 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-02 10:09 - 2014-01-02 10:09 - 00037376 _____ C:\windows\system32\vgojd.ynw

2014-01-02 09:59 - 2014-01-03 12:46 - 00000083 _____ C:\windows\system32\qqcao.cyn

2014-01-02 09:58 - 2014-01-02 10:09 - 00000097 _____ C:\windows\system32\wiuu.upx

2014-01-02 09:58 - 2014-01-02 09:58 - 00000064 _____ C:\windows\system32\ghyjwn.eyt

2014-01-02 09:42 - 2014-01-02 09:42 - 00219314 ____S C:\windows\system32\wrukyso.gcj

2013-12-23 16:53 - 2013-12-23 16:53 - 00000000 ____D C:\ProgramData\WEBREG

2013-12-23 16:52 - 2013-12-23 16:54 - 00000000 ____D C:\Users\Mike\AppData\Roaming\HP

2013-12-23 16:48 - 2013-12-31 07:34 - 00000000 ____D C:\Users\Mike\AppData\Roaming\HpUpdate

2013-12-23 16:48 - 2013-12-24 09:36 - 00000000 ____D C:\ProgramData\Yahoo! Companion

2013-12-23 16:48 - 2013-12-23 16:48 - 00001068 _____ C:\Users\Public\Desktop\HP Photo Creations.lnk

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Yahoo!

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\ProgramData\HP Photo Creations

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\Yahoo!

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\Coupons

2013-12-23 16:47 - 2013-12-23 16:47 - 00001132 _____ C:\Users\Public\Desktop\Shop for HP Supplies.lnk

2013-12-23 16:46 - 2013-12-23 16:46 - 00001286 _____ C:\Users\Public\Desktop\HP Solution Center.lnk

2013-12-23 16:46 - 2013-12-23 16:46 - 00000000 ____D C:\ProgramData\HP Product Assistant

2013-12-23 16:43 - 2009-04-16 14:08 - 00136704 _____ (Hewlett-Packard Company) C:\windows\system32\hpf3l70v.dll

2013-12-23 16:42 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\HP

2013-12-23 16:41 - 2013-12-23 16:53 - 00208445 _____ C:\windows\hpoins43.dat

2013-12-23 16:41 - 2013-12-23 16:53 - 00001280 _____ C:\ProgramData\hpzinstall.log

2013-12-23 16:41 - 2013-12-23 16:52 - 00000000 ____D C:\ProgramData\HP

2013-12-23 16:41 - 2013-12-23 16:41 - 00000000 ____D C:\Program Files\HP

2013-12-23 16:41 - 2010-01-30 08:11 - 00000601 ____N C:\windows\hpomdl43.dat

2013-12-23 16:40 - 2009-04-16 06:53 - 00642360 _____ (Hewlett-Packard) C:\windows\system32\hpzids40.dll

2013-12-23 16:40 - 2009-02-11 06:03 - 01403904 _____ (Hewlett-Packard Co.) C:\windows\system32\hpost_p02c.dll

2013-12-23 16:40 - 2009-02-11 06:03 - 00880640 _____ (Hewlett-Packard) C:\windows\system32\hposwia_p02c.dll

2013-12-23 16:40 - 2009-02-11 06:03 - 00515072 _____ (Hewlett-Packard Co.) C:\windows\system32\hposc_p02a.dll

2013-12-23 16:40 - 2008-10-28 19:27 - 00551424 _____ (Hewlett-Packard) C:\windows\system32\hppldcoi.dll

2013-12-18 07:25 - 2013-12-18 07:25 - 00002183 _____ C:\Users\Public\Desktop\Google Earth.lnk

2013-12-17 09:35 - 2013-12-17 14:13 - 00000000 ____D C:\Users\Mike\Documents\Flower City Communications Files

2013-12-05 11:28 - 2013-12-05 11:28 - 00000000 ____D C:\Users\Mike\AppData\Local\Deployment

2013-12-05 11:28 - 2013-12-05 11:28 - 00000000 ____D C:\Users\Mike\AppData\Local\Apps\2.0

==================== One Month Modified Files and Folders =======

2014-01-03 15:11 - 2014-01-03 15:11 - 00000000 ____D C:\FRST

2014-01-03 14:49 - 2012-04-04 06:09 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2014-01-03 14:41 - 2009-07-14 00:13 - 00876314 _____ C:\windows\system32\PerfStringBackup.INI

2014-01-03 14:39 - 2009-07-13 23:45 - 00016304 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-01-03 14:39 - 2009-07-13 23:45 - 00016304 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-01-03 14:35 - 2011-05-26 17:40 - 01632851 _____ C:\windows\WindowsUpdate.log

2014-01-03 14:32 - 2013-01-04 18:36 - 00013484 _____ C:\windows\setupact.log

2014-01-03 14:32 - 2011-05-26 18:00 - 00000050 _____ C:\windows\system32\SupplicantTest.log

2014-01-03 14:32 - 2010-08-29 23:44 - 00000908 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-03 14:32 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2014-01-03 13:51 - 2014-01-03 13:26 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-03 13:26 - 2014-01-03 13:26 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-01-03 13:25 - 2014-01-03 13:25 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-03 13:08 - 2011-12-22 10:03 - 00000000 ____D C:\windows\pss

2014-01-03 13:08 - 2011-09-18 17:39 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Skype

2014-01-03 12:46 - 2014-01-02 09:59 - 00000083 _____ C:\windows\system32\qqcao.cyn

2014-01-03 12:18 - 2010-08-29 23:44 - 00000912 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-03 10:49 - 2010-08-30 00:00 - 00273298 _____ C:\windows\PFRO.log

2014-01-03 07:20 - 2012-07-20 13:36 - 00000384 _____ C:\windows\Tasks\Regwork.job

2014-01-02 10:09 - 2014-01-02 10:09 - 00037376 _____ C:\windows\system32\vgojd.ynw

2014-01-02 10:09 - 2014-01-02 09:58 - 00000097 _____ C:\windows\system32\wiuu.upx

2014-01-02 09:58 - 2014-01-02 09:58 - 00000064 _____ C:\windows\system32\ghyjwn.eyt

2014-01-02 09:42 - 2014-01-02 09:42 - 00219314 ____S C:\windows\system32\wrukyso.gcj

2013-12-31 07:34 - 2013-12-23 16:48 - 00000000 ____D C:\Users\Mike\AppData\Roaming\HpUpdate

2013-12-30 14:01 - 2013-11-12 08:46 - 00000000 ____D C:\Users\Mike\Desktop\AT&T Jobs

2013-12-24 09:36 - 2013-12-23 16:48 - 00000000 ____D C:\ProgramData\Yahoo! Companion

2013-12-24 09:34 - 2009-07-13 23:45 - 00417368 _____ C:\windows\system32\FNTCACHE.DAT

2013-12-23 16:54 - 2013-12-23 16:52 - 00000000 ____D C:\Users\Mike\AppData\Roaming\HP

2013-12-23 16:53 - 2013-12-23 16:53 - 00000000 ____D C:\ProgramData\WEBREG

2013-12-23 16:53 - 2013-12-23 16:41 - 00208445 _____ C:\windows\hpoins43.dat

2013-12-23 16:53 - 2013-12-23 16:41 - 00001280 _____ C:\ProgramData\hpzinstall.log

2013-12-23 16:52 - 2013-12-23 16:41 - 00000000 ____D C:\ProgramData\HP

2013-12-23 16:52 - 2011-05-26 15:28 - 00103232 _____ C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT

2013-12-23 16:52 - 2009-07-13 21:34 - 00000534 _____ C:\windows\win.ini

2013-12-23 16:48 - 2013-12-23 16:48 - 00001068 _____ C:\Users\Public\Desktop\HP Photo Creations.lnk

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Yahoo!

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\ProgramData\HP Photo Creations

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\Yahoo!

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations

2013-12-23 16:48 - 2013-12-23 16:48 - 00000000 ____D C:\Program Files (x86)\Coupons

2013-12-23 16:48 - 2013-12-23 16:42 - 00000000 ____D C:\Program Files (x86)\HP

2013-12-23 16:47 - 2013-12-23 16:47 - 00001132 _____ C:\Users\Public\Desktop\Shop for HP Supplies.lnk

2013-12-23 16:46 - 2013-12-23 16:46 - 00001286 _____ C:\Users\Public\Desktop\HP Solution Center.lnk

2013-12-23 16:46 - 2013-12-23 16:46 - 00000000 ____D C:\ProgramData\HP Product Assistant

2013-12-23 16:41 - 2013-12-23 16:41 - 00000000 ____D C:\Program Files\HP

2013-12-18 07:25 - 2013-12-18 07:25 - 00002183 _____ C:\Users\Public\Desktop\Google Earth.lnk

2013-12-18 07:25 - 2010-08-29 23:43 - 00000000 ____D C:\Program Files (x86)\Google

2013-12-17 14:13 - 2013-12-17 09:35 - 00000000 ____D C:\Users\Mike\Documents\Flower City Communications Files

2013-12-17 10:45 - 2011-09-02 08:50 - 00000000 ____D C:\Users\Mike\Documents\Wegmans MOTOTRBO

2013-12-17 07:14 - 2013-07-13 02:00 - 00000000 ____D C:\windows\system32\MRT

2013-12-17 07:11 - 2011-05-31 07:12 - 90708896 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-12-12 15:22 - 2013-10-02 13:21 - 00501760 _____ C:\Users\Mike\Desktop\Current Customer List (10-2-13).xls

2013-12-12 08:06 - 2011-05-27 09:19 - 00889812 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2013-12-12 07:19 - 2012-04-04 09:50 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-12-11 09:51 - 2011-05-27 08:18 - 00000088 _____ C:\windows\QBChanUtil_Trigger.ini

2013-12-11 09:49 - 2012-04-04 06:09 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-12-11 09:49 - 2012-04-04 06:09 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-12-11 09:49 - 2011-10-03 07:58 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-10 17:21 - 2009-07-13 22:20 - 00000000 ____D C:\windows\system32\NDF

2013-12-05 11:28 - 2013-12-05 11:28 - 00000000 ____D C:\Users\Mike\AppData\Local\Deployment

2013-12-05 11:28 - 2013-12-05 11:28 - 00000000 ____D C:\Users\Mike\AppData\Local\Apps\2.0

2013-12-05 11:28 - 2012-09-28 08:55 - 00000000 ____D C:\Users\Mike\AppData\Local\Citrix

Some content of TEMP:

====================

C:\Users\Mike\AppData\Local\Temp\air236B.exe

C:\Users\Mike\AppData\Local\Temp\air8D04.exe

C:\Users\Mike\AppData\Local\Temp\airC012.exe

C:\Users\Mike\AppData\Local\Temp\airDEFB.exe

C:\Users\Mike\AppData\Local\Temp\BackupSetup.exe

C:\Users\Mike\AppData\Local\Temp\BetOnline Updater.exe

C:\Users\Mike\AppData\Local\Temp\install_flashplayer11x32axau_gtba_chra_dy_aaa_aih[1].exe

C:\Users\Mike\AppData\Local\Temp\tbFree.dll

C:\Users\Mike\AppData\Local\Temp\tbInte.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-12-12 10:23

==================== End Of Log ============================

Addition.txt

kevinf80 · January 3, 2014

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Next,

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Full scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log...

Next,

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Uncheck any elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review.
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted (if necessary):
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Post those logs, let me know if any change/improvement..

Kevin

fixlist.txt

Sarge · January 4, 2014

Logs :

ix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-01-2014

Ran by Mike at 2014-01-03 18:14:15 Run:1

Running from F:\Installers\Security stuff

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Start

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-11-08] (APN LLC.)

C:\Program Files (x86)\AskPartnerNetwork

2014-01-02 10:09 - 2014-01-02 10:09 - 00037376 _____ C:\windows\system32\vgojd.ynw

2014-01-02 09:59 - 2014-01-03 12:46 - 00000083 _____ C:\windows\system32\qqcao.cyn

2014-01-02 09:58 - 2014-01-02 10:09 - 00000097 _____ C:\windows\system32\wiuu.upx

2014-01-02 09:58 - 2014-01-02 09:58 - 00000064 _____ C:\windows\system32\ghyjwn.eyt

2014-01-02 09:42 - 2014-01-02 09:42 - 00219314 ____S C:\windows\system32\wrukyso.gcj

C:\Users\Mike\AppData\Local\Temp\air236B.exe

C:\Users\Mike\AppData\Local\Temp\air8D04.exe

C:\Users\Mike\AppData\Local\Temp\airC012.exe

C:\Users\Mike\AppData\Local\Temp\airDEFB.exe

C:\Users\Mike\AppData\Local\Temp\BackupSetup.exe

C:\Users\Mike\AppData\Local\Temp\BetOnline Updater.exe

C:\Users\Mike\AppData\Local\Temp\install_flashplayer11x32axau_gtba_chra_dy_aaa_aih[1].exe

C:\Users\Mike\AppData\Local\Temp\tbFree.dll

C:\Users\Mike\AppData\Local\Temp\tbInte.dll

AlternateDataStreams: C:\ProgramData\TEMP:D346F792

End

*****************

APNMCP => Service deleted successfully.

C:\Program Files (x86)\AskPartnerNetwork => Moved successfully.

C:\windows\system32\vgojd.ynw => Moved successfully.

C:\windows\system32\qqcao.cyn => Moved successfully.

Could not move "C:\windows\system32\wiuu.upx" => Scheduled to move on reboot.

C:\windows\system32\ghyjwn.eyt => Moved successfully.

Could not move "C:\windows\system32\wrukyso.gcj" => Scheduled to move on reboot.

"C:\Users\Mike\AppData\Local\Temp\air236B.exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\air8D04.exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\airC012.exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\airDEFB.exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\BackupSetup.exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\BetOnline Updater.exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\install_flashplayer11x32axau_gtba_chra_dy_aaa_aih[1].exe" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\tbFree.dll" => File/Directory not found.

"C:\Users\Mike\AppData\Local\Temp\tbInte.dll" => File/Directory not found.

C:\ProgramData\TEMP => ":D346F792" ADS removed successfully.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-01-03 18:15:44)<=

"C:\windows\system32\wiuu.upx" => File could not move.

"C:\windows\system32\wrukyso.gcj" => File could not move.

==== End of Fixlog ====

Malwarebytes Anti-Malware (PRO) 1.75.0.1300

www.malwarebytes.org

Database version: v2014.01.03.03

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

Mike :: MIKE-LAPTOP [administrator]

Protection: Enabled

1/3/2014 6:17:17 PM

mbam-log-2014-01-03 (18-17-17).txt

Scan type: Full scan (C:\|)

Scan options disabled: P2P

Objects scanned: 421987

Time elapsed: 1 hour(s), 9 minute(s), 34 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

# AdwCleaner v3.016 - Report created 03/01/2014 at 19:28:25

# Updated 23/12/2013 by Xplode

# Operating System : Windows 7 Home Premium (64 bits)

# Username : Mike - MIKE-LAPTOP

# Running from : F:\Installers\Security stuff\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\END

File Found : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage

File Found : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage-journal

File Found : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage

File Found : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage-journal

Folder Found : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeedhehdfjahfpjhaedmaohbfcdkoolg

Folder Found : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nemfjadlboooiffmcelkafilagddogim

Folder Found C:\Program Files (x86)\Conduit

Folder Found C:\Program Files (x86)\MyPC Backup

Folder Found C:\ProgramData\apn

Folder Found C:\ProgramData\AskPartnerNetwork

Folder Found C:\ProgramData\Partner

Folder Found C:\Users\Mike\AppData\Local\apn

Folder Found C:\Users\Mike\AppData\Local\AskPartnerNetwork

Folder Found C:\Users\Mike\AppData\Local\Conduit

Folder Found C:\Users\Mike\AppData\LocalLow\Conduit

Folder Found C:\Users\Mike\AppData\LocalLow\PriceGong

Folder Found C:\Users\Mike\AppData\Roaming\pccustubinstaller

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Found : HKCU\Software\AppDataLow\Software\PriceGong

Key Found : HKCU\Software\AppDataLow\Software\RewardsArcade

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\AskPartnerNetwork

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Cr_Installer

Key Found : HKCU\Software\Google\Chrome\Extensions\jeedhehdfjahfpjhaedmaohbfcdkoolg

Key Found : HKCU\Software\Google\Chrome\Extensions\nemfjadlboooiffmcelkafilagddogim

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5911488E-9D1E-40EC-8CBB-06B231CC153F}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13D095-45C3-4271-9475-F3B48227DD9F}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8736C681-37A0-40C6-A0F0-4C083409151C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5911488E-9D1E-40EC-8CBB-06B231CC153F}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13D095-45C3-4271-9475-F3B48227DD9F}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D8278076-BC68-4484-9233-6E7F1628B56C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Softonic

Key Found : HKCU\Software\Zugo

Key Found : [x64] HKCU\Software\AskPartnerNetwork

Key Found : [x64] HKCU\Software\Conduit

Key Found : [x64] HKCU\Software\Cr_Installer

Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

Key Found : [x64] HKCU\Software\Softonic

Key Found : [x64] HKCU\Software\Zugo

Key Found : HKLM\Software\AskPartnerNetwork

Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}

Key Found : HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}

Key Found : HKLM\SOFTWARE\Classes\RewardsArcade.BHO

Key Found : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox

Key Found : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox.1

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3266331

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3289663

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9945959C-AAD8-4312-8B57-2DE11927E770}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jeedhehdfjahfpjhaedmaohbfcdkoolg

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\nemfjadlboooiffmcelkafilagddogim

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_google-earth[1]_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_google-earth[1]_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : [x64] HKLM\SOFTWARE\AskPartnerNetwork

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D8278076-BC68-4484-9233-6E7F1628B56C}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Found : HKLM\SOFTWARE\mozilla\Firefox\Extensions [crossriderapp498@crossrider.com]

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7600.17267

-\\ Google Chrome v

[ File : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : icon_url

Found : search_url

Found : suggest_url

Found : keyword

Found : search_url

Found : icon_url

Found : search_url

Found : suggest_url

Found : keyword

*************************

AdwCleaner[R0].txt - [10200 octets] - [03/01/2014 19:28:25]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [10261 octets] ##########

kevinf80 · January 4, 2014

Re-run AdwareCleaner, this time also use the "Clean" option and remove all of the "found" entries identified in last log.

Next,

Re-run FRST and post a fresh log. Can you also tell me if the original issue is still present?

Sarge · January 4, 2014

I think maybe that did it......all is quiet at the moment.....

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2014

Ran by Mike (administrator) on MIKE-LAPTOP on 04-01-2014 07:07:35