[Nutloaf]

Hi soclueless here is my coorected instructions for ADWcleaner. This will delete all the malware that was found in the 1st scan.

ADWcleaner

• Right click ADWcleaner and Run as Administrator then select Scan
• Once the scan is complete click Clean
• A reboot will be asked for click O.K
• On reboot a log will be produced, please post in your next reply.

Post this log and we can move on

[Advertisements]

Still with me?

[Nutloaf]

Still with me?

[soclueless]

yes sorry have been away with work.. i'll run the report again and post it.

[Nutloaf]

Thanks for the reply No problem I just have to check in every couple of days

[soclueless]

# AdwCleaner v3.002 - Report created 06/09/2013 at 22:24:05
# Updated 01/09/2013 by Xplode
# Operating System : Windows Vista ™ Home Premium Service Pack 2 (32 bits)
# Username : Emma - EMMA-PC
# Running from : C:\Users\Emma\Desktop\Virus Checking\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v7.0.6002.18005


-\\ Mozilla Firefox v23.0.1 (en-GB)

[ File : C:\Users\Emma\AppData\Roaming\Mozilla\Firefox\Profiles\dzf6nx5b.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [14371 octets] - [01/09/2013 21:29:41]
AdwCleaner[R1].txt - [13882 octets] - [02/09/2013 20:46:02]
AdwCleaner[R2].txt - [1087 octets] - [06/09/2013 22:21:02]
AdwCleaner[S0].txt - [14176 octets] - [02/09/2013 20:53:30]
AdwCleaner[S1].txt - [1009 octets] - [06/09/2013 22:24:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1069 octets] ##########

[Nutloaf]

Now I see what happened, you have cleaned twice better safe than sorry. O.K the log I need to see will be called : AdwCleaner[S0].txt [S0] being the first clean.

C:\ADWCleaner\AdwCleaner[S0].txt

Post that and we will say no more about ADWcleaner

[soclueless]

# AdwCleaner v3.002 - Report created 02/09/2013 at 20:46:02
# Updated 01/09/2013 by Xplode
# Operating System : Windows Vista ™ Home Premium Service Pack 2 (32 bits)
# Username : Emma - EMMA-PC
# Running from : C:\Users\Emma\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Users\Emma\AppData\Roaming\Mozilla\Firefox\Profiles\dzf6nx5b.default\\invalidprefs.js
File Found : C:\Users\Emma\AppData\Roaming\Mozilla\Firefox\Profiles\dzf6nx5b.default\user.js
Folder Found C:\ProgramData\Babylon
Folder Found C:\ProgramData\Trymedia
Folder Found C:\Users\Emma\AppData\Local\PackageAware
Folder Found C:\Users\Emma\AppData\Roaming\Mozilla\Firefox\Profiles\dzf6nx5b.default\Conduit

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\BabSolution
Key Found : HKCU\Software\Delta
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Found : HKLM\SOFTWARE\Classes\Prod.cap
Key Found : HKLM\Software\Delta
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Product Found : Google Update Helper

***** [ Browsers ] *****

-\\ Internet Explorer v7.0.6002.18005


-\\ Mozilla Firefox v23.0.1 (en-GB)

[ File : C:\Users\Emma\AppData\Roaming\Mozilla\Firefox\Profiles\dzf6nx5b.default\prefs.js ]

Line Found : user_pref("CT2438727.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Line Found : user_pref("CT2438727.CTID", "CT2438727");
Line Found : user_pref("CT2438727.CommunitiesChangesLastCheckTime", "0");
Line Found : user_pref("CT2438727.CurrentServerDate", "17-11-2010");
Line Found : user_pref("CT2438727.DialogsAlignMode", "LTR");
Line Found : user_pref("CT2438727.DownloadReferralCookieData", "");
Line Found : user_pref("CT2438727.FirstServerDate", "3-11-2010");
Line Found : user_pref("CT2438727.FirstTime", true);
Line Found : user_pref("CT2438727.FirstTimeFF3", true);
Line Found : user_pref("CT2438727.FirstTimeSettingsDone", true);
Line Found : user_pref("CT2438727.FixPageNotFoundErrors", true);
Line Found : user_pref("CT2438727.GroupingInvalidateCache", false);
Line Found : user_pref("CT2438727.GroupingLastCheckTime", "0");
Line Found : user_pref("CT2438727.GroupingLastServerUpdateTime", "0");
Line Found : user_pref("CT2438727.GroupingServerCheckInterval", 1440);
Line Found : user_pref("CT2438727.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Line Found : user_pref("CT2438727.Initialize", true);
Line Found : user_pref("CT2438727.InitializeCommonPrefs", true);
Line Found : user_pref("CT2438727.InstallationAndCookieDataSentCount", 3);
Line Found : user_pref("CT2438727.InstalledDate", "Wed Nov 03 2010 16:39:15 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CT2438727.InvalidateCache", false);
Line Found : user_pref("CT2438727.IsGrouping", false);
Line Found : user_pref("CT2438727.IsMulticommunity", false);
Line Found : user_pref("CT2438727.IsOpenThankYouPage", true);
Line Found : user_pref("CT2438727.IsOpenUninstallPage", true);
Line Found : user_pref("CT2438727.LanguagePackLastCheckTime", "Wed Nov 17 2010 09:59:22 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CT2438727.LanguagePackReloadIntervalMM", 1440);
Line Found : user_pref("CT2438727.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
Line Found : user_pref("CT2438727.LastLogin_2.7.1.3", "Wed Nov 17 2010 21:12:36 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CT2438727.LatestVersion", "2.7.1.3");
Line Found : user_pref("CT2438727.Locale", "en");
Line Found : user_pref("CT2438727.LoginCache", 4);
Line Found : user_pref("CT2438727.MCDetectTooltipHeight", "83");
Line Found : user_pref("CT2438727.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Line Found : user_pref("CT2438727.MCDetectTooltipWidth", "295");
Line Found : user_pref("CT2438727.RadioLastCheckTime", "0");
Line Found : user_pref("CT2438727.RadioLastUpdateIPServer", "0");
Line Found : user_pref("CT2438727.RadioLastUpdateServer", "0");
Line Found : user_pref("CT2438727.SearchBoxWidth", 211);
Line Found : user_pref("CT2438727.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2438727&octid=EB_ORIGINAL_CTID&SearchSource=1");
Line Found : user_pref("CT2438727.SearchFromAddressBarIsInit", true);
Line Found : user_pref("CT2438727.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2438727&q=");
Line Found : user_pref("CT2438727.SearchInNewTabEnabled", true);
Line Found : user_pref("CT2438727.SearchInNewTabIntervalMM", 1440);
Line Found : user_pref("CT2438727.SearchInNewTabLastCheckTime", "Wed Nov 17 2010 09:58:57 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CT2438727.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
Line Found : user_pref("CT2438727.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
Line Found : user_pref("CT2438727.SearchInNewTabUserEnabled", false);
Line Found : user_pref("CT2438727.SettingsCheckIntervalMin", 120);
Line Found : user_pref("CT2438727.SettingsLastCheckTime", "Wed Nov 17 2010 21:12:36 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CT2438727.SettingsLastUpdate", "1287517459");
Line Found : user_pref("CT2438727.ThirdPartyComponentsInterval", 504);
Line Found : user_pref("CT2438727.ThirdPartyComponentsLastCheck", "Wed Nov 03 2010 16:39:13 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CT2438727.ThirdPartyComponentsLastUpdate", "1246790578");
Line Found : user_pref("CT2438727.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=101&sealid=112");
Line Found : user_pref("CT2438727.UserID", "UN41705849267640116");
Line Found : user_pref("CT2438727.ValidationData_Toolbar", 2);
Line Found : user_pref("CT2438727.alertChannelId", "832836");
Line Found : user_pref("CT2438727.backendstorage.currentgame", "706F6B6572");
Line Found : user_pref("CT2438727.clientLogIsEnabled", true);
Line Found : user_pref("CT2438727.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Line Found : user_pref("CT2438727.myStuffEnabled", true);
Line Found : user_pref("CT2438727.myStuffPublihserMinWidth", 400);
Line Found : user_pref("CT2438727.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Line Found : user_pref("CT2438727.myStuffServiceIntervalMM", 1440);
Line Found : user_pref("CT2438727.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Line Found : user_pref("CT2438727.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1249595/1245268/UK", "\"0\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/832836/828639/UK", "\"0\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/UK", "\"0\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2857573", "\"0\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "MUj9hNyEiPxkVQ8Q8IYZ6A==");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "ZF/VZo7UyQBp8ghNNzhnSQ==");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "+RsYuZ9IN1smka6Zuggr5w==");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "t6SQZ7j9WsBHhE8zC0kAEQ==");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.0.19", "\"0d291c3f9a7cb1:0\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.0.19", "\"0d291c3f9a7cb1:0\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2857573", "\"634289840782570000\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "634293235860000000");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2857573/CT2857573", "\"1294152330\"");
Line Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634292354593700000\"");
Line Found : user_pref("CommunityToolbar.EngineOwner", "");
Line Found : user_pref("CommunityToolbar.EngineOwnerGuid", "");
Line Found : user_pref("CommunityToolbar.EngineOwnerToolbarId", "");
Line Found : user_pref("CommunityToolbar.IsEngineShown", true);
Line Found : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Line Found : user_pref("CommunityToolbar.OriginalEngineOwner", "");
Line Found : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "");
Line Found : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "");
Line Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://uk.search.yahoo.com/search?fr=mcafee&p=");
Line Found : user_pref("CommunityToolbar.ToolbarsList", "CT2438727");
Line Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2438727");
Line Found : user_pref("CommunityToolbar.alert.alertInfoInterval", 60);
Line Found : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Tue Jan 04 2011 16:28:40 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Line Found : user_pref("CommunityToolbar.alert.locale", "en");
Line Found : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Line Found : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Tue Jan 04 2011 16:28:31 GMT+0000 (GMT Standard Time)");
Line Found : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1291052234");
Line Found : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Line Found : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Line Found : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Line Found : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Line Found : user_pref("CommunityToolbar.alert.userId", "{f412aa28-621c-41d1-ab30-935c5a5b8eb8}");
Line Found : user_pref("CommunityToolbar.globalUserId", "acb6581f-9bd8-414f-88c5-70c6b5a68ae7");
Line Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Line Found : user_pref("extensions.delta.admin", false);
Line Found : user_pref("extensions.delta.aflt", "babsst");
Line Found : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Line Found : user_pref("extensions.delta.autoRvrt", "false");
Line Found : user_pref("extensions.delta.dfltLng", "en");
Line Found : user_pref("extensions.delta.excTlbr", false);
Line Found : user_pref("extensions.delta.ffxUnstlRst", true);
Line Found : user_pref("extensions.delta.id", "6edb0b0a00000000000000225f49235a");
Line Found : user_pref("extensions.delta.instlDay", "15912");
Line Found : user_pref("extensions.delta.instlRef", "sst");
Line Found : user_pref("extensions.delta.newTab", false);
Line Found : user_pref("extensions.delta.prdct", "delta");
Line Found : user_pref("extensions.delta.prtnrId", "delta");
Line Found : user_pref("extensions.delta.rvrt", "false");
Line Found : user_pref("extensions.delta.smplGrp", "none");
Line Found : user_pref("extensions.delta.tlbrId", "base");
Line Found : user_pref("extensions.delta.tlbrSrchUrl", "");
Line Found : user_pref("extensions.delta.vrsn", "1.8.22.0");
Line Found : user_pref("extensions.delta.vrsnTs", "1.8.22.023:44:30");
Line Found : user_pref("extensions.delta.vrsni", "1.8.22.0");
Line Found : user_pref("extensions.delta_i.babExt", "");
Line Found : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=4955");
Line Found : user_pref("extensions.delta_i.srcExt", "ss");

-\\ Google Chrome v

[ File : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [14371 octets] - [01/09/2013 21:29:41]
AdwCleaner[R1].txt - [13740 octets] - [02/09/2013 20:46:02]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [13801 octets] ##########

[Nutloaf]

You posted the 2nd scan which has an [R0].txt I need the [S0].txt

3rd time lucky!

[Nutloaf]

Hi there, I hope no offence was taken from my last post it was not directed at you but at the both of us for the ADWcleaner results. The situation was a bit wacko as my instructions I gave you were not updated. I was trying to make light of the situation but what I wrote could be con-strewed as rude, not intended. I hope you can stick with me.

Don't worry about the ADWCleaner results the 2nd log was clean so the 1st log did the job

A lot has been removed, the next 2 scans should clean any leftovers. So lets see what is left, then I can make your programs more secure in the post after.


1. DOWNLOAD and INSTALL MALWAREBYTES

• using this link download and install Malwarebytes
• Before clicking Finish Uncheck the Start Free Trial checkbox if present and Select the Update and Launch Checkboxes.
• Click Finish
• Any updates found will now be installed and the main screen loads.
• Select Perform quick scan and click Scan
• The scan will take a few minutes. Once complete click O.K and Show Results
• Make sure anything found is checked and click Remove Selected
• A reboot may be needed please proceed if asked.
• When complete, a log will open in Notepad. Please paste this in your next reply.
• If reboot was needed the log is automatically saved by MBAM and can be viewed by clicking the Logs tab then Open log

2. ESET SCAN ONLY

You will need to disable your currently installed Anti-Virus, how to do so can be read here.


IMPORTANT - Vista / Win7 users: Right-click on the either the IE or FF icon in the Start Menu, Quick Launch Bar or the Taskbar and select Run as Administrator. For Taskbar right click IE then right click the IE icon that appears.

If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

Now use this link to run an online scan with the ESET Online Scanner

• Click the green ESET Online Scanner box
• Tick the box next to YES, I accept the Terms of Use
  then click on: Start
• You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
• Uncheck the Remove Found Threats box. I want to check the results first as ESET may remove a false positive
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed make sure you copy the logfile
• Then click on: Finish
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste the log in your next reply.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!


Things I want to see in your next post.

• Malwarebytes results
• ESET results
• How is the machine running now?
• Are your Browsers behaving themselves?

[Dakeyras]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Dakeyras]

Topic re-opened per OP's request.

[Nutloaf]

Open sesame! Carry on with the MBAM and ESET scans only if you haven't used the machine to download stuff. If not we will get an OTL scan first.

[Dakeyras]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.