Jump to content

Hijackthis Log Help: Ads

Kevinn95
 Share

Recommended Posts

Kevinn95

Kevinn95

Posted
Posted

Can you stop the ads that constantly pop up when I click something? Plus anything else that is bad.

 

 

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:54:24 PM, on 2/28/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16518)
Boot mode: Normal
 
Running processes:
C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
C:\Program Files (x86)\Dell V310-V510 Series\dleamon.exe
C:\Program Files (x86)\Dell V310-V510 Series\ezprint.exe
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe
C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Nero\SyncUP\SyncUP.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:13828
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Dell Toolbar - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Printable Web\toolband.dll
O2 - BHO: SaveSense - {2e32cfe5-df92-4ae5-b0be-609ed0df74a6} - C:\Program Files (x86)\SaveSense\SaveSenseIE.dll (file missing)
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O2 - BHO: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Dell Toolbar - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Printable Web\toolband.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
O4 - HKLM\..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
O4 - HKLM\..\Run: [RemoteControl9] "c:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "c:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"
O4 - HKLM\..\Run: [bDRegion] c:\Program Files (x86)\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
O4 - HKLM\..\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [NeroLauncher] C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe 900
O4 - HKLM\..\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
O4 - HKLM\..\Run: [brStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
O4 - HKLM\..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
O4 - HKLM\..\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [spUninstallDeleteDir] rmdir /s /q "\SearchProtect" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [spUninstallDeleteDir] rmdir /s /q "\SearchProtect" (User 'Default user')
O4 - Startup: Intel® Turbo Boost Technology Monitor 2.0.lnk = C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - https://support.dell.com/systemprofiler/SysProExe.CAB
O18 - Protocol: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrYNSvc - Brother Industries, Ltd. - C:\Program Files (x86)\Browny02\BrYNSvc.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: CyberLink Product - 2012/06/02 08:35:23 (CLKMSVC10_9EC60124) - CyberLink - c:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe
O23 - Service: dleaCATSCustConnectService - Unknown owner - C:\Windows\system32\spool\DRIVERS\x64\3\\dleaserv.exe
O23 - Service: dlea_device -   - C:\Windows\system32\dleacoms.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Dell DataSafe Online (NOBU) - Dell, Inc. - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Re-Markable - Unknown owner - C:\Program Files (x86)\Re-Markable\Re-Markable154.exe
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: RoxMediaDB12OEM - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
O23 - Service: Roxio Hard Drive Watcher 12 (RoxWatch12) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SavingsbullFilterService64 - Unknown owner - c:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Intel® Turbo Boost Technology Monitor 2.0 (TurboBoost) - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 
--
End of file - 17127 bytes
 
Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

First:

Please run a Quick Scan with Malwarebytes like this and post the log:

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

---------------------

Then please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt (DDS won't run on W8)

(please don't put logs in code or quotes and use the default font)

(Please don't forget to run the RogueKiller scan below)

General Forum P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites
Kevinn95

Kevinn95

Posted
  • Author
Posted
Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

 

Database version: v2014.03.01.06

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16518

Rashawn :: ORTIZ-PC [administrator]

 

Protection: Enabled

 

3/1/2014 2:44:11 PM

mbam-log-2014-03-01 (14-44-11).txt

 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 293102

Time elapsed: 11 minute(s), 4 second(s)

 

Memory Processes Detected: 1

C:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe (PUP.Optional.SavingsBull.A) -> 2832 -> Delete on reboot.

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 12

HKCR\Typelib\{FBC322D5-407E-4854-8C0B-555B951FD8E3} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.

HKCR\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.

HKLM\SYSTEM\CurrentControlSet\Services\SavingsbullFilterService64 (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\GorillaPrice (PUP.Optional.GorillaPrice.A) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\SaveSense (PUP.Optional.SaveSense.A) -> Quarantined and deleted successfully.

HKCU\Software\SavingsBull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

HKCU\Software\AppDataLow\Software\Savings Bull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

HKCU\Software\AppDataLow\Software\SavingsBull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\GorillaPrice (PUP.Optional.GorillaPrice.A) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\SaveSense (PUP.Optional.SaveSense.A) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\SavingsbullFilter (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.wajam.chrome.messaging.host (PUP.Optional.Wajam.A) -> Quarantined and deleted successfully.

 

Registry Values Detected: 1

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer (PUM.Bad.Proxy) -> Data: http=127.0.0.1:13828 -> Quarantined and deleted successfully.

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 5

C:\Program Files\SavingsbullFilter (PUP.Optional.SavingsBull.A) -> Delete on reboot.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\plugins (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Roaming\freegames4357 (PUP.Optional.FreeGames.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

 

Files Detected: 196

C:\Users\Rashawn\Desktop\setup.exe (PUP.Optional.PremiumApps.A) -> Quarantined and deleted successfully.

C:\$Recycle.Bin\S-1-5-21-1420903912-3880237241-328177655-1004\$R09J1BT.exe (PUP.Optional.InstalleRex) -> Quarantined and deleted successfully.

C:\$Recycle.Bin\S-1-5-21-1420903912-3880237241-328177655-1004\$R80X1BC.exe (PUP.Optional.InstalleRex) -> Quarantined and deleted successfully.

C:\$Recycle.Bin\S-1-5-21-1420903912-3880237241-328177655-1004\$R8RHI9D.exe (PUP.Optional.InstalleRex) -> Quarantined and deleted successfully.

C:\Windows\System32\rlls.dll (PUP.Optional.RelevantKnowledge) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\CSM2922.tmp (PUP.Optional.RelevantKnowledge) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\mconduitinstaller.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\mism.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsf545B.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsf9063.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsf94A8.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsi93DA.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsjCDF1.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsp307B.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nssE7A8.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsu1EEB.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nswC16E.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsx97E0.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsxEBFC.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsz5748.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsz7BBA.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\sp-downloader.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\SPIdentifier.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\SPSetup.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\SPStub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\Сodec Performer803975.exe (PUP.Optional.InstallBrain.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\07b9374c-f696-48a6-a585-3bd9222bb56f\android.exe (Trojan.Android.NSD) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\07b9374c-f696-48a6-a585-3bd9222bb56f\spidentifierimpl.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\android\android.exe (Trojan.Android.NSD) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\AU\SPSetup.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\c2919c3e-bcb2-4a0c-a643-848b285f8d09\android.exe (Trojan.Android.NSD) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\c2919c3e-bcb2-4a0c-a643-848b285f8d09\software\swa1_23.exe (PUP.Optional.SevereWeatherAlerts) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\c2919c3e-bcb2-4a0c-a643-848b285f8d09\software\tuguu_US_savingsbull_E685B607-05BD-4C58-84D3-D5023CEDA723.exe (PUP.Optional.Savingsbull) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\chLogic.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\ctbe.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\ieLogic.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\spch.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\statisticsStub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\stub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\is45637729\1930688_stp\Mysearchdial.exe (PUP.Optional.MySpeedDial.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\is45637729\4966931_stp\Mysearchdial.exe (PUP.Optional.MySpeedDial.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\is45637729\4966951_stp\FindRightSetup.exe (PUP.Optional.FindRight.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\is838815544\37400027_stp\Mysearchdial.exe (PUP.Optional.MySpeedDial.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsh6827.tmp\SPtool.dll (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\nsi7783\SpSetup.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nsb8845.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nsb911C.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nscEE97.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nsh9A5E.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nshB9FF.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nsm60E.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nsmBABA.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\nssF2EB.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\CodecPerformerSetup.exe (PUP.Optional.InstallBrain.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\Java.exe (PUP.Optional.Outbrowse) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\Kendrick+Lamar+ft.+Mary+J.+Blige+-+Now+Or+Never+%28Lyrics%29.exe (PUP.Optional.InstalleRex) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\Player-Chrome.exe (PUP.Optional.OptimumInstaller.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\Setup (1).exe (PUP.Optional.Solimba) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\Setup (2).exe (PUP.Optional.DomaIQ) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\ShopAtHome_AppCore_7127_C64026199_D1_R92237_B3 (1).exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\ShopAtHome_AppCore_7127_C64026199_D1_R92237_B3.exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\ShopAtHome_AppCore_7127_C64026199_D1_R92270_B3 (1).exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\ShopAtHome_AppCore_7127_C64026199_D1_R92270_B3 (2).exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\ShopAtHome_AppCore_7127_C64026199_D1_R92270_B3.exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\TinyMediaPlayer_RocketFuelInstaller (1).exe (PUP.Optional.RocketFuel.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\TinyMediaPlayer_RocketFuelInstaller.exe (PUP.Optional.RocketFuel.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Downloads\update.exe (PUP.Optional.OptimumInstaller.A) -> Quarantined and deleted successfully.

C:\Users\ortiz\Local Settings\Temporary Internet Files\Content.IE5\1I2T8B0F\stubinst_pkg_en-us[1].cab (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.

C:\Users\ortiz\Local Settings\Temporary Internet Files\Content.IE5\TIHCSETP\stubinst_pkg_en-us[1].cab (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\2ZT0G5G5\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\2ZT0G5G5\wajam_install[1].exe (PUP.Optional.Wajam) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\6RKBVHL6\SPIdentifierImpl[1].exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\6RKBVHL6\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\6RKBVHL6\spstub[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\ADRWON04\appbario13[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\ADRWON04\checktbexist[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\ADRWON04\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\ADRWON04\statisticsstub[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\FD1ZIT42\conduitinstaller[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\P6AJ6OJW\ClickMeInGeneric[1].exe (PUP.Optional.Clickmein) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\UAO6OIFA\appbario13[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\Local Settings\Temporary Internet Files\Content.IE5\XL5PL944\Setup[1].exe (PUP.Optional.FindRight.A) -> Quarantined and deleted successfully.

C:\Program Files\SavingsbullFilter\sample.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files\SavingsbullFilter\Installbat64.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files\SavingsbullFilter\Microsoft.Deployment.WindowsInstaller.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files\SavingsbullFilter\Microsoft.Deployment.WindowsInstaller.xml (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files\SavingsbullFilter\nfapi.dll (PUP.Optional.SavingsBull.A) -> Delete on reboot.

C:\Program Files\SavingsbullFilter\nfregdrv.exe (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files\SavingsbullFilter\ProtocolFilters.dll (PUP.Optional.SavingsBull.A) -> Delete on reboot.

C:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe (PUP.Optional.SavingsBull.A) -> Delete on reboot.

C:\Windows\Tasks\Re-Markable Update.job (PUP.Optional.ReMarkable.A) -> Quarantined and deleted successfully.

C:\Windows\System32\rlls.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\SysWOW64\rlls.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\chromeid.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\CT3279412.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\initdata.json (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\manifest.json (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\setup.ini.txt (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Local\Temp\ct3279412\plugins\TBVerifier.dll (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Roaming\freegames4357\freegames4357.crx (PUP.Optional.FreeGames.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Roaming\freegames4357\freegames4357DeskTopIcon.ico (PUP.Optional.FreeGames.A) -> Quarantined and deleted successfully.

C:\Users\Rashawn\AppData\Roaming\freegames4357\install_helper.exe (PUP.Optional.FreeGames.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\bootstrap.js.old (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\CustomActionInstall (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\CustomActionUninstall (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_addonkit_page-mod.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_addonkit_private-browsing.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_addonkit_request.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_addonkit_windows.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_addon_runner.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_api-utils.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_base64.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_byte-streams.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_collection.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_content.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_cortex.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_cuddlefish.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_deprecate.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_environment.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_errors.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_events.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_file.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_functional.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_globals.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_heritage.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_hidden-frame.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_light-traits.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_list.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_loader.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_match-pattern.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_memory.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_namespace.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_observer-service.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_plain-text-console.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_preferences-service.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_promise.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_querystring.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_runtime.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_sandbox.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_self.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_system.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_text-streams.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_timer.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_traceback.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_traits.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_unload.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_url.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_uuid.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_window-utils.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_xhr.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_xpcom.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_base_xul-app.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_bootstrap.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_content_content-proxy.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_content_content-worker.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_content_loader.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_content_symbiont.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_content_worker.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_dom_events.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_events_assembler.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_event_core.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_event_target.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_harness-options.json (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_icon.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_icon64.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_install.rdf (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_l10n_core.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_l10n_html.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_l10n_loader.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_l10n_locale.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_l10n_prefs.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_locales.json (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_main.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_main.js.old (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_prefs.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_privatebrowsing_utils.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_system_events.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_tabs_events.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_tabs_observer.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_tabs_tab.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_tabs_utils.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_traits_core.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_utils_data.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_utils_object.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_utils_registry.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_utils_thumbnail.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_windows_dom.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_windows_loader.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_windows_observer.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_windows_tabs.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\ff_window_utils.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\IEOptimizer.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\IEOptimizer64.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\Microsoft.Deployment.WindowsInstaller.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\Microsoft.Deployment.WindowsInstaller.xml (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\SavingsBull\SendJson.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

 

(end)
Link to post
Share on other sites
Kevinn95

Kevinn95

Posted
  • Author
Posted
RogueKiller V8.8.10 [Feb 28 2014] by Adlice Software





 

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Rashawn [Admin rights]

Mode : Scan -- Date : 03/01/2014 15:07:27

| ARK || FAK || MBR |

 

¤¤¤ Bad processes : 0 ¤¤¤

 

¤¤¤ Registry Entries : 8 ¤¤¤

[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (hxxp=127.0.0.1:13828 [Country: (Private Address) (XX), City: (Private Address)]) -> FOUND

[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableTaskMgr (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

 

¤¤¤ Scheduled tasks : 0 ¤¤¤

 

¤¤¤ Startup Entries : 0 ¤¤¤

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ Browser Addons : 0 ¤¤¤

 

¤¤¤ Particular Files / Folders: ¤¤¤

 

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

 

¤¤¤ External Hives: ¤¤¤

 

¤¤¤ Infection :  ¤¤¤

 

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

 

 

 

 

¤¤¤ MBR Check: ¤¤¤

 

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9750420AS +++++

--- User ---

[MBR] c4d441a27258bc95be2bbf548713c1b2

[bSP] dea9defa67a18cc486b8c709b2ee22f0 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 101 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 212992 | Size: 20000 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 41172992 | Size: 695299 Mo

User = LL1 ... OK!

User = LL2 ... OK!

 

Finished : << RKreport[0]_S_03012014_150727.txt >>
Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please do this:

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner from HERE or HERE to your desktop.

  • Double click on AdwCleaner.exe to run the tool.

    Vista/Windows 7/8 users right-click and select Run As Administrator

  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
Then.........

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

reply1.jpg

New window that comes up.

replyer1.jpg

MrC

Link to post
Share on other sites
Kevinn95

Kevinn95

Posted
  • Author
Posted
# AdwCleaner v3.020 - Report created 01/03/2014 at 16:54:52

# Updated 27/02/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Rashawn - ORTIZ-PC

# Running from : C:\Users\Rashawn\Downloads\adwcleaner (2).exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

File Deleted : C:\Users\Rashawn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage

File Deleted : C:\Users\Rashawn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.16518

 

 

-\\ Google Chrome v33.0.1750.117

 

[ File : C:\Users\ortiz\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

[ File : C:\Users\Rashawn\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [16311 octets] - [25/02/2014 19:48:13]

AdwCleaner[R1].txt - [1439 octets] - [28/02/2014 19:14:45]

AdwCleaner[R2].txt - [1370 octets] - [28/02/2014 19:29:44]

AdwCleaner[R3].txt - [1221 octets] - [28/02/2014 19:34:15]

AdwCleaner[R4].txt - [1554 octets] - [01/03/2014 16:44:12]

AdwCleaner[s0].txt - [15495 octets] - [25/02/2014 19:50:46]

AdwCleaner[s1].txt - [1508 octets] - [28/02/2014 19:18:27]

AdwCleaner[s2].txt - [1435 octets] - [28/02/2014 19:30:34]

AdwCleaner[s3].txt - [1479 octets] - [01/03/2014 16:54:52]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s3].txt - [1539 octets] ##########
Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Download the attached fixlist.txt to the same folder as FRST.

Run FRST.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then......

Clean out temp files: (may require a reboot)

Download TFC from here and save it to your desktop.

http://oldtimer.geekstogo.com/TFC.exe

Close any open programs and Internet browsers.

Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.

Please be patient as clearing out temp files may take a while.

Once it completes you may be prompted to restart your computer, please do so.

Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

Let me know how it is, MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Good........

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC
Link to post
Share on other sites
Kevinn95

Kevinn95

Posted
  • Author
Posted
 Results of screen317's Security Check version 0.99.79  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

 WMI entry may not exist for antivirus; attempting automatic update. 

`````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware version 1.75.0.1300  

 Java 7 Update 51  

 Adobe Reader 10.1.9 Adobe Reader out of Date!  

 Mozilla Thunderbird (24.3.0) 

 Google Chrome 32.0.1700.107  

 Google Chrome 33.0.1750.117  

 Google Chrome EULA Accepted...  

````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes' Anti-Malware mbamscheduler.exe   

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 2% 

````````````````````End of Log`````````````````````` 
Link to post
Share on other sites
Kevinn95

Kevinn95

Posted
  • Author
Posted
 Results of screen317's Security Check version 0.99.79  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

 WMI entry may not exist for antivirus; attempting automatic update. 

`````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware version 1.75.0.1300  

 Java 7 Update 51  

 Adobe Reader 10.1.9 Adobe Reader out of Date!  

 Mozilla Thunderbird (24.3.0) 

 Google Chrome 32.0.1700.107  

 Google Chrome 33.0.1750.117  

 Google Chrome EULA Accepted...  

````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes' Anti-Malware mbamscheduler.exe   

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 2% 

````````````````````End of Log`````````````````````` 
Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

------------------------------------------

Adobe Reader 10.1.9 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

---------------------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter. (it may look like CF is re-installing but it's not)
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.
If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (PM also found HERE)

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.