[Robertcharles123]

Will this help, the sick computer boots up as a quest with no problem.

[Advertisements]

Do you mean into Warcraft?

If so can you get out of there onto your desktop?

[emeraldnzl]

Do you mean into Warcraft?

If so can you get out of there onto your desktop?

[Robertcharles123]

I have no idea what Warcraft is. I mean I have my wife and my two kids and a quest to be able to use the computer and the quest without a password booted right up.

And I am on the internet with it it seems

I am hitting the q instead of the g. I haven't slept in the last 2 weeks and it is starting to get to me. Sorry

Thanks,

Robert

Edited by Robertcharles123, 11 February 2014 - 09:34 PM.

[emeraldnzl]

Oh, there is a quest type "thingy" in Warcraft which is a game. My mistake.

If you are on the internet then please go ahead with my last instruction.

[emeraldnzl]

I am hitting the q instead of the g. I haven't slept in the last 2 weeks and it is starting to get to me. Sorry

Hey Robert... it's bad to go without sleep too long. Would you like to call it quits until tomorrow?

[Robertcharles123]

it is scanning-- the junkware removal tool

[Robertcharles123]

I am hitting the q instead of the g. I haven't slept in the last 2 weeks and it is starting to get to me. Sorry

Hey Robert... it's bad to go without sleep too long. Would you like to call it quits until tomorrow?

I still have to go to work. So, I might as well let this run until I have to leave and shut it down for the night at a good point.

I will leave the computer on at some point. Is that ok?

It is still working. It is at checking Registry.

Thanks,

Robert

[emeraldnzl]

I still have to go to work.

Hmm... don't let yourself go without sleep too long. Did that myself many years ago, before I reached retirement, didn't do a lot of good for my health lol.

I will leave the computer on at some point. Is that ok?

No problem. Probably a good idea to disconnect it from the internet though.

[Robertcharles123]

the sick computer lost internet and I am right next to it with the one I am typing on and it still has it. The sick one will not connect now but the log is complete. can I copy it and transfer it to this computer and send it.

[emeraldnzl]

Yep.

[Robertcharles123]

I still have to go to work.

Hmm... don't let yourself go without sleep too long. Did that myself many years ago, before I reached retirement, didn't do a lot of good for my health lol.

I will leave the computer on at some point. Is that ok?

No problem. Probably a good idea to disconnect it from the internet though.

It disconnected itself.

[emeraldnzl]

[Robertcharles123]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Diane on Tue 02/11/2014 at 21:38:41.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113}



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\dnu.exe
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escort.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortapp.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escorteng.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortlbr.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\esrv.exe
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\secman.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\aol toolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\iminent
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\aol toolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\searchprotect
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dnupdate
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dnupdater.downloaduibrowser
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dnupdater.downloaduibrowser.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dnupdater.downloadupdcontroller
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dnupdater.downloadupdcontroller.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.bandobjectattribute
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.dockingpanel
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbarbandobject
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbardisplaystate
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbarmenuform
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3EF64538-8B54-4573-B48F-4D34B0238AB2}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}



~~~ Files

Successfully deleted: [File] "C:\Users\Diane\appdata\local\google\chrome\user data\default\local storage\http_app.mam.conduit.com_0.localstorage"
Successfully deleted: [File] "C:\Users\Diane\appdata\local\google\chrome\user data\default\local storage\http_app.mam.conduit.com_0.localstorage-journal"
Successfully deleted: [File] "C:\Users\Diane\appdata\local\google\chrome\user data\default\local storage\http_storage.conduit.com_0.localstorage"
Successfully deleted: [File] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ebay.lnk"
Successfully deleted: [File] C:\Windows\syswow64\sho146B.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho435.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB0B9.tmp



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\aol toolbar"
Successfully deleted: [Folder] "C:\ProgramData\conduit"
Successfully deleted: [Folder] "C:\Users\Diane\AppData\Roaming\drivercure"
Successfully deleted: [Folder] "C:\Users\Diane\AppData\Roaming\isafe"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\local\aol toolbar"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\local\cre"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\local\searchprotect"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\local\swvupdater"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\locallow\homeworksimplified_7e"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\locallow\pricegong"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\locallow\smartbar"
Successfully deleted: [Folder] "C:\Users\Diane\appdata\locallow\whitesmoke_new"
Failed to delete: [Folder] "C:\Program Files (x86)\aol toolbar"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\coupons"
Successfully deleted: [Folder] "C:\Program Files (x86)\homeworksimplified_7e"
Successfully deleted: [Folder] "C:\Program Files (x86)\isafe"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\Program Files (x86)\Common Files\software update utility"
Successfully deleted: [Folder] "C:\Program Files (x86)\Common Files\umbrella"



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Diane\appdata\local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 02/11/2014 at 21:46:50.45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I hope this helps.

[Robertcharles123]

Well, that is about all I can do. I hope some progress has been made. I am not really up to par on any of the tech side of the computers, so I really do not know.

I appreciate all the help you have given me and I can see some light at the end of this tunnel. Let me know if any of that stuff was useful. I am going to stop now.

Thanks,
Robert

I turned the auto connect off on the internet and I am leaving it on with the screen off.


Thanks again and good night.. um evening to you...Right?

Take it easy.

[emeraldnzl]

Well done. I think we have made very good progress.

We have removed an immense amount of adware/foistware/browser redirection stuff and general rubbish.

This will have improved things for that machine but we do need to check further for possible hidden infection and we also want to look at possible corruption, services not working properly and maybe check for hardware problems.

That will take time.

Catch you tomorrow or when you get time.