Spigot / Yahoo Redirect

fencergirl · March 20, 2014

Thank you for any help you can provide. My homepage and search engine on Chrome and Firefox are being redirected by this Spigot malware. I ran Malwarebytes and it did find malicious items, which I deleted. (I have those logs if you need them). However, the problem wasn't solved. I just ran a new Quick Scan and nothing was found. If it's ok, I will post my DDS logs.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8

Boot Device: \Device\HarddiskVolume1

Install Date: 8/9/2013 3:18:34 PM

System Uptime: 3/20/2014 2:46:09 AM (12 hours ago)

.

Motherboard: ASUSTeK COMPUTER INC. | | K55VJ

Processor: Intel® Core i7-3630QM CPU @ 2.40GHz | SOCKET 0 | 1200/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 373 GiB total, 195.324 GiB free.

D: is FIXED (NTFS) - 538 GiB total, 537.727 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP45: 2/23/2014 2:55:39 PM - Windows Modules Installer

RP46: 3/3/2014 8:35:00 PM - Scheduled Checkpoint

RP47: 3/12/2014 10:38:29 PM - Windows Update

RP48: 3/15/2014 8:13:43 PM - Installed AVG 2014

.

==== Installed Programs ======================

.

7-Zip 9.22beta

Adobe Creative Cloud

Adobe Flash Player 12 Plugin

Adobe Illustrator CC

Adobe Reader XI (11.0.06)

Advanced SystemCare 7

Amazon Cloud Player

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS Instant Connect

ASUS InstantOn

ASUS LifeFrame3

ASUS Power4Gear Hybrid

ASUS Smart Gesture

ASUS Splendid Video Enhancement Technology

ASUS Tutor

ASUS USB Charger Plus

ASUS WebStorage Sync Agent

ASUSDVD

AsusVibe2.0

ATK Package

AVG 2014

Bonjour

Gmail

Google Chrome

Google Update Helper

HitmanPro 3.7

Intel® Management Engine Components

Intel® Processor Graphics

Intel® SDK for OpenCL - CPU Only Runtime Package

Intel® Trusted Connect Service Client

IObit Apps Toolbar v8.8

IObit Uninstaller

iTunes

Java 7 Update 25

Java Auto Updater

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft Office 365 Home Premium - en-us

Microsoft Silverlight

Microsoft SkyDrive

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 27.0.1 (x86 en-US)

Mozilla Maintenance Service

NVIDIA 3D Vision Driver 306.97

NVIDIA Control Panel 306.97

NVIDIA Graphics Driver 306.97

NVIDIA HD Audio Driver 1.3.18.0

NVIDIA Install Application

NVIDIA Optimus 1.10.8

NVIDIA PhysX

NVIDIA PhysX System Software 9.12.0613

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 1.10.8

NVIDIA Update Components

Office 15 Click-to-Run Extensibility Component

Office 15 Click-to-Run Licensing Component

Office 15 Click-to-Run Localization Component

OpenOffice 4.0.0

PDF Settings CC

Pharos

Pokki

Pokki Download Helper

Qualcomm Atheros Client Installation Program

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Realtek PCIE Card Reader

Scrivener

Shared C Run-time for x64

Speccy

SUPERAntiSpyware

Surfing Protection

Update for Japanese Microsoft IME Postal Code Dictionary

Update for Japanese Microsoft IME Standard Dictionary

Update for Japanese Microsoft IME Standard Extended Dictionary

Visual Studio 2010 x64 Redistributables

Visual Studio 2012 x64 Redistributables

Visual Studio 2012 x86 Redistributables

Windows Driver Package - ASUS (ATP) Mouse (10/29/2012 1.0.0.148)

WinFlash

WinRAR 5.01 (64-bit)

.

==== Event Viewer Messages From Past Week ========

.

3/20/2014 2:47:07 AM, Error: Service Control Manager [7000] - The McAfee Boot Delay Start Service service failed to start due to the following error: The system cannot find the file specified.

3/20/2014 12:55:23 AM, Error: Service Control Manager [7034] - The LiveUpdate service terminated unexpectedly. It has done this 1 time(s).

3/20/2014 12:55:23 AM, Error: Service Control Manager [7034] - The Advanced SystemCare Service 7 service terminated unexpectedly. It has done this 1 time(s).

3/20/2014 1:50:08 PM, Error: Service Control Manager [7022] - The NVIDIA Update Service Daemon service hung on starting.

3/17/2014 9:27:22 PM, Error: Tcpip [4199] - The system detected an address conflict for IP address 0.0.0.0 with the system having network hardware address 00-00-00-00-00-00. Network operations on this system may be disrupted as a result.

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16843 BrowserJavaVersion: 10.25.2

Run by Alexa at 14:57:27 on 2014-03-20

Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8077.5144 [GMT -7:00]

.

AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

.

============== Running Processes ===============

.

C:\PROGRA~2\AVG\AVG2014\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\dwm.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe

C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe

C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Windows\system32\dashost.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe

C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe

C:\PROGRA~2\PharosSystems\Core\CTskMstr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe

C:\Windows\system32\taskhostex.exe

C:\Program Files (x86)\IObit\Advanced SystemCare 7\Monitor.exe

C:\Program Files\ASUS\P4G\BatteryLife.exe

C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe

C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe

C:\Users\Alexa\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

C:\Program Files (x86)\AVG\AVG2014\avgui.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\SysWOW64\ACEngSvr.exe

C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe

C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe

C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uURLSearchHooks: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\8.8\iobitappsToolbarIE.dll

mWinlogon: Userinit = userinit.exe,

BHO: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\8.8\iobitappsToolbarIE.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL

BHO: Advanced SystemCare Browser Protection: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\8.8\iobitappsToolbarIE.dll

uRun: [Pokki] C:\Windows\System32\rundll32.exe "C:\Users\Alexa\AppData\Local\Pokki\Engine\Launcher.dll",RunLaunchPlatform

uRun: [Advanced SystemCare 7] "C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe" /Auto

uRun: [Amazon Cloud Player] "C:\Users\Alexa\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe"

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

uRunOnce: [Application Restart #3] C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Alexa\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session

uRunOnce: [Application Restart #2] C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --appletID=AppsPanel_BL --appletVersion=1.0 --mode=LBS --helperBridgeName={B7C30866-4224-4FBD-88DC-CF972C9D029F} --helperPath=C:\Users\Alexa\AppData\Local\Temp\\Creative Cloud Helper.exe --lbsWorkflowID={0E177A22-2077-4730-8611-037F299334C1} --inputXmlPath="C:\Users\Alexa\AppData\Local\Temp\{00CCBD93-135E-46B2-88ED-5B11A2F29928}" /RestartByRestartManager:93E9F493-6A8A-4dc7-AE08-5A21C5254E07

mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"

mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe /S

mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Adobe Creative Cloud] "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true

mRun: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe

IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{BE43DA2A-E600-4B08-800A-785E1ADDE6D5} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{BE43DA2A-E600-4B08-800A-785E1ADDE6D5}\2375942554636323 : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{BE43DA2A-E600-4B08-800A-785E1ADDE6D5}\34963736F61363035323D27657563747 : DHCPNameServer = 192.168.3.1

TCP: Interfaces\{BE43DA2A-E600-4B08-800A-785E1ADDE6D5}\3796D607C65607C656163757275637 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{BE43DA2A-E600-4B08-800A-785E1ADDE6D5}\84F4D454D203345323 : DHCPNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{BE43DA2A-E600-4B08-800A-785E1ADDE6D5}\E45445745414254313 : DHCPNameServer = 192.168.1.1

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL

AppInit_DLLs= C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll, C:\Windows\SysWOW64\nvinit.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: ExplorerWnd Helper: {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll

x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll

x64-BHO: Slick Savings: {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL

x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL

x64-TB: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\8.8\iobitappsToolbarIE64.dll

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [ACMON] C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll

x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Alexa\AppData\Roaming\Mozilla\Firefox\Profiles\emc3uep5.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo!

FF - plugin: C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll

FF - plugin: C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\npsitesafety.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL

FF - plugin: C:\Users\Alexa\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: content.notify.ontimer - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.switch.threshold - 750000

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\Drivers\avgidsha.sys [2013-11-25 196376]

R0 Avgloga;AVG Logging Driver;C:\Windows\System32\Drivers\avgloga.sys [2013-10-31 294712]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\Drivers\avgmfx64.sys [2013-10-1 123704]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\Drivers\avgrkx64.sys [2013-9-10 31544]

R0 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2012-7-5 645952]

R0 nvpciflt;nvpciflt;C:\Windows\System32\Drivers\nvpciflt.sys [2012-10-8 30056]

R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536]

R1 Avgdiska;AVG Disk Driver;C:\Windows\System32\Drivers\avgdiska.sys [2013-11-25 150808]

R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\Drivers\avgidsdrivera.sys [2013-11-25 243480]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\Drivers\avgldx64.sys [2013-11-1 212280]

R1 Avgwfpa;AVG Firewall Driver;C:\Windows\System32\Drivers\avgwfpa.sys [2013-10-21 252728]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-10-10 144152]

R2 AdvancedSystemCareService7;Advanced SystemCare Service 7;C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe [2014-2-8 881440]

R2 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2014-2-19 807800]

R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]

R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [2012-4-13 277120]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [2014-1-22 3788816]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [2013-9-24 348008]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2012-11-10 166720]

R2 LiveUpdateSvc;LiveUpdate;C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2013-10-29 2151200]

R2 OfficeSvc;Microsoft Office Service;C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2014-1-22 1907896]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-2 382824]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-11-10 365376]

R3 AiCharger;ASUS Charger Driver;C:\Windows\System32\Drivers\AiCharger.sys [2012-7-24 17152]

R3 ATP;ASUS PS/2 Port Input Device;C:\Windows\System32\Drivers\AsusTP.sys [2012-10-31 61824]

R3 HIDSwitch;ASUS Wireless Radio Control;C:\Windows\System32\Drivers\AsHIDSwitch64.sys [2012-9-4 21152]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\Drivers\IntcDAud.sys [2012-9-4 342528]

R3 RSBASTOR;Realtek PCIE CardReader Driver - BA;C:\Windows\System32\Drivers\RtsBaStor.sys [2012-11-10 294544]

R3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2012-11-10 683664]

S0 Avgboota;AVG Early Launch Anti-Malware Driver;C:\Windows\System32\Drivers\avgboota.sys [2013-9-4 20496]

S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

S2 mcbootdelaystartsvc;McAfee Boot Delay Start Service;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc --> C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]

S3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-25 198656]

.

=============== File Associations ===============

.

FileExt: .txt: txtfile=C:\Windows\System32\NOTEPAD.EXE %1 [userChoice]

.

=============== Created Last 30 ================

.

2014-03-20 21:29:12 -------- d-----w- C:\Users\Alexa\AppData\Roaming\SUPERAntiSpyware.com

2014-03-20 21:28:47 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2014-03-20 21:28:47 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2014-03-16 23:53:25 78304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-03-16 23:53:25 694240 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2014-03-13 03:32:42 4036608 ----a-w- C:\Windows\System32\win32k.sys

2014-03-09 06:48:23 -------- d-----w- C:\Program Files\iPod

2014-03-09 06:48:22 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-03-09 06:48:22 -------- d-----w- C:\Program Files\iTunes

2014-03-09 06:48:22 -------- d-----w- C:\Program Files (x86)\iTunes

2014-03-06 00:14:47 -------- d-----w- C:\Users\Alexa\AppData\Local\Microsoft Help

2014-02-22 07:02:04 -------- d-----w- C:\Program Files (x86)\Application Updater

2014-02-22 07:02:03 -------- d-----w- C:\Program Files (x86)\IObit Apps Toolbar

2014-02-20 07:11:24 -------- d-----w- C:\Users\Alexa\AppData\Roaming\PDAppFlex

2014-02-20 07:11:08 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe

2014-02-19 05:10:19 -------- d-----w- C:\ProgramData\ALM

.

==================== Find3M ====================

.

2014-03-20 09:48:47 408 ----a-w- C:\Users\Alexa\AppData\Roaming\sp_data.sys

2014-02-23 08:13:41 2241536 ----a-w- C:\Windows\System32\wininet.dll

2014-02-23 08:13:31 915968 ----a-w- C:\Windows\System32\uxtheme.dll

2014-02-23 08:13:31 53760 ----a-w- C:\Windows\System32\UXInit.dll

2014-02-23 08:11:59 3960320 ----a-w- C:\Windows\System32\jscript9.dll

2014-02-23 08:11:52 67072 ----a-w- C:\Windows\System32\iesetup.dll

2014-02-23 08:11:52 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2014-02-23 06:54:46 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2014-02-23 06:54:37 44032 ----a-w- C:\Windows\SysWow64\UXInit.dll

2014-02-23 06:53:22 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll

2014-02-23 06:53:18 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2014-02-23 06:53:18 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2014-02-23 06:35:36 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2014-02-23 06:31:25 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2014-02-23 04:06:33 534528 ----a-w- C:\Windows\SysWow64\uxtheme.dll

2014-02-05 23:41:39 595968 ----a-w- C:\Windows\System32\qedit.dll

2014-02-05 23:37:51 496640 ----a-w- C:\Windows\SysWow64\qedit.dll

2014-01-31 00:48:33 1339392 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll

2014-01-31 00:06:01 1628160 ----a-w- C:\Windows\System32\WindowsCodecs.dll

2014-01-16 03:33:45 688640 ----a-w- C:\Windows\System32\WSShared.dll

2014-01-16 03:33:45 562688 ----a-w- C:\Windows\SysWow64\WSShared.dll

2014-01-16 03:33:45 163840 ----a-w- C:\Windows\System32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-16 03:33:45 124928 ----a-w- C:\Windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-16 03:33:24 83968 ----a-w- C:\Windows\System32\drivers\hidclass.sys

2014-01-12 23:30:39 2032640 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2014-01-12 23:30:18 2238976 ----a-w- C:\Windows\System32\d3d10warp.dll

2013-12-25 02:04:43 588288 ----a-w- C:\Windows\System32\SHCore.dll

2013-12-25 02:04:43 452608 ----a-w- C:\Windows\SysWow64\SHCore.dll

2013-12-25 02:04:42 915968 ----a-w- C:\Windows\System32\MPSSVC.dll

2013-12-25 02:04:42 86016 ----a-w- C:\Windows\SysWow64\davclnt.dll

2013-12-25 02:04:42 758784 ----a-w- C:\Windows\System32\FirewallAPI.dll

2013-12-25 02:04:42 74752 ----a-w- C:\Windows\System32\drivers\mpsdrv.sys

2013-12-25 02:04:42 550400 ----a-w- C:\Windows\SysWow64\FirewallAPI.dll

2013-12-25 02:04:42 227840 ----a-w- C:\Windows\System32\WebClnt.dll

2013-12-25 02:04:42 199168 ----a-w- C:\Windows\SysWow64\WebClnt.dll

2013-12-25 02:04:42 104448 ----a-w- C:\Windows\System32\davclnt.dll

2013-12-25 02:04:42 100696 ----a-w- C:\Windows\System32\drivers\disk.sys

.

============= FINISH: 14:57:56.93 ===============

MrCharlie · March 20, 2014

Welcome to the forum.

Did you recently install Advanced SystemCare 7 ??

Please run a Quick Scan with Malwarebytes like this and post the log:
Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.
Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.
Make sure that everything is checked, and click Remove Selected.

---------------------

Then........

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.
For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.
When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.
(please don't put logs in code or quotes and use the default font)

General Forum P2P/Piracy Warning:

MrC

Note:
Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------
(If I don't respond within 24 hours, please send me a PM)

fencergirl · March 21, 2014

Thank you very much (and sorry about the duplicate post). Hm no I've had Advanced SystemCare for a while I think.

Malwarebytes:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.20.02

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16843

Alexa :: ALEXAPC [administrator]

3/20/2014 2:42:35 PM

mbam-log-2014-03-20 (14-42-35).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 249961

Time elapsed: 7 minute(s), 29 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Rogue Killer:

RogueKiller V8.8.12 _x64_ [Mar 20 2014] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version

Started in : Normal mode

User : Alexa [Admin rights]

Mode : Scan -- Date : 03/20/2014 15:15:14

| ARK || FAK || MBR |

¤¤¤ Bad processes : 3 ¤¤¤

[sUSP PATH][DLL] explorer.exe -- C:\Users\Alexa\AppData\Local\Pokki\ocdeskband_1.dll [x] -> UNLOADED

[sUSP PATH] pokki.exe -- C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe [7] -> KILLED [TermProc]

[sUSP PATH] pokki.exe -- C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe [7] -> KILLED [TermThr]

¤¤¤ Registry Entries : 6 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\RunOnce : Application Restart #3 (C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Alexa\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session [7][-]) -> FOUND

[RUN][sUSP PATH] HKCU\[...]\RunOnce : Application Restart #2 (C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --appletID=AppsPanel_BL --appletVersion=1.0 --mode=LBS --helperBridgeName={B7C30866-4224-4FBD-88DC-CF972C9D029F} --helperPath=C:\Users\Alexa\AppData\Local\Temp\\Creative Cloud Helper.exe --lbsWorkflowID={0E177A22-2077-4730-8611-037F299334C1} --inputXmlPath="C:\Users\Alexa\AppData\Local\Temp\{00CCBD93-135E-46B2-88ED-5B11A2F29928}" /RestartByRestartManager:93E9F493-6A8A-4dc7-AE08-5A21C5254E07 [7][x][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1022454136-3497358331-2660885672-1002\[...]\RunOnce : Application Restart #3 (C:\Users\Alexa\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Alexa\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session [7][-]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1022454136-3497358331-2660885672-1002\[...]\RunOnce : Application Restart #2 (C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --appletID=AppsPanel_BL --appletVersion=1.0 --mode=LBS --helperBridgeName={B7C30866-4224-4FBD-88DC-CF972C9D029F} --helperPath=C:\Users\Alexa\AppData\Local\Temp\\Creative Cloud Helper.exe --lbsWorkflowID={0E177A22-2077-4730-8611-037F299334C1} --inputXmlPath="C:\Users\Alexa\AppData\Local\Temp\{00CCBD93-135E-46B2-88ED-5B11A2F29928}" /RestartByRestartManager:93E9F493-6A8A-4dc7-AE08-5A21C5254E07 [7][x][x]) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 2 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 1 ¤¤¤

[FF][PUP] emc3uep5.default : AVG SafeGuard toolbar

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : PUP ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10JPVT-80A1YT0 +++++

--- User ---

[MBR] 5121ed68627e23ab97862d4b9d9f4d5e

[bSP] 4816b00b2e7efa2cda2c0a65fdf3e385 : Empty MBR Code

Partition table:

0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097152 MB

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_03202014_151514.txt >>

MrCharlie · March 21, 2014

Start with this: (make sure you have created a new system restore point)

Please download AdwCleaner from HERE or HERE to your desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Last.........

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

fencergirl · March 21, 2014

Thank you very much. I have attached all the logs.

MrCharlie · March 21, 2014

I'll look over the logs and get back to you in the AM, MrC

MrCharlie · March 21, 2014

I believe there's some setting in Advanced SystemCare that prevents you from changing your home and search engines, please check and turn it off found.

----------------------------

You have to manually change Chromes settings:
https://support.google.com/chrome/answer/2765944?hl=en

CHR DefaultSearchKeyword: yahoo.com search
CHR DefaultSearchProvider: Yahoo
CHR DefaultSearchURL: http://search.yahoo.com/search?fr=chr-greentree_gc&ei=utf-8&ilc=12&type=198484&p={searchTerms}

-----------------------------------------

Download the attached fixlist.txt to the same folder as FRST.
Run FRST.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Let me know how it is, MrC

fencergirl · March 21, 2014

Thank you very much for taking the time to do this. You were right about Advanced SystemCare. It seems to be fixed! Both Chrome and Firefox loaded my regular homepage and search engine.

Here is the fix log:

SearchScopes: HKCU - {70AF5706-EDE8-437C-87D6-43C39E405981} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=198484&p={searchTerms}

FF DefaultSearchEngine: Yahoo!

FF SearchPlugin: C:\Users\Alexa\AppData\Roaming\Mozilla\Firefox\Profiles\emc3uep5.default\searchplugins\yahoo_ff.xml

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Pokki Download Helper) - C:\Users\Alexa\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll No File

CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll No File

CHR HKCU\...\Chrome\Extension: [eihlgbnhhkigaajnpjohgjldcmdhjiol] - C:\Users\Alexa\AppData\Local\CRE\eihlgbnhhkigaajnpjohgjldcmdhjiol.crx [2013-08-14]

CHR HKLM-x32\...\Chrome\Extension: [eihlgbnhhkigaajnpjohgjldcmdhjiol] - C:\Users\Alexa\AppData\Local\CRE\eihlgbnhhkigaajnpjohgjldcmdhjiol.crx [2013-08-14]

U0 msahci;

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.

HKU\S-1-5-21-1022454136-3497358331-2660885672-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Application Restart #3 => Value deleted successfully.

HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70AF5706-EDE8-437C-87D6-43C39E405981} => Key deleted successfully.

HKCR\CLSID\{70AF5706-EDE8-437C-87D6-43C39E405981} => Key not found.

Firefox homepage deleted successfully.

Firefox Keyword.URL deleted successfully.

Firefox DefaultSearchEngine deleted successfully.

C:\Users\Alexa\AppData\Roaming\Mozilla\Firefox\Profiles\emc3uep5.default\searchplugins\yahoo_ff.xml => Moved successfully.

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll not found.

C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll not found.

C:\Users\Alexa\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll not found.

C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll not found.

HKCU\SOFTWARE\Google\Chrome\Extensions\eihlgbnhhkigaajnpjohgjldcmdhjiol => Key deleted successfully.

"C:\Users\Alexa\AppData\Local\CRE\eihlgbnhhkigaajnpjohgjldcmdhjiol.crx" => File/Directory not found.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eihlgbnhhkigaajnpjohgjldcmdhjiol => Key deleted successfully.

"C:\Users\Alexa\AppData\Local\CRE\eihlgbnhhkigaajnpjohgjldcmdhjiol.crx" => File/Directory not found.

msahci => Service deleted successfully.

==== End of Fixlog ====

MrCharlie · March 21, 2014

Good.........

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
If you get Unsupported operating system. Aborting now, just reboot and try again.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

MrC

fencergirl · March 21, 2014

Ok, I ran the check after rebooting. Here is the result:

Results of screen317's Security Check version 0.99.81

x64 (UAC is enabled)

Internet Explorer 10 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Enabled!

AVG AntiVirus Free Edition 2014

Windows Defender

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

Java 7 Update 25

Java version out of Date!

Adobe Flash Player 12.0.0.77

Adobe Reader XI

Mozilla Firefox 27.0.1 Firefox out of Date!

Google Chrome 33.0.1750.146

Google Chrome 33.0.1750.154

````````Process Check: objlist.exe by Laurent````````

AVG avgwdsvc.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: %

````````````````````End of Log``````````````````````

MrCharlie · March 21, 2014

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Java version out of Date! <----please update, should be Update 51
Java 7 Update 25 <--------Go to control panel > Java > Update Tab > Update Now
Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

If there's no update tab in Java, uninstall it and Download and install the latest version from Here
Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

----------------------------

Internet Explorer 10 Out of date! <--------please update your IE

Mozilla Firefox 27.0.1 Firefox out of Date! <----please check for an update if available. (28)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.
If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (PM also found HERE)

Good Luck and Thanks for using the forum, MrC

fencergirl · March 22, 2014

Hi, I've done the updates and deletions, thanks!

Thanks for all your help!

Btw the first link for the preventive maintenance doesn't work for me, The second is fine tough.

MrCharlie · March 22, 2014

Yes, I know a lot of people tell me that they can't get to Spyware Beware, that's why I put the second link in.

Take Care MrC

Maurice Naggar · March 24, 2014

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

Spigot / Yahoo Redirect

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information