persistent registry pup entries

gousey · August 5, 2015

For some time now MBAM finds one key and 6 other registry entries entitled pup funmoods. I delete them and they always return on the subsequent scans. ADW Cleaner also finds two registry entries to do with Search Scopes. I ran JRT and it finds something similar. They all find these repeatedly despite my removing/fixing them. No other indications on my computer of malware. ADW and MBAM texts attached along with FRST and Additions text. Strangly MBAM always finds 7 and ADW cleaner only two entries.

Addition.txt

FRST.txt

AdwCleanerR27.txt

mbam pup2.txt

TwinHeadedEagle · August 6, 2015

Hello,

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

Before we start please read and note the following:

We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
I volunteer to help you, so please, do not ask for help for your company/business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

I do not recommend usage of IOBIT products, they have bad reputation, and are prone to create problems. That is why I suggest to uninstall:

- Advanced SystemCare 8

- Driver Booster

- Game Booster

- IObit Malware Fighter

- IObit Uninstaller

- Smart Defrag 2

- Surfing Protection

When you see a word "Booster", "Optimizer", "TuneUp" or similar it is often some kind of silly application. You cannot "boost" you system more than it actually is. Microsoft optimized Windows perfectly and they are constantly working on improvements, so these tools are just selling you nothing but "fog".

Only way to actually boost your system is to upgrade your hardware by adding SSD, more processor power or more ram memory.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.

gousey · August 6, 2015

I deleted all Iobit programs. Followed the instructions, forgot to run zoek in administrator mode. Renamed the results adding xx to name. reran in administrators mode as directed, results below.

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by Aurora on 05/08/2015 at 23:18:53.90.

Microsoft Windows 8.1 Pro 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Aurora\Desktop\Security & Maintenance\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-resultsxx.log 639 bytes

==== System Restore Info ======================

05/08/2015 11:20:07 PM Zoek.exe System Restore Point Created Successfully.

==== Batch Command(s) Run By Tool======================

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== EOF on 05/08/2015 at 23:21:43.35 ======================

TwinHeadedEagle · August 6, 2015

Zoek did not run well, can you run it again?

gousey · August 6, 2015

On thinking about why, i realized that I did not turn off MB Anti-Exploit, The instructions at Bleeping computers does not mention it. So turning it off too, obviously helped. Here are the results: (Could not find a way to attach the file)

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by Aurora on 06/08/2015 at 8:56:45.94.

Microsoft Windows 8.1 Pro 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Aurora\Desktop\Security & Maintenance\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-results2015-08-06-062143.log 716 bytes

C:\zoek-resultsxx.log 639 bytes

==== System Restore Info ======================

06/08/2015 9:00:29 AM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\Citrix deleted successfully

C:\PROGRA~2\HP Games deleted successfully

C:\PROGRA~2\NirSoft deleted successfully

C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully

C:\PROGRA~3\Blio deleted successfully

C:\PROGRA~3\Canon IJ Network Tool deleted successfully

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully

C:\PROGRA~3\ZoomBrowser deleted successfully

C:\PROGRA~3\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} deleted successfully

C:\PROGRA~3\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} deleted successfully

C:\PROGRA~3\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} deleted successfully

C:\Users\Aurora\AppData\Roaming\calibre deleted successfully

C:\Users\Aurora\AppData\Roaming\LastPass deleted successfully

C:\Users\Aurora\AppData\Roaming\Media Player Classic deleted successfully

C:\Users\Aurora\AppData\Roaming\Windows Live Writer deleted successfully

C:\Users\Aurora\AppData\Roaming\ZoomBrowser EX deleted successfully

C:\Users\Aurora\AppData\Local\CrashDumps deleted successfully

C:\Users\Aurora\AppData\Local\Mega Limited deleted successfully

C:\Users\Aurora\AppData\Local\Secunia PSI deleted successfully

C:\Users\Guest\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1308239477-2047963427-3902588853-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully

HKEY_USERS\S-1-5-21-1308239477-2047963427-3902588853-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\Aurora\AppData\Roaming\Mozilla\Firefox\Profiles\c3lj3rxi.default

user.js not found

---- FireFox user.js and prefs.js backups ----

prefs_082015_0936_.backup

ProfilePath: C:\Users\Aurora\AppData\Roaming\TomTom\HOME\Profiles\zn6mfo0f.default

user.js not found

---- FireFox user.js and prefs.js backups ----

prefs_082015_0936_.backup

==== Batch Command(s) Run By Tool======================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Citrix not found

C:\PROGRA~2\HP Games not found

C:\PROGRA~2\NirSoft not found

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found

C:\PROGRA~3\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} not found

C:\PROGRA~3\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} not found

C:\PROGRA~3\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} not found

C:\Users\Aurora\AppData\Roaming\freecorder deleted

C:\search.sqlite deleted

C:\install.exe deleted

C:\Users\Aurora\AppData\Roaming\ProductData deleted

C:\PROGRA~3\ProductData deleted

C:\PROGRA~3\Package Cache deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted

C:\windows\SysNative\GroupPolicy\Machine deleted

C:\windows\SysNative\GroupPolicy\User deleted

C:\windows\SysNative\GroupPolicy\gpt.ini deleted

C:\Users\Aurora\AppData\Roaming\Mozilla\Firefox\Profiles\c3lj3rxi.default\CT3308528 deleted

C:\Users\Aurora\Desktop\pup funmoods.JPG deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Aurora\AppData\Roaming\Mozilla\Firefox\Profiles\c3lj3rxi.default

user_pref("browser.startup.homepage", "http://www.google.ca/");

user_pref("browser.search.defaultenginename", "Amazon.co.uk");

user_pref("browser.search.selectedEngine", "Amazon.co.uk");

==== Firefox Extensions ======================

ProfilePath: C:\Users\Aurora\AppData\Roaming\Mozilla\Firefox\Profiles\c3lj3rxi.default

- LastPass - %ProfilePath%\extensions\support@lastpass.com

ProfilePath: C:\Users\Aurora\AppData\Roaming\TomTom\HOME\Profiles\zn6mfo0f.default

- Undetermined - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com

- Undetermined - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\baseTheme@tomtom.com

AppDir: C:\Program Files (x86)\Mozilla Firefox

- TrueSuite Website Logon - %AppDir%\extensions\websitelogon@truesuite.com

- Skype Click to Call - %AppDir%\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Aurora\AppData\Roaming\Mozilla\Firefox\Profiles\c3lj3rxi.default

F4D52B252DA08B647F2BD5379191A741 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll - RocketLife Secure Plug-In Layer

FD82108FD60B63010325D9AF6F00AF99 - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll - Shockwave Flash

1F352B5944AF5C2204D9EFF7F845C5AF - C:\Users\Aurora\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll - Google Update

49D429EBF5305FC9ADD7545B7C914333 - C:\Users\Aurora\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin

6BEAD7859E8A087BE04556AB5A78855C - C:\Users\Aurora\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer

==== Chromium Look ======================

Google Chrome Version: 44.0.2403.125

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

aepeildmfnnehghlknddebgjghlompfe - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx[11/02/2011 03:37 AM]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

bbjllphbppobebmjpjcijfbakobcheof - No path found[]

Website Logon - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe

LastPass - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd

Google Voice (by Google) - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo

Poppit - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi

Google Play Books - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmimngoggfoobjdlefbcabngfnmieonb

LastPass Vault - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncliohomlfopnmlfkepkcbnhmeijkhhf

Sudoku - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\agdhembpgcpfegeigidembjopfhghnpj

Rapport - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjllphbppobebmjpjcijfbakobcheof

Google Cast - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd

Mailto for Gmail™ - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgkkmcknielgdhebimdnfahpipajcpjn

LastPass - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd

Google Voice (by Google) - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo

Chrome Hotword Shared Module - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

Poppit - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi

Ghostery - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij

Play Books - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmimngoggfoobjdlefbcabngfnmieonb

LastPass Vault - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncliohomlfopnmlfkepkcbnhmeijkhhf

Sidekick - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd

ScriptSafe - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiigbmnaadbkfbmpbfijlflahbdbdgdf

LocalGalleryViewerExtension - Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\opheklanmaieaeneebdohfpbjkhcgilk

==== Chromium Startpages ======================

C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences

"homepage": "http://www.google.com/",

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Preferences

settings":{"aciahcmjmecflokailenpkdchphgkefd":"FA3DD6604FCC56CB35361C52A1FA3E6F4C68ADBADDBD07361598A528E0E4C319","aepeildmfnnehghlknddebgjghlompfe":"EE2616DA8E527664271DA8F7C479E9D19D8086337956F365D3D412EE4A3C7913","agdhembpgcpfegeigidembjopfhghnpj":"521975BD4786E26033973A6444AC00FE17EB7E948BCC88E99AACC0B9203FF118","ahfgeienlihckogmohjhadlkjgocpleb":"F5E1DA33F84DFB918109AB8CE3F36EF697479F49B9FA68AFA339D21B3C60DFE3","aohghmighlieiainnegkcijnfilokake":"541CD6A75168935620D893B91446F1D132A3E1ABE56ACD55A9AB5CE8DF7948BA","apdfllckaahabafndbhieahigkjlhalf":"EB721C895B5A72E21D83EAC5C3E39717C03EA1DB5B7F6E2C199B5903DE96B1BD","bbjllphbppobebmjpjcijfbakobcheof":"EC0833729A4F03ECE844CD4EDAF4DA78982D79D85A3389E1A2D469A3CD58234B","bbmegnmpleoagolcnjnejdacakedpcgd":"674EC22E0A7A95F513B6413902BA7C299DEAC7EDF3888F7DC57CE73D0D062015","bepbmhgboaologfdajaanbcjmnhjmhfn":"4471F1A3D8FCBBDA269D1CE7A80B3EC27800AD386224669E0740106305F4A409","blpcfgokakmgnkcojhhkbfbldkacnbeo":"30FD7197D486B0F0BD702156E8E3E4DCB71C8B5B74E8A927AB2966B3928C1641","boadgeojelhgndaghljhdicfkmllpafd":"2E676514F47542BB57BEAB84C0F3C51830494D7529B7A035183160F7823DE666","cfhdojbkjhnklbpkdaibdccddilifddb":"1546274CC9F75DE1EB5686B1617968A540161A5BD15DC5D6983DA6AE8B17B80D","coobgpohoikkiipiblmjeljniedjpjpf":"E6C85C5AEC5E8A13E4E1327800A3BB3281904BB1421301A3FBD826C0D36A7218","dgkkmcknielgdhebimdnfahpipajcpjn":"1C5F532567878D532D47A46C86CDC74CDB22948933FD1AD83C043311B757995F","dnhpdliibojhegemfjheidglijccjfmc":"2B4ABD9A7CF6E853F3DE81569AB1F65056052879245D1A3AB17559EEFFA39703","eemcgdkfndhakfknompkggombfjjjeno":"CF7D1E8BA55A74C9AA8B9352632A263AD767760777BCA9186C77B3B786DD921C","ejidjjhkpiempkbhmpbfngldlkglhimk":"48B206DAF9D74860D1D446A88655D03722908935FCB1C6D192EFBB43B77AB896","ennkphjdgehloodpbhlhldgbnhmacadg":"94AA54AA409F532952495155F1F2842D800ED50C913E517A60C6469A49B8531C","fdcgdnkidjaadafnichfpabhfomcebme":"1AFCDDF5405A2F828DB3DF89577B08C17C58EA410CDD9A0EDBC7B9FB3FB9AAB2","gfdkimpbcpahaombhbimeihdjnejgicl":"9528A47E2084E55CB6A0CDED5894D945BD4AD61EB5BF882F62241CB32C598AEF","hdokiejnpimakedhajhdlcegeplioahd":"49C45D49C51BBD7785CD08CD8E8AB798248D5FBC98D463FA6C5772874ED54BBA","kcnhkahnjcbndmmehfkdnkjomaanaooo":"F19BD9475D1D64E1347D98D496D18617024A3A67921D38CE30B8CC56B3E8AAE0","kmendfapggjehodndflmmgagdbamhnfd":"E7DCF89520DB65FEBCF05C893CDAFCBDAD08268F69FC3842D40B344982AF5100","knipolnnllmklapflnccelgolnpehhpl":"65377D2646720350FA1C9FF4218A4F3639E7F4128F6CB0EBD4B9EAD28AB291FA","lccekmodgklaepjeofjdjpbminllajkg":"D0D2EA59E71A3A7C88CFC8E102FDB37A0F39BC4A0B4C5F424DDF0024F5AA655E","lmjegmlicamnimmfhcmpkclmigmmcbeh":"518364EA133EE24F10E2BACFFC348B26B792728D4822AEB2E145C3CD4329D044","mcbkbpnkkkipelfledbfocopglifcfmi":"9699139328DD4BA7CBC840CC5839211A4DDF27A02ACF2FE9932A4289C954ECFE","mfehgcgbbipciphmccgaenjidiccnmng":"8E40296BE87DD2C17FB64C193E1AE9A680592746C6CE1ADD15A2A073F8720018","mfffpogegjflfpflabcdkioaeobkgjik":"3D1793803B93CAFCE59155F206CBAB2DE319ACD9D6AC94F2630E7CEE26C19981","mgndgikekgjfcpckkfioiadnlibdjbkf":"50AC6B9BE02B0285ECBC66AAE6C876ECC9B418E674ACF23081E5A43F0625ACB3","mhjfbmdgcfjbbpaeojofohoefgiehjai":"557AF56A5561264699938EA30E658FC1D5C275DC6FC7DA47C5325B7812C1D4D2","mlomiejdfkolichcflejclcbmpeaniij":"9AA0ADE8308011EAA958FE8352DF7C469A6384066972AA15C4F155E32EAC708F","mmimngoggfoobjdlefbcabngfnmieonb":"A21A28FF99E918645AD2D54AB52CB13EEB2E40EE578961B34FCC86B53B7C395A","nbpagnldghgfoolbancepceaanlmhfmd":"99328D298DCB3798D6DD2BD11EE341D5A89DD35C9074156BFACD06F953DE716A","ncliohomlfopnmlfkepkcbnhmeijkhhf":"F9A3C9A9979B52CD763C6B96D54D33B4F5E865565B417C9E242615B783F449BF","neajdppkdcdipfabeoofebfddakdcjhd":"971FB3B9B0B3A77C10EB5C549B6BB931A3256D28ABF6EDB7E99F81ECF3E756BD","nfengeggddojhakldhlpjdlddgkkjkddabc":"4BA7BB42E7163DD21A5B75829E1C9B5BE5407A518C95C9C1EE314C57CC5909F5","nkeimhogjdpnpccoofpliimaahmaaome":"6E3A87AB7B01C78A37E406D4388FB504DE38243A8089FA882007424EAE829E44","nmmhkkegccagdldgiimedpiccmgmieda":"1B5967F0947F35DAEDE8982D551296EFA4C5ACEF2511D63B93FA193F47DCC4AD","oiiaigjnkhngdbnoookogelabohpglmd":"BC1A318C9A4006ABB20697C62DCBA5FD4F9A2609C23DF89DC03CDD1F9E81C416","oiigbmnaadbkfbmpbfijlflahbdbdgdf":"FD17BAB61733BB334C661619405C3D19781DFDF883D1BEB2E2D1DA109EC816B1","opheklanmaieaeneebdohfpbjkhcgilk":"1534172E285D03B1CDC47632F789F8215B275541F8F0EAEB3084166BE4361E3A","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"EA6BAC2178EE2F03986B73BDE1D8E37D8C106CB94250F2C74FBDC811AF24F73E","pjkljhegncpnkpknbcohdijeoejaedia":"1C0F42E2A78F328CA59163B25CFE2968B1ABC0D13ED16D6AB6EC006B70031407"}},"google":{"services":{"account_id":"1444C7536F0ECB84208BBC5F3C9AA996AD99909557BB720DAF11BD01552FECD5","last_username":"8FFF50D79718A4A7B1F0EF907BD746106C3BB86F499C33E05DCCC581E12930AE","username":"A657585F58E5341DBCFDEE8A1299057A77E5284421B81E7945F913AD41D772A5"}},"homepage":"E1C7A4DBD4AB60AC393996138C9C79345EE04D22A9F2C5151F91577A63CE2CCE","homepage_is_newtabpage":"67AAB20F8AD6F4656D73B925BA3E51687C518B5657B09FAE93A3D618227C338D","pinned_tabs":"52C1F811F62C12793C0CB65CA55FD03AAC21AB1D47F310E03E726F76E15BB7EE","prefs":{"preference_reset_time":"BBAD98B2A8BD31640BFE8B0235DEC492761A22E408D085D873EEB34A65BEE185"},"profile":{"reset_prompt_memento":"52F3E899DE5C1628B6B54FB5087350C512A7E193CDAA7183E05F945618120129"},"safebrowsing":{"incidents_sent":"8162C657C02B1F13962323A6D994435984DAE53107770A86BDCD48F3AD9F7AD2"},"search_provider_overrides":"1FDCD95B8278FBBA30C54784354C3935A9F25453DB930FACF5EC4CA2C3F31059","session":{"restore_on_startup":"83746B13B5A161D88CD65B7A5D4ED66E705C3DD9369AA77E7180CB6CD75ADDD8","startup_urls":"DFB140646BEDD9697F237EDD2ED5D02BE236D94EFC95F8C9D82D808B63693922"},"software_reporter":{"prompt_reason":"43B532D64BE1008B9EAB6CDB6184B8DAC6EDB349E63E0B3F761B1EE317E14114","prompt_seed":"F23DFCD6A12BCDCE706B09E4EE83B08C684C14D586DF6CBB98205D8DF1954310","prompt_version":"920B2FC238426B06A414C36B77310E865606321F253B1397275BB8717A35C235"},"sync":{"remaining_rollback_tries":"FA97824B0295919EEBD8284D68581BB72BA17B3990FB0FE1F2C9B5B4F57867A9"}},"super_mac":"BA4B09004C45770CB0124C795087422973A27CEC75688A47B2082E45CF990439"},"session":{"restore_on_startup":4,"startup_urls":["http://www.google.ca/]},"sync":{"remaining_rollback_tries":0}}

==== Chromium Fix ======================

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.ak.facebook.com_0.localstorage deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.ak.facebook.com_0.localstorage-journal deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.getsidekick.com_0.localstorage deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.getsidekick.com_0.localstorage-journal deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_oiiaigjnkhngdbnoookogelabohpglmd_0.localstorage deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_oiiaigjnkhngdbnoookogelabohpglmd_0.localstorage-journal deleted successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oiiaigjnkhngdbnoookogelabohpglmd deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/?ocid=iehp"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] not found

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/?ocid=iehp"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{716CB19C-CBA6-48F6-8326-E39A1438B39E} Google Url="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

{80B57BF1-97AF-4E19-BAF8-C8F31A7DE709} Unknown Url="Not_Found"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1308239477-2047963427-3902588853-1003\Software\Microsoft\Internet Explorer\SearchScopes\{80B57BF1-97AF-4E19-BAF8-C8F31A7DE709} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{80B57BF1-97AF-4E19-BAF8-C8F31A7DE709} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{80B57BF1-97AF-4E19-BAF8-C8F31A7DE709} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Policies\Chromium deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easybits Recovery deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPConnectionManager deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings deleted successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Aurora\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Aurora\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully

C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Aurora\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\Users\Aurora\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully

C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\Users\Default User\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

C:\Users\Aurora\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=180 folders=70 201471004 bytes)

==== Empty Temp Folders ======================

C:\Users\Administrator\AppData\Local\Temp emptied successfully

C:\Users\Aurora\AppData\Local\Temp will be emptied at reboot

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\Users\Guest\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied

C:\Users\Aurora\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 06/08/2015 at 9:52:20.75 ======================

TwinHeadedEagle · August 7, 2015

Very good. How is your PC behaving now?

gousey · August 7, 2015

after working all day yesterday and today, a couple of MBAM scans shows no PUP registry entries. All is well.

Thanks so much. This can be closed.

TwinHeadedEagle · August 7, 2015

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself

Recommended reading:

MUST READ - security tips:

Computer Security - a short guide to staying safer online.

Simple and easy ways to keep your computer safe and secure on the Internet

How Malware Spreads - How did I get infected

MUST READ - general maintenance:

What to do if your Computer is running slowly?

The Importance of Software Updating:

In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.

Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

Recommended additional software:

CCleaner - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

Adblock - to surf the web without annoying ads!

Post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

Run the tool by right click on the icon and Run as administrator option.
Make sure that these ones are checked:
- Remove disinfection tools
- Purge system restore
- Reset system settings
Push Run.
The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix

Tool deletes old system restore points and create a fresh system restore point after cleaning.

My help is free for everybody.

If you're happy with the help provided and/or wish to show your appreciation for the assistance you received, then you can consider a donation:

Thank you!

Stay safe,

TwinHeadedEagle

AdvancedSetup · September 2, 2015

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

persistent registry pup entries

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information