[zep516]

Hello Nanee5_08,


ESET didn't find anything, good enough.

How is the computer now?

Thanks
Joe

[Advertisements]

Joe, I think it is good to go! I also defragged and ran disk cleanup. So, now I have 110 of 136 free and it is running pretty fast online now. Thanks for all of your help.

Donna

[Nanee5_08]

Joe, I think it is good to go! I also defragged and ran disk cleanup. So, now I have 110 of 136 free and it is running pretty fast online now. Thanks for all of your help.

Donna

[Nanee5_08]

Actually, I am still having an issue. After updating some of this stuff, I think that I have gained a highjacker. My Chrome main search is supposed to be google, but now when I open it, it is on a page called Searchconduit, and I went to setting and deleted it, but it is still coming up.

[zep516]

Hi,

Here's what we will do. Go back to post # 2 and run

• AdwCleaner
  
• Junkware Removal Tool

Again, post both log files and post a fresh OTL Log too.

We need to up date Adobe and Java too, I'll give instructions for that.

Thanks
Joe

[Nanee5_08]

Will do ASAP. :-)

[zep516]

Hello,

Are you still with us?

[Nanee5_08]

Yes sir... Just been busy. I'm so sorry.

[zep516]

That's ok,

Take your time, no hurry....

Thanks
Joe

[Nanee5_08]

Here is the AdwCleaner log...

# AdwCleaner v3.022 - Report created 18/03/2014 at 16:31:14
# Updated 13/03/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : Donna - DONNA-PC
# Running from : C:\Users\Donna\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\blekko toolbars
Folder Deleted : C:\ProgramData\Search Protection
Folder Deleted : C:\Program Files\Toolbar Cleaner
Folder Deleted : C:\Users\Donna\AppData\Local\SearchProtect
Folder Deleted : C:\Users\Donna\AppData\LocalLow\adawaretb
Folder Deleted : C:\Users\Donna\AppData\Roaming\Mozilla\Firefox\Profiles\3a22vja7.default\adawaretb
Folder Deleted : C:\Users\Donna\AppData\Roaming\Mozilla\Firefox\Profiles\3a22vja7.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File Deleted : C:\Users\Donna\AppData\Roaming\Mozilla\Firefox\Profiles\3a22vja7.default\invalidprefs.js
File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\adawaretb.xml
File Deleted : C:\Users\Donna\AppData\Roaming\Mozilla\Firefox\Profiles\3a22vja7.default\searchplugins\conduit-search.xml

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Key Deleted : HKCU\Software\AppDataLow\Software\adawaretb
Key Deleted : HKLM\Software\adawaretb
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\Software\Toolbar Cleaner
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adawaretb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Donna\AppData\Roaming\Mozilla\Firefox\Profiles\3a22vja7.default\prefs.js ]

Line Deleted : user_pref("browser.search.selectedEngine", "Conduit Search");
Line Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3323878&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP06807649-BF0A-4A00-8663-EFEE8BDC8B8D&SSPV=");
Line Deleted : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3323878&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SP06807649-BF0A-4A00-8663-EFEE8BDC8B8D");

-\\ Google Chrome v33.0.1750.146

[ File : C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

*************************

AdwCleaner[R0].txt - [8952 octets] - [03/03/2014 11:11:47]
AdwCleaner[R1].txt - [3547 octets] - [18/03/2014 16:27:07]
AdwCleaner[S0].txt - [9288 octets] - [03/03/2014 11:22:43]
AdwCleaner[S1].txt - [3500 octets] - [18/03/2014 16:31:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [3560 octets] ##########

[Nanee5_08]

And here is the Junkware...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x86
Ran by Donna on Tue 03/18/2014 at 16:43:15.71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1834033059-1348628536-3071649529-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Donna\appdata\local\adawarebp"
Successfully deleted: [Empty Folder] C:\Users\Donna\appdata\local\{9AFC98F0-71C6-42FC-8978-D7090EE4A836}



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Donna\AppData\Roaming\mozilla\firefox\profiles\3a22vja7.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
Successfully deleted the following from C:\Users\Donna\AppData\Roaming\mozilla\firefox\profiles\3a22vja7.default\prefs.js

user_pref("browser.search.selectedEngine", "SecureSearch");
user_pref("browser.startup.homepage", "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-03-09&ent=hp&u=934823C42D3941315DFEEF531D171862");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 03/18/2014 at 16:53:17.50
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Nanee5_08]

And here is a new Securitycheck log..just for kicks and giggles.

Results of screen317's Security Check version 0.99.80
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
Ad-Aware Antivirus
Bitdefender Antivirus Free Edition
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Ad-Aware
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 51
Adobe Flash Player 12.0.0.70
Adobe Reader XI
Mozilla Firefox (27.0.1)
Google Chrome 33.0.1750.146
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Bitdefender Antivirus Free Edition gzserv.exe
Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5354.0\AdAwareService.exe
Bitdefender Antivirus Free Edition gziface.exe
Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5354.0\AdAwareTray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

[zep516]

Hello,

Where did this come from as seen in security check up log ?
Ad-Aware Antivirus

Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!

Did you install Ad-Aware Antivirus ? Never run 2 Anti Virus programs.

When you get time post a new OTL Log just for kicks and giggles

Thanks
Joe

[Nanee5_08]

Yes, I did but the antivirus part isn't running, just the anti malware. I can uninstall. No biggie. One OtL coming up!

[Nanee5_08]

Sorry couldn't  do the rest of this, with them having the website down for a bit.  Will do the last OTL tomorrow. Thanks!

[zep516]

No problem, see you then.

 

Joe