Jump to content

Pop Up quarantining and then recurring


Recommended Posts

Hi, Not sure if this is an infection or a setting gone amiss, on every scan recently unwanted objects detected, pup.optional.helperbar.A. Mb clears this to quarantine. but on next scan the identical object is detected, is there a solution to this?

 

Any help will be appreciated, the computer is running windows 7 64 bit SP1

 

many thanks 

Link to post
Share on other sites

Welcome to the forum. (Do what you can)

General P2P/Piracy Warning:

 

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

2. If you have illegal/cracked software (MS Office, Adobe Products), cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

 

<====><====><====><====><====><====><====><====>

 

Please run a Quick Scan with Malwarebytes (if possible)

For Malwarebytes ver: 1.75

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

For Malwarebytes 2.0, please run a Threat Scan

Click on Settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware

Same for PUM (Potentially Unwanted Modifications)

Quarantine all that's found

Post the log

Then......

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button. (make sure the Addition box is checked)
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

reply1.jpg

New window that comes up.

replyer1.jpg

Last................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Wait for the Prescan to finish

Click Scan to scan the system.

When the scan completes > Don't Fix anything! > Click on the Report Button > Copy and paste the Report back here.

Don't run any other options, they're not all bad!!!!!!!

RogueKiller logs will also be located here:

%programdata%/RogueKiller/Logs <-------W7

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP

(please don't put logs in code or quotes and use the default font)

 

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running. Create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

If I don't respond within 24 hours, please send me a PM

Link to post
Share on other sites

Latest log produced from last scan

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 11/08/2014
Scan Time: 18:14:10
Logfile: Mb  latest log.txt
Administrator: Yes
 
Version: 2.00.2.1012
Malware Database: v2014.08.11.05
Rootkit Database: v2014.08.04.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TOM
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 351455
Time Elapsed: 10 min, 21 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Disabled
Rootkits: Disabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
 
now proceeding with FRST
Link to post
Share on other sites

RogueKiller V9.2.6.0 (x64) [Jul 11 2014] by Adlice Software





 

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : TOM [Admin rights]

Mode : Scan -- Date : 08/11/2014  19:46:01

 

¤¤¤ Bad processes : 1 ¤¤¤

[suspicious.Path] vsnp2std.exe -- C:\Windows\vsnp2std.exe[7] -> KILLED [TermProc]

 

¤¤¤ Registry Entries : 11 ¤¤¤

[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | snp2std : C:\Windows\vsnp2std.exe  -> FOUND

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> FOUND

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> FOUND

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> FOUND

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> FOUND

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> FOUND

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> FOUND

[PUM.Desktop] (X64) HKEY_USERS\S-1-5-21-3456300056-613046056-2772485092-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0  -> FOUND

[PUM.Desktop] (X86) HKEY_USERS\S-1-5-21-3456300056-613046056-2772485092-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND

 

¤¤¤ Scheduled tasks : 1 ¤¤¤

[suspicious.Path] \\DSite -- C:\Users\TOM\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE (/Check) -> FOUND

 

¤¤¤ Files : 0 ¤¤¤

 

¤¤¤ HOSTS File : 1 ¤¤¤

[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 activate.adobe.com

 

¤¤¤ Antirootkit : 4 (Driver: LOADED) ¤¤¤

[EAT:Addr] (explorer.exe) MSVCR110_CLR0400.dll - DllCanUnloadNow : C:\Program Files (x86)\Google\Drive\googledrivesync64.dll @ 0x7fef8462350

[EAT:Addr] (explorer.exe) MSVCR110_CLR0400.dll - DllGetClassObject : C:\Program Files (x86)\Google\Drive\googledrivesync64.dll @ 0x7fef8462130

[EAT:Addr] (explorer.exe) MSVCR110_CLR0400.dll - DllRegisterServer : C:\Program Files (x86)\Google\Drive\googledrivesync64.dll @ 0x7fef8461f70

[EAT:Addr] (explorer.exe) MSVCR110_CLR0400.dll - DllUnregisterServer : C:\Program Files (x86)\Google\Drive\googledrivesync64.dll @ 0x7fef8462060

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: ST2000DM 001-9YN164 SCSI Disk Device +++++

--- User ---

[MBR] 42793001a4a9216f3290b72d72d9f2e5

[bSP] 065ba6bf1511ecd043648a18a7cce876 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 8794 MB

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 18012160 | Size: 1898933 MB

User = LL1 ... OK

User = LL2 ... OK

 

+++++ PhysicalDrive1: Seagate FreeAgent Go USB Device +++++

--- User ---

[MBR] 0d3d9440de7697ad2b340f99317567dc

[bSP] 5cab7fac78b6fe5301595cea6da44b25 : Empty MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 152625 MB

User = LL1 ... OK

Error reading LL2 MBR! ([32] The request is not supported. )
Link to post
Share on other sites

¤¤¤ HOSTS File : 1 ¤¤¤

[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 activate.adobe.com

Why is this in your host file??????

 

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

2. If you have illegal/cracked software (MS Office, Adobe Products), cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Link to post
Share on other sites

It has one purpose...to by-pass activation on Adobe products. AKA: Piracy

If you want to receive help on this forum, you have to uninstall the Adobe products and restore the original host file.

Please go to the link below, download and run Fixit:

http://support.microsoft.com/kb/972034 <---reset host file fixit

MrC

Link to post
Share on other sites

Make sure you have created a restore point and.....
bwebb7v.jpgDownload Delfix from Here and save it to your desktop.

  • Place a check mark in front of .......
  • Create registry backup <---only!
  • Uncheck the rest!
  • Click the Run button.

    Close the tool out when it's done....we'll use it later.

    ===================================

    Please uninstall these: (adware)
    FileParade Bundle
    Yahoo Community Smartbar Engine


    ==================================

    Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.
    Run FRST.exe/FRST64.exe and click Fix only once and wait
    The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

    =================================

    Please download AdwCleaner from HERE or HERE to your desktop.
    • Double click on AdwCleaner.exe to run the tool.
      Vista/Windows 7/8 users right-click and select Run As Administrator
    • Click on the Scan button.
    • AdwCleaner will begin...be patient as the scan may take some time to complete.
    • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
    • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
    • Look over the log especially under Files/Folders for any program you want to save.
    • If there's a program you may want to save, just uncheck it from AdwCleaner.
    • If you're not sure, post the log for review. (all items found are either adware/spyware/foistware)
    • If you're ready to clean it all up.....click the Clean button.
    • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
    • Copy and paste the contents of that logfile in your next reply.
    • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
    • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
    • To restore an item that has been deleted:
    • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
    Next..................

    thisisujrt.gif Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
    Next.........

    If you're using Malwarebytes 2.0, please run a Threat Scan
    Click on settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware
    Same for PUM (Potentially Unwanted Modifications)
    Quarantine All that's found

    MrC
Link to post
Share on other sites

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-08-2014
Ran by TOM at 2014-08-13 18:45:53 Run:1
Running from C:\Users\TOM\Desktop\FRST
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
Task: {62E467FA-DED4-425F-8096-6F1FA5F6B5CE} - System32\Tasks\DSite => C:\Users\TOM\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7CD48AD6-87F7-487D-9BFB-88BCDD307072} - System32\Tasks\ZoomExUpdaterTask{2B56D032-06F6-41EE-B74C-5ADF796466CD} => C:\ProgramData\Premium\ZoomEx\ZoomEx.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Microsoft:dMyANubNRJwcfyjHkBASM
AlternateDataStreams: C:\ProgramData\Microsoft:wRvCH7bcfbo8GLNQm
AlternateDataStreams: C:\Users\TOM\AppData\Local\mWmtLIN3MoADrsp:ezyoW60jaUeXb0vYUwktOF8oJv
AlternateDataStreams: C:\Users\TOM\Documents\Bob David.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\TOM\Documents\HANDY TIPS.ppp:SummaryInformation
AlternateDataStreams: C:\Users\TOM\Documents\HANDY TIPS.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\TOM\Documents\instructions for web.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\TOM\Documents\LEMONS.ppp:SummaryInformation
AlternateDataStreams: C:\Users\TOM\Documents\LEMONS.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\TOM\Documents\photo framing 10x8.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\TOM\Documents\sequence of events.ppp:SummaryInformation
AlternateDataStreams: C:\Users\TOM\Documents\sequence of events.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\TOM\Documents\Web page insert.ppp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Task: {02D1E8D3-CC05-4E65-B3AC-EE850BEA8E2D} - System32\Tasks\AdobeAAMUpdater-1.0-TOM-ADVENT-TOM => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
CHR StartupUrls: "https://mail.google.com/mail/u/0/?tab=wm#inbox", "hxxp://cpw.mail.aol.com/36992-111/talktalk-5/en-gb/Suite.aspx", "hxxp://weather.aol.co.uk/forecast/todays/europe/united-kingdom/london/id/ukxx0085;jsessionid=697653274206DA270FDE333FDBA0D267", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDpd54DElQfVNa4m81Ohlca8mmUlR4JXTsFPfc-ZueRT0ite2ZkspqxxWa56pzNs6K97v2cu7wCceIThC_E26gPDYAfDa6qebmqTUxaqR6m849iig1R7P-DD_ykTC4MX2kUX-Bpj2716iwyuaUQUs_jpmsK_IynIg,,"
C:\Users\TOM\AppData\Local\Temp\debutsetup.exe
C:\Users\TOM\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE
C:\Users\TOM\AppData\Local\Temp\HitmanPro.exe
C:\Users\TOM\AppData\Local\Temp\InstallAX.exe
C:\Users\TOM\AppData\Local\Temp\InstallPlugin.exe
C:\Users\TOM\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\TOM\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\TOM\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\TOM\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\TOM\AppData\Local\Temp\KERNELBASE.dll
C:\Users\TOM\AppData\Local\Temp\Kickstarter.exe
C:\Users\TOM\AppData\Local\Temp\LMkRstPt.exe
C:\Users\TOM\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe
C:\Users\TOM\AppData\Local\Temp\PAGEPLUS-X5-EN_15.0.5.030_Patch-Setup.exe
C:\Users\TOM\AppData\Local\Temp\PAGEPLUS-X6-en-GB_16.0.3.029_Patch-Setup.exe
C:\Users\TOM\AppData\Local\Temp\prismsetup.exe
C:\Users\TOM\AppData\Local\Temp\sb9upgrade.exe
C:\Users\TOM\AppData\Local\Temp\SkypeSetup.exe
C:\Users\TOM\AppData\Local\Temp\vpsetup.exe
C:\Users\TOM\AppData\Local\Temp\VSUSetup.exe
C:\Users\TOM\AppData\Local\Temp\wintrust.dll
C:\Users\TOM\AppData\Local\Temp\wpsetup.exe
 
 
*****************
 
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{62E467FA-DED4-425F-8096-6F1FA5F6B5CE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{62E467FA-DED4-425F-8096-6F1FA5F6B5CE}" => Key deleted successfully.
C:\Windows\System32\Tasks\DSite => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7CD48AD6-87F7-487D-9BFB-88BCDD307072}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7CD48AD6-87F7-487D-9BFB-88BCDD307072}" => Key deleted successfully.
C:\Windows\System32\Tasks\ZoomExUpdaterTask{2B56D032-06F6-41EE-B74C-5ADF796466CD} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ZoomExUpdaterTask{2B56D032-06F6-41EE-B74C-5ADF796466CD}" => Key deleted successfully.
C:\ProgramData\Microsoft => ":dMyANubNRJwcfyjHkBASM" ADS removed successfully.
C:\ProgramData\Microsoft => ":wRvCH7bcfbo8GLNQm" ADS removed successfully.
C:\Users\TOM\AppData\Local\mWmtLIN3MoADrsp => ":ezyoW60jaUeXb0vYUwktOF8oJv" ADS removed successfully.
C:\Users\TOM\Documents\Bob David.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\TOM\Documents\HANDY TIPS.ppp => ":SummaryInformation" ADS removed successfully.
C:\Users\TOM\Documents\HANDY TIPS.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\TOM\Documents\instructions for web.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\TOM\Documents\LEMONS.ppp => ":SummaryInformation" ADS removed successfully.
C:\Users\TOM\Documents\LEMONS.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\TOM\Documents\photo framing 10x8.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\TOM\Documents\sequence of events.ppp => ":SummaryInformation" ADS removed successfully.
C:\Users\TOM\Documents\sequence of events.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\TOM\Documents\Web page insert.ppp => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{02D1E8D3-CC05-4E65-B3AC-EE850BEA8E2D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02D1E8D3-CC05-4E65-B3AC-EE850BEA8E2D}" => Key deleted successfully.
C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-TOM-ADVENT-TOM => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeAAMUpdater-1.0-TOM-ADVENT-TOM" => Key deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeAAMUpdater-1.0 => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
CHR StartupUrls: "https://mail.google.com/mail/u/0/?tab=wm#inbox", "hxxp://cpw.mail.aol.com/36992-111/talktalk-5/en-gb/Suite.aspx", "hxxp://weather.aol.co.uk/forecast/todays/europe/united-kingdom/london/id/ukxx0085;jsessionid=697653274206DA270FDE333FDBA0D267", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDpd54DElQfVNa4m81Ohlca8mmUlR4JXTsFPfc-ZueRT0ite2ZkspqxxWa56pzNs6K97v2cu7wCceIThC_E26gPDYAfDa6qebmqTUxaqR6m849iig1R7P-DD_ykTC4MX2kUX-Bpj2716iwyuaUQUs_jpmsK_IynIg,," ==> The Chrome "Settings" can be used to fix the entry.
C:\Users\TOM\AppData\Local\Temp\debutsetup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\HitmanPro.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\InstallAX.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\InstallPlugin.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\KERNELBASE.dll => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\Kickstarter.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\LMkRstPt.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\PAGEPLUS-X5-EN_15.0.5.030_Patch-Setup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\PAGEPLUS-X6-en-GB_16.0.3.029_Patch-Setup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\prismsetup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\sb9upgrade.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\vpsetup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\VSUSetup.exe => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\wintrust.dll => Moved successfully.
C:\Users\TOM\AppData\Local\Temp\wpsetup.exe => Moved successfully.
 

==== End of Fixlog ====                                             

Link to post
Share on other sites

# AdwCleaner v3.304 - Report created 13/08/2014 at 19:07:21

# Updated 08/08/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : TOM - TOM-ADVENT

# Running from : C:\Users\TOM\Desktop\adwcleaner_3.304.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\NCH Software

Folder Deleted : C:\Program Files (x86)\albrechto

Folder Deleted : C:\Program Files (x86)\driver-soft

Folder Deleted : C:\Program Files (x86)\NCH Software

Folder Deleted : C:\Program Files (x86)\TidyNetwork

Folder Deleted : C:\Program Files (x86)\VideoConverter

Folder Deleted : C:\Users\TOM\AppData\Roaming\DSite

Folder Deleted : C:\Users\TOM\AppData\Roaming\NCH Software

 

***** [ Scheduled Tasks ] *****

 

Task Deleted : Browser Manager

Task Deleted : SUPERAntiSpyware Scheduled Task 56345189-e4ff-46a5-a545-ea9849a1244d

 

***** [ Shortcuts ] *****

 

Shortcut Disinfected : C:\Users\TOM\Desktop\Search.lnk

Shortcut Disinfected : C:\Users\TOM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Key Deleted : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager

Key Deleted : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\dsiteproducts

Key Deleted : HKCU\Software\IM

Key Deleted : HKCU\Software\InstallCore

Key Deleted : HKCU\Software\Myfree Codec

Key Deleted : HKCU\Software\PrivitizeVPNInstallDates

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Driver-Soft

Key Deleted : HKLM\Software\firstsearch

Key Deleted : HKLM\Software\Myfree Codec

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Genius_is1

Key Deleted : [x64] HKLM\SOFTWARE\Conduit

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17239

 

 

-\\ Google Chrome v36.0.1985.125

 

[ File : C:\Users\TOM\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}&qsrc=0&o=8263&l=sem&qo=homepageSearchBox

Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}

Deleted [search Provider] : hxxp://www.kelkoo.co.uk/ctl/do/search?siteSearchQuery={searchTerms}&from=colibri

Deleted [search Provider] : hxxp://www.webaddresshelp.bt.com/index?ClientLocation=uk&ParticipantID=mg76cjr54t8kx45jjw4j4k9j5hsr5m26&Implementation=0&LinkID=U6M0oX8AAAEAABNAqH8AAABm&FailureMode=5&pvf=1&pvi=0&SearchQuery={searchTerms}&searchbtn=Search

Deleted [startup_urls] : hxxps://mail.google.com/mail/u/0/?tab=wm#inbox

Deleted [startup_urls] : hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDpd54DElQfVNa4m81Ohlca8mmUlR4JXTsFPfc-ZueRT0ite2ZkspqxxWa56pzNs6K97v2cu7wCceIThC_E26gPDYAfDa6qebmqTUxaqR6m849iig1R7P-DD_ykTC4MX2kUX-Bpj2716iwyuaUQUs_jpmsK_IynIg,,

 

*************************

 

AdwCleaner[R0].txt - [6827 octets] - [13/08/2014 18:56:14]

AdwCleaner[R1].txt - [6887 octets] - [13/08/2014 19:05:29]

AdwCleaner[s0].txt - [6714 octets] - [13/08/2014 19:07:21]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [6774 octets] ##########
Link to post
Share on other sites

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by TOM on 13/08/2014 at 19:21:21.83

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] "C:\ProgramData\drivergenius"

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\driver genius"

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 13/08/2014 at 19:29:13.85

End of JRT log

Link to post
Share on other sites

Yes to Malware bytes scan, used settings suggested on completion the annoying file was still showing up, quarantined this and received a log, attached

 

Please also check the latest item in this post. ie second log

 

Malwarebytes Anti-Malware

www.malwarebytes.org
 
Scan Date: 11/08/2014
Scan Time: 18:14:10
Logfile: Mb  latest log.txt
Administrator: Yes
 
Version: 2.00.2.1012
Malware Database: v2014.08.11.05
Rootkit Database: v2014.08.04.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TOM
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 351455
Time Elapsed: 10 min, 21 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Disabled
Rootkits: Disabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
 
I also ran the Threat scan this morning, this scan still shows the pop.optional.helper.A as a threat, before quarantining I took a Log which is below.
 
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 14/08/2014
Scan Time: 10:07:23
Logfile: 14.08 latest mb log.txt
Administrator: Yes
 
Version: 2.00.2.1012
Malware Database: v2014.08.14.03
Rootkit Database: v2014.08.04.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TOM
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 356098
Time Elapsed: 17 min, 40 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Disabled
Rootkits: Enabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 1
PUP.Optional.HelperBar.A, C:\Users\TOM\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (      "startup_urls": [ ""http://cpw.mail.aol.com/36992-111/talktalk-5/en-gb/Suite.aspx", "http://weather.aol.co.uk/forecast/todays/europe/united-kingdom/london/id/ukxx0085;jsessionid=697653274206DA270FDE333FDBA0D267", "http://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDpd54DElQfVNa4m81Ohlca8mmUlR4JXTsFPfc-ZueRT0ite2ZkspqxxWa56pzNs6K97v2cu7wCceIThC_E26gPDYAfDa6qebmqTUxaqR6m849iig1R7P-DD_ykTC4MX2kUX-Bpj2716iwyuaUQUs_jpmsK_IynIg,," ],), ,[dfb960629ae1ad893957ce325aabe61a]
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
Link to post
Share on other sites

The problem is that Google Chromes settings are stored on their server and is retored everytime it re-syncs , here's how to clean them out.

You may want to back-up your bookmarks:

http://www.wikihow.com/Export-Bookmarks-from-Chrome <---bookmarks

Open up Chrome by clicking on the 3 bars in the upper right hand corner.

Then in Chrome go to Settings > Under Sign In, go to Google Dashboard > Click on Settings > Click on Stop and Clear left bottom of the page.

http://www.it-support.com.au/wp-content/uploads/2013/12/Google-Chrome-Sync-Stop-And-Clear.png

That should clear out the setting.

Now.......reset Chrome:

https://support.google.com/chrome/answer/95314?hl=en <<<----Home page

https://support.google.com/chrome/answer/95421?hl=en <<<---CHR StartupUrls

Re-scan with Malwarebytes, it may find the setting one more time but after that it should be clean.

MrC

Link to post
Share on other sites

Hello MrC,

 

Ok followed the above details, have run threat scan twice each time the same pop shows, have included the last scan log. the log was produced before removing the threat.

 

sorry to be such a pain.

 

Tom

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 14/08/2014
Scan Time: 14:33:56
Logfile: 14.8 14.49.txt
Administrator: Yes
 
Version: 2.00.2.1012
Malware Database: v2014.08.14.06
Rootkit Database: v2014.08.04.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TOM
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 356748
Time Elapsed: 13 min, 10 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Disabled
Rootkits: Enabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 1
PUP.Optional.HelperBar.A, C:\Users\TOM\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (      "startup_urls": [ ""http://cpw.mail.aol.com/36992-111/talktalk-5/en-gb/Suite.aspx", "http://weather.aol.co.uk/forecast/todays/europe/united-kingdom/london/id/ukxx0085;jsessionid=697653274206DA270FDE333FDBA0D267", "http://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDpd54DElQfVNa4m81Ohlca8mmUlR4JXTsFPfc-ZueRT0ite2ZkspqxxWa56pzNs6K97v2cu7wCceIThC_E26gPDYAfDa6qebmqTUxaqR6m849iig1R7P-DD_ykTC4MX2kUX-Bpj2716iwyuaUQUs_jpmsK_IynIg,,", "http://www.google.com" ],), ,[b2e69a280c6fa39366ece51c63a2669a]
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
Link to post
Share on other sites

In Chrome go to Settings > Under Sign in "Advanced Sync Settings" > Click the drop down arrow in the Sync Everything Box > Click Choose What To Sync > Uncheck "Settings" > Click OK

Run AdwCleaner and JRT again.

Now.......reset Chrome Startup:

https://support.google.com/chrome/answer/95314?hl=en <<<----Home page

https://support.google.com/chrome/answer/95421?hl=en <<<---CHR StartupUrls

Re-scan with Malwarebytes, it may find the setting one more time but after that it should be clean.

Let me know, MrC

Link to post
Share on other sites

Latest ADW report

 

# AdwCleaner v3.305 - Report created 15/08/2014 at 09:42:19
# Updated 14/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : TOM - TOM-ADVENT
# Running from : C:\Users\TOM\Desktop\adwcleaner_3.305.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Scheduled Tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17239
 
 
-\\ Google Chrome v36.0.1985.125
 
[ File : C:\Users\TOM\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}&qsrc=0&o=8263&l=sem&qo=homepageSearchBox
Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}
Deleted [search Provider] : hxxp://www.kelkoo.co.uk/ctl/do/search?siteSearchQuery={searchTerms}&from=colibri
Deleted [search Provider] : hxxp://www.webaddresshelp.bt.com/index?ClientLocation=uk&ParticipantID=mg76cjr54t8kx45jjw4j4k9j5hsr5m26&Implementation=0&LinkID=U6M0oX8AAAEAABNAqH8AAABm&FailureMode=5&pvf=1&pvi=0&SearchQuery={searchTerms}&searchbtn=Search
Deleted [search Provider] : hxxp://isearch.avg.com/search?cid={02DBB236-AE7D-4384-8C53-80D121E806C5}&mid=bf26ac3ba66747d0abb86939b2bde1e4-8cc02c7ba85ada44567b03be94880899579999d1〈=en&ds=pl011&pr=sa&d=2012-03-17 18:10:02&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
Deleted [startup_urls] : hxxps://mail.google.com/mail/u/0/?tab=wm#inbox
Deleted [startup_urls] : hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDpd54DElQfVNa4m81Ohlca8mmUlR4JXTsFPfc-ZueRT0ite2ZkspqxxWa56pzNs6K97v2cu7wCceIThC_E26gPDYAfDa6qebmqTUxaqR6m849iig1R7P-DD_ykTC4MX2kUX-Bpj2716iwyuaUQUs_jpmsK_IynIg,,
 
*************************
 
AdwCleaner[R0].txt - [6827 octets] - [13/08/2014 18:56:14]
AdwCleaner[R1].txt - [6887 octets] - [13/08/2014 19:05:29]
AdwCleaner[R2].txt - [1445 octets] - [15/08/2014 09:34:50]
AdwCleaner[s0].txt - [6890 octets] - [13/08/2014 19:07:21]
AdwCleaner[s1].txt - [2180 octets] - [15/08/2014 09:42:19]
 
########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [2240 octets] ##########
Link to post
Share on other sites

Good......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC
Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.