Betterdeals popups

LarryS · January 20, 2015

I screwed up I ran the program hit the clean and the program said it needed to restart I clicked ok it restarted and then the log cam up I high lighted the whole log and clicked save and went to your page and went to click paste but paste was not an option for some reason the save did not work and when I went back the log was no longer there.

LarryS · January 20, 2015

the program worked the clean worked the log came up I copied to clipboard went to your page to paste but that option was not there the save did not work I went back and the log was gone

Naathim · January 20, 2015

You didn't screw up anything. Please go to the C:\AdwCleaner folder and search for the log there. If paste won't be an option, you may attach it.

LarryS · January 20, 2015

I ran it again and here is the log

# AdwCleaner v4.108 - Report created 20/01/2015 at 17:50:39
# Updated 17/01/2015 by Xplode
# Database : 2015-01-18.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : FBI Ruskin - SUPERSLOW
# Running from : C:\Users\FBI Ruskin\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

*************************

AdwCleaner[R0].txt - [5752 octets] - [20/01/2015 16:57:12]
AdwCleaner[R1].txt - [3330 octets] - [20/01/2015 17:28:06]
AdwCleaner[R2].txt - [958 octets] - [20/01/2015 17:48:46]
AdwCleaner[s0].txt - [5168 octets] - [20/01/2015 16:59:01]
AdwCleaner[s1].txt - [3169 octets] - [20/01/2015 17:29:14]
AdwCleaner[s2].txt - [880 octets] - [20/01/2015 17:50:39]

########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [939 octets] ##########

LarryS · January 20, 2015

# AdwCleaner v4.108 - Report created 20/01/2015 at 16:57:12
# Updated 17/01/2015 by Xplode
# Database : 2015-01-18.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : FBI Ruskin - SUPERSLOW
# Running from : C:\Users\FBI Ruskin\Downloads\adwcleaner_4.108.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Folder Found : C:\Program Files (x86)\WSE_Vosteran
Folder Found : C:\ProgramData\Aimersoft Video Converter Ultimate
Folder Found : C:\Users\FBI Ruskin\AppData\Local\Vosteran
Folder Found : C:\Users\FBI Ruskin\AppData\Roaming\Aimersoft Video Converter Ultimate
Folder Found : C:\Users\FBI Ruskin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vosteran
Folder Found : C:\Users\FBI Ruskin\AppData\Roaming\WSE_Vosteran
Folder Found : C:\Users\FBI Ruskin\Documents\Aimersoft Video Converter Ultimate

***** [ Scheduled Tasks ] *****

Task Found : WSE_Vosteran

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\AppDataLow\Software\adawarebp
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\IM
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\bitchcrawler.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\lax1.ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\nym1.ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.bitchcrawler.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{41A9AA74-B872-4784-BF3A-0E98CD41590D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2974C985-8151-4DE5-B23C-B875F0A8522F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran
Key Found : HKCU\Software\Vosteran
Key Found : HKCU\Software\Vosteran Browser
Key Found : HKCU\Software\WSE_Vosteran
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\IM
Key Found : [x64] HKCU\Software\InstallCore
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{41A9AA74-B872-4784-BF3A-0E98CD41590D}
Key Found : [x64] HKCU\Software\Vosteran
Key Found : [x64] HKCU\Software\Vosteran Browser
Key Found : [x64] HKCU\Software\WSE_Vosteran
Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Found : HKLM\SOFTWARE\Classes\.bdc
Key Found : HKLM\SOFTWARE\Classes\.bgl
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2974C985-8151-4DE5-B23C-B875F0A8522F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSE_Vosteran
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [start Page] - hxxp://vosteran.com/?f=1&a=vst_dwndlm_15_04_ie&cd=2XzuyEtN2Y1L1QzuyBtD0FtC0AtCtBtCtC0F0CtDyDzz0DzytN0D0Tzu0StCtCtCyDtN1L2XzutAtFyBtFtBtFtCtN1L1CzutCyEtBzytDyD1V1BtAtN1L1G1B1V1N2Y1L1Qzu2SyByDtDzztBtB0DyCtGzy0B0ByCtG0Dzzzz0CtGyB0FyCtBtGtAzz0FtC0DyEyC0D0B0ByD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EzyyEyD0C0A0A0AtGyC0AtAyEtGyEtByDtCtGzztBzyyCtGyD0E0C0Czz0A0FyB0D0DzyyB2Q&cr=1763743019&ir=

*************************

AdwCleaner[R0].txt - [5560 octets] - [20/01/2015 16:57:12]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5620 octets] ##########

Naathim · January 21, 2015

Hi

Scan with ZOEK

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;type "C:\AdwCleaner\AdwCleaner[S0].txt">>"%temp%\log.txt";btype "C:\AdwCleaner\AdwCleaner[S1].txt">>"%temp%\log.txt";b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

LarryS · January 21, 2015

# AdwCleaner v4.108 - Report created 20/01/2015 at 16:59:01
# Updated 17/01/2015 by Xplode
# Database : 2015-01-18.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : FBI Ruskin - SUPERSLOW
# Running from : C:\Users\FBI Ruskin\Downloads\adwcleaner_4.108.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Aimersoft Video Converter Ultimate
Folder Deleted : C:\Program Files (x86)\WSE_Vosteran
Folder Deleted : C:\Users\FBI Ruskin\AppData\Local\Vosteran
Folder Deleted : C:\Users\FBI Ruskin\AppData\Roaming\Aimersoft Video Converter Ultimate
Folder Deleted : C:\Users\FBI Ruskin\AppData\Roaming\WSE_Vosteran
Folder Deleted : C:\Users\FBI Ruskin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vosteran
Folder Deleted : C:\Users\FBI Ruskin\Documents\Aimersoft Video Converter Ultimate
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

***** [ Scheduled Tasks ] *****

Task Deleted : WSE_Vosteran

***** [ Shortcuts ] *****

I'm shocked that we have had to do all this to rid my machine of the bad stuff!

LarryS · January 21, 2015

found this file also

# AdwCleaner v4.108 - Report created 20/01/2015 at 17:29:14
# Updated 17/01/2015 by Xplode
# Database : 2015-01-18.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : FBI Ruskin - SUPERSLOW
# Running from : C:\Users\FBI Ruskin\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

[#] Service Deleted : Update ace race
[#] Service Deleted : Util ace race
Service Deleted : {9cdb05d3-a225-439b-a302-3c928fc40412}Gw64

***** [ Files / Folders ] *****

[!] Folder Deleted : C:\Program Files (x86)\ace race
Folder Deleted : C:\Users\FBIRUS~1\AppData\Local\Temp\ace race
File Deleted : C:\Windows\System32\drivers\{9cdb05d3-a225-439b-a302-3c928fc40412}Gw64.sys

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Update ace race
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Util ace race
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{68182220-3c75-49d9-a9c4-4093d3986279}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{c6b5d430-8ba5-479b-8a52-dd182e4315b5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68182220-3c75-49d9-a9c4-4093d3986279}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{68182220-3c75-49d9-a9c4-4093d3986279}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{68182220-3c75-49d9-a9c4-4093d3986279}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKCU\Software\ace race
Key Deleted : HKLM\SOFTWARE\ace race
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ace race

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

*************************

AdwCleaner[R0].txt - [5752 octets] - [20/01/2015 16:57:12]
AdwCleaner[R1].txt - [3330 octets] - [20/01/2015 17:28:06]
AdwCleaner[s0].txt - [5168 octets] - [20/01/2015 16:59:01]
AdwCleaner[s1].txt - [3009 octets] - [20/01/2015 17:29:14]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [3069 octets] ##########

Naathim · January 21, 2015

OK, skip ZOEK.

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

LarryS · January 21, 2015

Naathim · January 21, 2015

Ok, just some minor thins to clean up left.

Please tell me how is your machine behaving. Do you face any issues?

LarryS · January 21, 2015

Not that I can see the betterdeals are gone! I did get a browser hijack but I use the control alt delete and use the task manager to remove it ( via browser restart? run into them way to often for my taste.

LarryS · January 21, 2015

I think on reboot my Norton thinks the farbar is a virus as it removes it from my system

LarryS · January 21, 2015

Some web pictures won't load just getting a small box with an x in it

LarryS · January 21, 2015

I went to move a picture from my pics library to Facebook but when I go threw the fb link my pics folder shows folders but no pictures. when I go threw the folder link on the bottom of my screen every thing is there. Do I need to reinstall fb?

Naathim · January 22, 2015

Hi

I did get a browser hijack but I use the control alt delete and use the task manager to remove it ( via browser restart? run into them way to often for my taste.

Be more specific please. What Hijack?

I think on reboot my Norton thinks the farbar is a virus as it removes it from my system

It happens often. FRST is clean but it contains invasive procedure within itself, that's why it looks suspicious.

Some web pictures won't load just getting a small box with an x in it

This rather looks like some ads-blocking or flash-blocking. Or a plugin missing.

I went to move a picture from my pics library to Facebook but when I go threw the fb link my pics folder shows folders but no pictures. when I go threw the folder link on the bottom of my screen every thing is there. Do I need to reinstall fb?

I don't really understand what's the case here. I'm not the Facebook specialist...

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Press the + R on your keyboard at the same time. Type Notepad and click OK.

Copy the entire content of the codebox below and paste into the Notepad document:

startCloseProcesses:CreateRestorePoint:HKLM-x32\...\Run: [] => [X]HKU\S-1-5-21-191125125-3998107540-3752353725-1001\...A8F59079A8D5}\localserver32:  <==== ATTENTION!SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No PathCHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No PathS3 catchme; \??\C:\ComboFix\catchme.sys [X]S2 webinstrNHKT; \??\C:\Windows\system32\Drivers\webinstrNHKT.sys [X]AlternateDataStreams: C:\ProgramData\Temp:373E1720Task: {CCE7120A-13AF-40C9-B6B9-EA65D0667243} - \Search-Protect No Task File <==== ATTENTIONEmptyTemp:end

Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
Press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please include it in your reply.

LarryS · January 22, 2015

Disregard the last 2 post they now work

Naathim · January 22, 2015

Good to know. But please perform the FRST fix anyway and post the report.

LarryS · January 22, 2015

I must have done something wrong. I followed your directions and copied the txt did the save as and saved to my desktop. It didn.t work as I didn't find the file name after running the FRST program

Naathim · January 22, 2015

OK, please provide me some fresh reports then.

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

LarryS · January 22, 2015

LarryS · January 22, 2015

to answer your question I got the fake flash player update that locks the browser yesterday I have also in the last month received the fake us.gov green card that says it has encrypted my files but in reality just locks the browser and a couple of different ones that say I have a virus and need to call a number to remove one was a fake Norton and the other I forget who that was from.. I did the ctrl atl del and used the task manager to stop the script from running and when the browser restarts I'm back up and running

Naathim · January 22, 2015

Did you press the FIX button this time insteead of Scan?

If the fixlist file is still on your desktop, please just run FRST and press FIX.

LarryS · January 22, 2015

I hope this is what your asking for

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by FBI Ruskin at 2015-01-22 09:57:58 Run:1
Running from C:\Users\FBI Ruskin\Desktop
Loaded Profiles: FBI Ruskin (Available profiles: FBI Ruskin)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-191125125-3998107540-3752353725-1001\...A8F59079A8D5}\localserver32: <==== ATTENTION!
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S2 webinstrNHKT; \??\C:\Windows\system32\Drivers\webinstrNHKT.sys [X]
AlternateDataStreams: C:\ProgramData\Temp:373E1720
Task: {CCE7120A-13AF-40C9-B6B9-EA65D0667243} - \Search-Protect No Task File <==== ATTENTION
EmptyTemp:
end
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKU\S-1-5-21-191125125-3998107540-3752353725-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key Deleted Successfully.
"HKU\S-1-5-21-191125125-3998107540-3752353725-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77}" => Key deleted successfully.
HKCR\CLSID\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} => Key not found.
"HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.
catchme => Service deleted successfully.
webinstrNHKT => Service deleted successfully.
C:\ProgramData\Temp => ":373E1720" ADS removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CCE7120A-13AF-40C9-B6B9-EA65D0667243}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCE7120A-13AF-40C9-B6B9-EA65D0667243}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Search-Protect" => Key deleted successfully.
EmptyTemp: => Removed 796.6 MB temporary data.

The system needed a reboot.

==== End of Fixlog 10:01:35 ====

Naathim · January 22, 2015

Yeah,m looks much better. Now the proxy needs to be removed.

Scan with ZOEK

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.
In the main box please paste in the following script:
```
createsrpoint;resetieproxy;
```
Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

Betterdeals popups

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information