WinUpdate detected as Spyware.PasswordStealer?

Zinedane · January 17, 2016

Did a scan earlier due to my twitter account being compromised but I don't know if it was just coincidence since this pc belongs to my dad and hasn't been scanned in ages.

Here's a copy of the scan results. I'm quite worried as although it's labeled as Spyware.PasswordStealer, It is a value in the registry and as can be seen I am sure that it is the WinUpdate/Windows Update key.

I see some other PUP's there too but I'm only most hesitant on the Spyware.PasswordStealer and Trojan.Malpack.VB which is a svchost.exe

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 1/17/2016

Scan Time: 1:26 PM

Logfile: scanned.txt

Administrator: Yes

Version: 2.2.0.1024

Malware Database: v2016.01.16.05

Rootkit Database: v2016.01.09.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7

CPU: x64

File System: NTFS

User: Torres

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 802981

Time Elapsed: 4 hr, 53 min, 45 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 5

PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\avaxvyyvyf, , [5df82119881163d36a05b17449bb9868],

PUP.Optional.SProtector, HKLM\SOFTWARE\WOW6432NODE\SProtector, , [11440535b6e3fa3cd7b9e9bd7a89ff01],

PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\CltMngSvc_RASAPI32, , [1b3a89b1dbbe0b2bacbf9c89887cef11],

PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\CltMngSvc_RASMANCS, , [2431ae8c0d8c53e395d663c2c63e58a8],

PUP.Optional.YahooVNM, HKU\S-1-5-21-819453736-4280033654-1804472810-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}, , [68ede852f7a2082ec23bc91e62a109f7],

Registry Values: 2

Spyware.PasswordStealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|WinUpdate, Wscript.exe //e:VBScript "C:\Windows\:Microsoft Office Update for Windows XP.sys", , [f46116241a7f360094a62febf50f50b0]

PUP.Optional.YahooVNM, HKU\S-1-5-21-819453736-4280033654-1804472810-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}|URL, https://ph.search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10099_swoc_campaign_151005__yaie&p={searchTerms},, [68ede852f7a2082ec23bc91e62a109f7]

Registry Data: 0

(No malicious items detected)

Folders: 5

PUP.Optional.OpenCandy, C:\Users\Torres\AppData\Roaming\OpenCandy, , [8bca87b3d1c886b0c7c799fa0ef4718f],

PUP.Optional.OpenCandy, C:\Users\Torres\AppData\Roaming\OpenCandy\878AA39A63914AD4A83B434E3BAEDE5B, , [8bca87b3d1c886b0c7c799fa0ef4718f],

PUP.Optional.SearchProtect.AppFlsh, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SearchProtect, , [84d121193a5fd85e37e87e4cd131b24e],

PUP.Optional.SearchProtect.AppFlsh, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SearchProtect\SearchProtect, , [84d121193a5fd85e37e87e4cd131b24e],

PUP.Optional.SearchProtect.AppFlsh, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SearchProtect\SearchProtect\rep, , [84d121193a5fd85e37e87e4cd131b24e],

Files: 38

Trojan.MalPack.VB, C:\Users\Torres\AppData\Local\svchost.exe, , [8ec73307465380b6298ba3a318e92ed2],

Backdoor.Agent.E, C:\ProgramData\Microsoft\Microsoft.lnk, , [71e48eac27722e08d2391ac582803dc3],

Worm.Agent, C:\ProgramData\autorun.inf, , [65f0d9611d7ce452c63d1470c53e9d63],

PUP.Optional.SearchProtect.AppFlsh, C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, , [89ccae8ceaafff37db81978e21e322de],

PUP.Optional.OpenCandy, C:\Users\Torres\AppData\Roaming\OpenCandy\878AA39A63914AD4A83B434E3BAEDE5B\PCTU2015-EN-1day-AID1006075.exe, , [8bca87b3d1c886b0c7c799fa0ef4718f],

PUP.Optional.SearchProtect.AppFlsh, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat, , [84d121193a5fd85e37e87e4cd131b24e],

PUP.Optional.Babylon, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (user_pref("extensions.BabylonToolbar.prtkHmpg", 0)

, ,[68edd268079291a582ef48915ba953ad]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (user_pref("extensions.mysearchdial.aflt", "ir_14_15_ch")

, ,[8cc93307d6c3c86e8e9c93472cd86d93]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (es to this file while the application is running,

* the changes will b manual change), ,[4b0a6fcbe7b2fc3aab7f7c5e49bbb44c]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (plication is running,

* the changes will b manual change to preferences, you can visit the URL about:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBar", 0);

useref("aol_toolbar.default.search.check", false);

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1436073236);

user_pref("app6072876);

user_pref("app.update.last), ,[75e047f3554454e2c2680fcbc1436a96]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (ground-update-timer", 1436073236);

user_pref("app), ,[b69f1129b8e1b77ff23886547d87f10f]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (ke changes to this file while the application is runn), ,[83d2ef4b5a3f9c9adb4f25b53fc55da3]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (hanges to this file while the application is runn), ,[f362e159bbdeca6c7fab12c84aba2bd5]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (ke changes to this file while the application is run), ,[96bfd961cacfba7cdb4fddfd45bffd03]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (changes to this file while the application is runn), ,[84d1d664217825119f8bcc0e27dd669a]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (e changes to this file while the application is running,

* the changes will b manual change to preferences, you can visit the URL about:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBar", 0);

useref("aol_toolbar.default.search.check", false);

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1436073236);

user_pref("app6072876);

user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1436072996);

user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1436072636);

user_pref("app.update.lastUpdateTime.experiments-update-timer", 1436073116);

user_pref("app.update.lastUpd), ,[73e2d268b4e5c2749595b6246a9a5da3]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (timer", 1436073116);

user_pref("app.update.lastUpdat), ,[460f1d1d0e8bcb6b2a006e6c51b3af51]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (changes to this file while the application is running,

* the changes will b man), ,[0a4bd7632772f83e73b7fae0c1432cd4]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (he application is running,

* the changes will b), ,[cb8a9d9d9ffa72c4ae7c964463a1b54b]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (ake changes to this file while the application is running,

* the changes will b manual change to preferences, you can visit the URL about:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBar", 0);

useref("aol_toolbar.default.search.check", false);

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1436073236);

user_pref("app6072876);

user_pref("app.update.lastUpdateTime.blocklist-background-updat), ,[d28378c21e7bb87e33f73e9c3bc9f808]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (update.lastUpdateTime.blocklist-background-update-timer", 14), ,[7fd658e2b3e62e08999192489f6521df]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (to this file while the application is running,

* the c), ,[2c295bdf1188b87e0a201fbb31d3738d]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (nges to this file while the application is running,

* the), ,[57feee4c6138f93deb3f34a6aa5ab14f]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (s to this file while the application is running,

* the changes will b manual change to preferences, you can visit the URL about:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBar", 0);

useref("aol_toolbar.default.search.check", false);

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1436073236);

user_pref("app6072876);

user_pref("app.update.lastUpdateTime.blocklist-background-update-timer"), ,[0352ee4c78211b1bcb5fbd1dd331e21e]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (p.update.lastUpdateTime.blocklist-background-update-timer", 1436072), ,[eb6a6ccef6a378bed35759814fb5ba46]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: ( file while the application is running,

* the changes will b manual change to preferences, you can visit the URL about:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBar", 0);

useref("aol_toolbar.default.search.check", false);

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1436073236);

user_pref("app6072876);

user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1436072996)), ,[c590a298b1e872c40c1e15c59272f20e]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (date.lastUpdateTime.blocklist-background-update-timer", 1436072996);

user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1436072636);

user_pref("app.update.lastUpdateTime.), ,[e4711d1d6039072f181258827292f30d]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (t:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBa), ,[223387b39efb44f2ca600cce838137c9]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: ( to this file while the application is running,

* the change), ,[81d4ff3b2079c17563c73c9ee71de818]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (o this file while the application is running,

*), ,[3e1751e9d6c3d75f5ecc1dbd7b8951af]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (ake changes to this file while the application is running,

* t), ,[fc59e6542f6ab383e347eceeaf55f10f]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (this file while the application is running,

* the c), ,[84d18dad544589ad64c68654e1233fc1]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (changes to this file while the application is running,

* the changes will b manual change to preferences, you can visit the URL about:config

*/

user_pref("DataMngr.Updater.Enabdfind.flashBar", 0);

useref("aol_toolbar.default.search.check", false);

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1436073236);

user_pref("app6072876);

user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1), ,[99bccc6e53460630e1495189d4306a96]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (lastUpdateTime.blocklist-background-update-timer", 143), ,[a8ad42f8bbde44f284a623b73bc9728e]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (anges to this file while the application is running,

*), ,[91c41d1df9a0b086b575cf0beb196997]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (nges to this file while the application is running,

), ,[1441dc5e9009bf77f5354b8f26de9c64]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (hanges to this file while the application is running,

), ,[96bf84b6f9a079bdc7637268be46ef11]

PUP.Optional.MySearchDial, C:\Users\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default\prefs.js, Good: (), Bad: (nges to this file while the application is running,

* the change), ,[d184ba8075243105c66486545ca8fd03]

Physical Sectors: 0

(No malicious items detected)

(end)

Any input?

blender · January 17, 2016

Hello,

Thank you for posting the report.

None of these look like false positives.. the svchost.exe you speak of is in your local application directory. You have a legit svchost.exe in system32 (which is not the one we are hitting)

You have quite a bit of nastiness going on there including backdoor activity.

You should allow MBAM to clean this up. Let MBAM clean it, reboot as it asks then re-scan to ensure everything is cleaned up.

You will want to change passwords to any sensitive sites/apps you use since your passwords & user info may have been stolen too.

If you still have troubles with the machine afterward or MBAM keeps detecting stuff, head over to the help forum here:

https://forums.malwarebytes.org/index.php?/topic/119858-available-assistance-for-possibly-infected-computers/

The experts there will help clean out whatever is left & post some advise on future prevention/protection.

Kindly note, it sometimes takes a day or 2 for them to respond. Most of them are volunteers.

kevinf80 · January 17, 2016

Hello and welcome to Malwarebytes,

Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". <---- Very Important
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
Make sure Addition.txt is checkmarked under "Optional scans"
Press Scan button to run the tool....
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also make a log named (Addition.txt) Please attach those logs to your reply.

Let me see those logs in your next reply...

Thank you,

Kevin...

Zinedane · January 17, 2016

Hello,

Thank you for posting the report.
None of these look like false positives.. the svchost.exe you speak of is in your local application directory. You have a legit svchost.exe in system32 (which is not the one we are hitting)

You have quite a bit of nastiness going on there including backdoor activity.
You should allow MBAM to clean this up. Let MBAM clean it, reboot as it asks then re-scan to ensure everything is cleaned up.

You will want to change passwords to any sensitive sites/apps you use since your passwords & user info may have been stolen too.

If you still have troubles with the machine afterward or MBAM keeps detecting stuff, head over to the help forum here:
https://forums.malwarebytes.org/index.php?/topic/119858-available-assistance-for-possibly-infected-computers/

The experts there will help clean out whatever is left & post some advise on future prevention/protection.
Kindly note, it sometimes takes a day or 2 for them to respond. Most of them are volunteers.

Hello and thank you for the quick response,

May I be assured that the Spyware.PasswordStealer is not really Windows Update? or an important part of windows update?

Thank you

kevinf80 · January 17, 2016

Please follow instructions in reply #3

blender · January 17, 2016

Zinedane:
Windows update runs as a system service.. the registry entry being tagged by MBAM here is pointing to a file attached to the windows directory in the form of "Alternate Data Stream" which is NOT normal.

You can read about "Alternate Data Streams" here:
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Alternate_Data_Streams.html(no need to download anything from the adverts on the page)

Carry on with what Kevin has you doing please, he'll get you cleaned up.

Zinedane · January 17, 2016

Please follow instructions in reply #3

Doing it now. thanks

Zinedane · January 17, 2016

Zinedane:
Windows update runs as a system service.. the registry entry being tagged by MBAM here is pointing to a file attached to the windows directory in the form of "Alternate Data Stream" which is NOT normal.
You can read about "Alternate Data Streams" here:
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Alternate_Data_Streams.html(no need to download anything from the adverts on the page)
Carry on with what Kevin has you doing please, he'll get you cleaned up.

Alright but should I remove those Malware detected by Malwarebytes first before running adwcleaner?

Zinedane · January 17, 2016

Doing it now. thanks

If I click "Cleaning" in AdwCleaner will it delete those everything that it has detected?

If so I don't know which to keep and which to delete.

Zinedane · January 17, 2016

Hello and welcome to Malwarebytes,
Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...
Please open Malwarebytes Anti-Malware.
On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". <---- Very Important
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.
        'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.
To get the log from Malwarebytes do the following:
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:
Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…
If Malwarebytes is not installed follow these instructions first:
Download Malwarebytes Anti-Malware to your desktop.
Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....
Next,
Download AdwCleaner by Xplode onto your Desktop.
Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...
Next,
Download Farbar Recovery Scan Tool and save it to your desktop.
Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Double-click to run it. When the tool opens click Yes to disclaimer.
(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
Make sure Addition.txt is checkmarked under "Optional scans"
Press Scan button to run the tool....
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also make a log named (Addition.txt) Please attach those logs to your reply.
Let me see those logs in your next reply...
Thank you,
Kevin...

This post is for AdwCleaner Log

I didn't "check" all of it since I don't know which files/folders should be deleted. Any Input? Farbar Recovery Scan Tool Log will follow, as it is still scanning.

# AdwCleaner v5.029 - Logfile created 17/01/2016 at 21:55:32

# Updated 11/01/2016 by Xplode

# Database : 2016-01-15.2 [server]

# Operating system : Windows 7 Ultimate (x64)

# Username : Torres - TORRES-PC

# Running from : D:\downloads\AdwCleaner.exe

# Option : Cleaning

# Support : http://toolslib.net/forum

***** [ Services ] *****

[x] Service Not Deleted : YahooAUService

***** [ Folders ] *****

[x] Folder Not Deleted : C:\Program Files\Windows Sidebar\Shared Gadgets

\gadgetbox.gadget

[x] Folder Not Deleted : C:\Program Files (x86)\Yahoo!\Companion

[x] Folder Not Deleted : C:\Program Files (x86)\myfree codec

[x] Folder Not Deleted : C:\Program Files (x86)\BitLord

[x] Folder Not Deleted : C:\Program Files (x86)\Common Files\Innovative Solutions

[x] Folder Not Deleted : C:\ProgramData\ytd video downloader

[x] Folder Not Deleted : C:\ProgramData\Yahoo! Companion

[x] Folder Not Deleted : C:\ProgramData\Innovative Solutions

[x] Folder Not Deleted : C:\ProgramData\BlocckUTuBeAd

[x] Folder Not Deleted : C:\ProgramData\SuaiveNewaAppPz

[x] Folder Not Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\myfree codec

[x] Folder Not Deleted : C:\Users\Torres\AppData\Local\Innovative Solutions

[x] Folder Not Deleted : C:\Users\Torres\AppData\Local\BitLord

[x] Folder Not Deleted : C:\Users\Torres\AppData\LocalLow\Yahoo! Companion

[x] Folder Not Deleted : C:\Users\Torres\AppData\LocalLow\Yahoo!\Companion

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\OpenCandy

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\RHEng

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\RPEng

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\Yahoo!\Companion

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\BitLord

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\Easeware

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\Microsoft\Windows\Start

Menu\Programs\BitLord

[x] Folder Not Deleted : C:\Users\Torres\AppData\Roaming\Mozilla\Firefox

\Profiles\zw4v3fc7.default\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}

[x] Folder Not Deleted : C:\Windows\SysWOW64\config\systemprofile\AppData\Local

\SearchProtect

[x] Folder Not Deleted : D:\my documents\BitLord

***** [ Files ] *****

[x] File Not Deleted : C:\Users\Torres\AppData\Local\Google\Chrome\User Data

\Default\Local Storage\hxxps_static.olark.com_0.localstorage[x] File Not Deleted

: C:\Users\Torres\AppData\Local\Google\Chrome\User Data\Default\Local Storage

\hxxps_static.olark.com_0.localstorage-journal[x] File Not Deleted : C:\Users

\Torres\AppData\Local\Google\Chrome\User Data\Default\Local Storage

\hxxp_st.chatango.com_0.localstorage[x] File Not Deleted : C:\Users\Torres

\AppData\Local\Google\Chrome\User Data\Default\Local Storage

\hxxp_st.chatango.com_0.localstorage-journal[x] File Not Deleted : C:\Users

\Torres\AppData\Roaming\Mozilla\Firefox\Profiles\zw4v3fc7.default

\invalidprefs.js[x] File Not Deleted : C:\Windows\AppPatch\Custom\{8a4d5a43-

c64a-45ab-bdf4-804fe18ceafd}.sdb[x] File Not Deleted : C:\Windows

\SysWOW64\lavasofttcpservice.dll

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

[-] Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe

[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar

[-] Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-

BD96E19DEE56}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-

F8DE92DD98DB}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-

743E72D283B0}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-

7695ECA05670}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-

1978A1BB060D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-

932B0121B472}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-

D0FBFBE7ECD3}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-

CEBE6E7BCB52}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-

082B8C2AE556}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-

0090271D4F88}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-

7AF40E7D593F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5C3B5DAA-0AFF-4808-90FB-

0F2F2D760E36}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-

1ED148AC8FFE}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-

56FC5162A994}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

\{0F3DC9E0-C459-4A40-BCF8-747BD9322E10}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings

\{0F3DC9E0-C459-4A40-BCF8-747BD9322E10}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved

\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved

\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89

-9713FBEDB671}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16

-617106245BB7}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9

-A6CD64D4E636}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-

8B6B-CF637B2D465A}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275

-A322A398D93F}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-

AA3C-1ED148AC8FFE}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-

8A5D-D1B7464B242D}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779

-9F7378555A8F}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07

-57B53D1C4215}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-

84DB-6F1514110BD5}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-

9FAE-4B1B2ADAF17B}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7

-21485FA8390B}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552

-B94356F39FFE}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6

-21BF6525F3FE}

[-] Key Deleted : HKCU\Software\Myfree Codec

[-] Key Deleted : HKCU\Software\smarttweak

[-] Key Deleted : HKCU\Software\Softonic

[-] Key Deleted : HKCU\Software\Yahoo\Companion

[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar

[-] Key Deleted : HKCU\Software\WEBAPP

[!] Key Not Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-

84D9848AE48B}

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion

[-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

[-] Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}

[-] Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}

[-] Key Deleted : HKLM\SOFTWARE\dt soft\daemon tools toolbar

[-] Key Deleted : HKLM\SOFTWARE\Myfree Codec

[-] Key Deleted : HKLM\SOFTWARE\SearchquSRTB

[-] Key Deleted : HKLM\SOFTWARE\SP Global

[-] Key Deleted : HKLM\SOFTWARE\SProtector

[-] Key Deleted : HKLM\SOFTWARE\Uniblue

[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

\MyFreeCodec

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo!

Toolbar

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo!

Companion

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\{8B9FA5FF-3E61-4658-B0DA-E6DDB46D6BAD}_is1

[-] Key Deleted : HKU\.DEFAULT\Software\AskToolbar

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-

84D9848AE48B}

[-] Key Deleted : HKU\S-1-5-19\Software\AppDataLow\{5F189DF5-2D05-472B-9091-

84D9848AE48B}

[-] Key Deleted : HKU\S-1-5-20\Software\AppDataLow\{5F189DF5-2D05-472B-9091-

84D9848AE48B}

***** [ Web browsers ] *****