[DonnaB]

Hi technoobie,

How keen are you on keeping the AVG Secure Search/Toolbar? Truly, it is just one of the many pieces of foistware known. Foistware is software that is included with free software that is a source of income for the developers of free software. Many toolbars are considered spyware and can collect other information from your computer, not to mention browsing habits or websites that you visit.

Miekiemoes discusses toolbars in more detail here if you would like to read before you decide if you would like me to remove the AVG Secure Search/Toolbar.

Please let me know your decision before I proceed with cleansing what AdwCleaner has found.

[Advertisements]

Hi Donna, I'm more than happy to get rid of the AVG toolbar - I've uninstalled AVG in favour of Microsoft security essentials anyway so that's a go ahead from me : ).

[technoobie]

Hi Donna, I'm more than happy to get rid of the AVG toolbar - I've uninstalled AVG in favour of Microsoft security essentials anyway so that's a go ahead from me : ).

[DonnaB]

Great! After I have you remove the files that AdwCleaner found, I would like for you to use the AVG Removal Tool I'll link you to at the bottom of my post.

For now:


Double-click AdwCleaner.exe to run the tool again.

• Click the Scan button.
  Note: Windows Vista, Windows 7/8 users right-click and select Run As Administrator.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Next:

Please download the AVG Removal Tool for the version that was installed from here. Scroll down just a bit and you will see the list. Please choose the 64-bit version.

Thank you,
Donna

[technoobie]

Hi Donna,

I think I've run the AVG removal tool correctly and here's the AdwCleaner log you requested:

# AdwCleaner v3.008 - Report created 17/10/2013 at 23:26:03
# Updated 17/10/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : TechnoobieFamily - EMACHINES
# Running from : C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\All Users\Application Data\BitGuard
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Documents and Settings\TechnoobieFamily\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\TechnoobieFamily\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\TechnoobieFamily\Start Menu\Programs\BitGuard

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKCU\Software\94dddfb534be40
Key Deleted : HKLM\SOFTWARE\94dddfb534be40
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\InstalledThirdPartyPrograms
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\InstalledThirdPartyPrograms
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Google Chrome v30.0.1599.69

[ File : C:\Documents and Settings\TechnoobieFamily\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3691 octets] - [17/10/2013 13:24:20]
AdwCleaner[S0].txt - [3696 octets] - [17/10/2013 23:26:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3756 octets] ##########

Edited by technoobie, 17 October 2013 - 07:06 AM.

[DonnaB]

Let's run an MBAM and ESET scan to make sure no residual files are lurking in the background.

1st:

Double click on the icon to open the application.

• If you are presented with a screen stating the database is outdated, please allow it to update.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy > Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Next:

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go >>HERE<< then click on:
  
  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on the icon to install.
  
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed make sure you first copy the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic.
• Now click on:
  (Selecting Uninstall application on close if you so wish)

In your next reply, please post the following logs:
MBAM.txt
C:\Program Files\ESET\EsetOnlineScanner\log.txt

Also, let me know how the computer is behaving?

Donna

[technoobie]

Hi Donna,

The netbook seems to be running well, I can't detect any signs of malware in its operation like before, however the ESET Online scanner did find some threats as you'll see in the log below.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.10.13.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
TechnoobieFamily :: EMACHINES [administrator]

18/10/2013 10:00:01 AM
mbam-log-2013-10-18 (10-00-01).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 223508
Time elapsed: 16 minute(s), 26 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=12d5b4466adace4da97c98a1ce952b4e
# engine=15530
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-10-18 02:41:10
# local_time=2013-10-18 01:41:10 (+1000, AUS Eastern Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=5892 16777213 88 94 0 9679862 0 0
# scanned=96458
# found=4
# cleaned=0
# scan_time=6217
sh=9AB9899BB5D6C7DACC3BCED0E05F90A99A5C4EF8 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AN application" ac=I fn="C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\unipdf-installer.zip"
sh=D2408C8A09A2BD9704AF39F818EC7AC9E9CCA46E ft=1 fh=08d2b982dc66508e vn="a variant of Win32/Bunndle application" ac=I fn="C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\utorrent.exe"
sh=8E2AC938704E0B7AE5E009347A030C9D307CA74C ft=1 fh=d359114b7701c185 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Program Files\Probit Software\Easy Speed PC\EasySpeedPC.exe"
sh=B018ADBCA951AC0EB0757AFFD7EAB8FC0228CA91 ft=1 fh=fda9a5748d3eb594 vn="a variant of Win32/Adware.SpeedingUpMyPC.C application" ac=I fn="C:\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe"

[DonnaB]

Hi technoobie,

The netbook seems to be running well, I can't detect any signs of malware in its operation like before

That is good news! We'll remove those files that ESET found with an OTL fix, but first I would like to discuss a program that I see installed called Easy Speed PC. We advise not to use this or any registry cleaner as there have been reports of them clearing out needed registry entries and messing up PCs. In addition, what they do clean up is so small that little or no advantages are noticed.

Modifying registry keys incorrectly can cause Windows instability, or make Windows unbootable. No registry cleaner is completely safe and the potential is ever present to cause more problems than they claim to fix.

Registry cleaners cannot distinguish between good and bad. If you run a registry cleaner, it will delete all those keys which are obsolete and sitting idle; but in reality, those keys may well be needed by some programs or windows at a later time.

Windows is a closed source system. Developers of registry cleaners do not have the core code of Windows 7 and Windows 8 and are not working on definitive information, but rather they are going on past knowledge and experience. Automatic cleaners will usually have to do some guesswork and this being a netbook with limited abilities to reinstall the OS due to corruption. I would like to suggest that you uninstall this program. You can do so in the following manner:

Start > Control Panel > Add/Remove Programs > Easy Speed PC
Right click and chose uninstall.

Let me know if you decide to unistall Easy Speed PC, or not. I can provide a much safer way to maintain your system after removing our tools and before I turn you loose. I still would like to discuss the safe use of USB flash drives as well.

Donna

[technoobie]

Hi Donna,

I never installed Easy Speed PC on my computer in the first place, I've now uninstalled it per your recommendations. It's a worry that it was installed without my knowledge. Upon looking through the addd/remove programs section in the control panel there appears to be quite a number of junk programs installed which I never actually installed or authorised so again this is a bit of a concern.

Anyway, thanks so much for your advice, I'm looking forward to finally fixing up all these issues!

[DonnaB]

I never installed Easy Speed PC on my computer in the first place, I've now uninstalled it per your recommendations. It's a worry that it was installed without my knowledge. Upon looking through the addd/remove programs section in the control panel there appears to be quite a number of junk programs installed which I never actually installed or authorised so again this is a bit of a concern.

Good! Software that is installed without your knowledge or consent are called foistware due to the nature in which they are forced upon a user and usually get installed along side other installed software. Anytime you install software, take your time and pay close attention to each window that is presented during the installation process to prevent from installing unwanted toolbars, PUP's, scanners, cleaners, etc. If you are presented with the option for a Custom Install, choose that option.

A tool that I recommend to uninstall unwanted software is PC Decrapifier which is a free to use and will help decide which programs you can remove that will not interfere with the function of the computer. It points out unnecessary startup items and icons that can slow down your PC. as well. It will also provide the user step by step instructions, and gives you recommendations on what to remove if the user is unsure. Nifty little program to have.

If you have any questions concerning the programs you are not familiar with, don't hesitate to ask.

Let's remove those files that ESET found, which also includes Easy Speed PC,which should not be found now that you have uninstalled it, and I'll have a look at the fresh OTL to see what else needs to be removed that may have been overlooked.

• Double click on the to open the program. On Vista/Win7/Win8 right click select Run As Administrator to start the program. If prompted by UAC, please allow it.
• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :COMMANDS
  [CREATERESTOREPOINT]
  
  :Files
  C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\unipdf-installer.zip
  C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\utorrent.exe
  C:\Program Files\Probit Software\Easy Speed PC\EasySpeedPC.exe
  C:\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe
  
  :Commands
  [emptytemp]
  

• Make sure all other windows are closed.
• Click the Run Fix button at the top
• Let the program run uninterrupted. The computer should reboot when the scan is done. If not, please reboot the computer.
• Post the log that is found in C:\_OTL\Moved Files in your next reply.
• Open OTL again and click the Quick Scan button.

Let's also check for outdated software:

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document in your next reply.

In your next reply, please post the logs for the following:

C:\_OTL\Moved Files
OTL.txt
checkup.txt

Thank you,
Donna

[technoobie]

Hi Donna,

Here's the OTL log:

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\unipdf-installer.zip moved successfully.
C:\Documents and Settings\TechnoobieFamily\My Documents\Downloads\utorrent.exe moved successfully.
File\Folder C:\Program Files\Probit Software\Easy Speed PC\EasySpeedPC.exe not found.
File\Folder C:\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Technoobie
->Temp folder emptied: 689633 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 34221 bytes

User: TechnoobieFamily
->Temp folder emptied: 8315395 bytes
->Temporary Internet Files folder emptied: 2686389 bytes
->Google Chrome cache emptied: 373789059 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 21638 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: SisterOne
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2270579 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 2570 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 24192 bytes

Total Files Cleaned = 370.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 10202013_122207

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


And here's the Checkup log:

Results of screen317's Security Check version 0.99.74
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
ESET Online Scanner v3
Microsoft Security Essentials
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader XI
Google Chrome 30.0.1599.101
Google Chrome 30.0.1599.69
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 12% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

I'm having a look at PC decrapifier now and will post if I run into any problems. Thanks for explaining about foistware .

[DonnaB]

I'm having a look at PC decrapifier now and will post if I run into any problems. Thanks for explaining about foistware .

Ok and you're welcome!

Here's a nice little program for your netbook since you don't have an optical drive and have to resort to USB Flash drives. I suspect that you have a USB Flash drive that has an infection on it. Always press and hold the Shift key anytime you insert a Flash drive into any computer. That will disable the autorun feature.

Download McShield2 to your desktop and install with default settings.
In the control center, select scanner and check unhide items on flash drives

Anytime you plug in a USB drive, McShield will scan the device.

A log will also be generated that you will find in the path below:
Start > all programs > MCShield > logs > all scans

Adobe Flash Player needs to be updated. You can install the most recent version from here. It should just write over the previous version.

Before we remove our tools, go to Start > All Programs > Accessories > System Tools and run Disk cleanup. Once Disk Cleanup is complete, defrag the HDD. You'll find that tool in the same location as Disk Cleanup. I personally prefer Auslogics Disk Defrag for my XP machines for the following reasons:


It does a more comprehensive job at Defragging
It will actually show you what it is doing
At the end of working it will show you how much speed you picked up
Once you have finished with the above, let me know how your system is performing and we'll remove the tools.

[technoobie]

Hi Donna,

I've downloaded McShield2 and I think I've successfully updated Adobe Flash Player, plus I've also run the disk cleanup but I can't get the Auslogics Disk Defrag download to work properly for me. When I tried to download it a message came up saying the program didn't support my screen resolution and then just shut. Should I just used the inbuilt windows disk defrag instead?

Thanks for all your help, you've been amazing!

[DonnaB]

Should I just used the inbuilt windows disk defrag instead?

Yes. Please do.

[technoobie]

I went ahead and completed the windows defrag and upon completion a message popped up saying some files couldn't be defragmented. Is this ok?

Otherwise I think I followed all the instructions as above.

[DonnaB]

Yes. That is ok. This is common for the Windows built-in Disk Defragmenter.

How is your netbook performing now?