[bettei]

I am having a little trouble understanding the last part of your instructions. First, I had to restore the "run" command to my menu, and I do not see a "start search" box either.

I opened the notepad and pasted the registry editor version onto my desktop, but not sure if it is right or not, I can't find the place where I can rightclick and run as admin., so I must not have the right notepad.exe open. How can I do that if I cant find the start search box? All I see is "search programs and files" with a place to type in something. And I can type in notepad.exe, but all I get is a blank page to paste something into. I don't understand how to get the notepad .exe. to a place to right click and run it like you said. Sorry I don't understand.

is this the right thing?

Attached Files

•  fixer.reg   567bytes   156 downloads

Edited by bettei, 27 June 2012 - 06:58 PM.

[Advertisements]

And if the fixer file is correct, I understand how to right click and I see "merge"...but there I am lost. Not sure how to "merge new information with the registry". What do you mean exactly?

[bettei]

And if the fixer file is correct, I understand how to right click and I see "merge"...but there I am lost. Not sure how to "merge new information with the registry". What do you mean exactly?

[Jintan]

Yes, sorry my steps are a tad jumbled. Right click - merge. It will return necessary Startups.

[bettei]

So I have the right text to merge? And all I have to do is right click and select merge, and it does it by itself? And I have downloaded Malewarebytes and it is running a scan right now on the laptop. I will post it when it finishes?

BTW, in case I forget to ask you, those check marks I removed from show hidden files (not recommended", should I go back and recheck them when this is all done?

Edited by bettei, 27 June 2012 - 07:27 PM.

[bettei]

Here is malware one

Attached Files

•  mbam-log-2012-06-27 (20-08-57).txt   1.81KB   94 downloads

[bettei]

I ran the eset again and it showed no threats, so I clicked on the box where it said to uninstall when closing, so I have no log to post. Malwarebytes found none either.
Oddly, when I clicked on your link to download the Malwarebytes, I again got the "Firefox has prevented the page from being redirected". Yet all these scans are showing nothing. Is that redirect notice I get normal?

Please let me know if I need to uninstall combofix, and if I did the "fixer" correctly. Thanks.

[Jintan]

So no malware being picked up anywhere so far. We'll uninstall ComboFix and make other final changes when we wrap things up here. Please update me on what issues still exist there, before we consider doing all that.

[bettei]

I still think the pages load really slow, but maybe it is just the fault of the games themselves. Sometimes there is a popup that says something about "this script has stopped. do I want to continue" or something like that. And I still get "Firefox has prevented page from being directed to another page". It happened when I clicked on the download link for Malwarebytes. I don't know if that is a problem or not.

[Jintan]

Let me review the logs, and see if I spot some culprits or changes we can make. I'll post tomorrow after a review.

[bettei]

Thanks!

[Jintan]

Open Gmer again. Once it has completed it's opening scan, this time just right click in the white space in the display and select Options - Only non MS files. Then click Scan and allow Gmer to run a different scan. Once that completes click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.

[bettei]

I am never sure that I am doing this right, hope this is it. I also notice "yield manager and double click" when the pages load along with all the other letters when pages load.

Attached Files

•  New Text Document (2).txt   30.38KB   114 downloads

Edited by bettei, 30 June 2012 - 06:18 PM.

[bettei]

I still wondered if any of the scans showed you anything. Still get redirects, pages still load slowly. I have questions about the Flash player version 11.3.r 300. It crashes a lot. I have uninstalled it, gone to Adobe and downloaded a newer version, yet it still crashes, and when that happens, I get a window saying "flash player 11.3.r 300 has stopped working, windows is seeking a solution".

What I don't understand is why it keeps going back to a version I have uninstalled. Is it possible that the version I keep getting the crashes with is not a legitimate flash player? I don't know why it keeps going back to a version I have uninstalled.

I will be away from the internet for the next two weeks, I will check here when I return to see your answers. Thanks!

Edited by bettei, 05 July 2012 - 07:01 PM.

[Jintan]

Oy vey, I have no idea why I did not reply here. Missed some IE entries in the earlier OTL log.


Temp disable security softwares, then open OTL again.

Under the Custom Scans/Fixes box at the bottom, paste in the following (inside the Code box):

:OTL
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {5587CF5C-BEC8-4829-9343-E77335EB26ED}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{5587CF5C-BEC8-4829-9343-E77335EB26ED}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKLM\..\SearchScopes,DefaultScope = {E0F4B07D-749E-401D-A571-67F336F6FEDC}
IE - HKLM\..\SearchScopes\{E0F4B07D-749E-401D-A571-67F336F6FEDC}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
IE - HKCU\..\SearchScopes,DefaultScope = {E0F4B07D-749E-401D-A571-67F336F6FEDC}
IE - HKCU\..\SearchScopes\{E0F4B07D-749E-401D-A571-67F336F6FEDC}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA_enUS370
IE - HKCU\..\SearchScopes\{F4A054AB-EE8F-45FE-9405-9A9D94D2B0D9}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA

Then click the Run Fix button at the top of the OTL display. When that completes a log will open - post that here in your next reply please. That log will also be saved in the c:\_OTL\MovedFiles folder, in the form of Date and Time (mmddyyyy_hhmmss.log).

[bettei]

here it is  07062012_074704.log   3.9KB   97 downloads