[ginnyjoe]

I cannot remember if I ran it two times. Sorry if I am making this harder.

 

# AdwCleaner v4.112 - Logfile created 17/03/2015 at 16:01:57
# Updated 09/03/2015 by Xplode
# Database : 2015-03-15.1 [Server]
# Operating system : Windows Vista ™ Home Premium Service Pack 2 (x86)
# Username : Diane - DIANE-PC
# Running from : C:\Users\Diane\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

Service Deleted : vToolbarUpdater18.3.0

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\UniDeals
Folder Deleted : C:\Program Files\UNiDeaLssi
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Windows\system32\SearchProtect
Folder Deleted : C:\Users\Diane\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Diane\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\ProgramData\cgfofmgjbbhbjgjebphjpbindjocghpa
File Deleted : C:\END
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\ask.com
Key Deleted : HKLM\SOFTWARE\Classes\P15bed875_a4b4_4cc2_8806_92ba75143ab6_.P15bed875_a4b4_4cc2_8806_92ba75143ab6_
Key Deleted : HKLM\SOFTWARE\Classes\P15bed875_a4b4_4cc2_8806_92ba75143ab6_.P15bed875_a4b4_4cc2_8806_92ba75143ab6_.9
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{15bed875-a4b4-4cc2-8806-92ba75143ab6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A86782D8-7B41-452F-A217-1854F72DBA54}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{38122A36-83B2-46B8-B39A-EC72A4614A07}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{38122A36-83B2-46B8-B39A-EC72A4614A07}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{15bed875-a4b4-4cc2-8806-92ba75143ab6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKLM\SOFTWARE\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Viewpoint
Key Deleted : HKLM\SOFTWARE\LookSafe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v9.0.8112.16533

-\\ Google Chrome v41.0.2272.89

[C:\Users\Diane\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN37796190102680813&ctid=CT3279417&UM=2
[C:\Users\Diane\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.avg.com/search?cid={86E1C96F-BCF5-4E5F-9257-613A7EF69BC1}&mid=803035610e3147d3b53ed1572e6f719f-33354d1a06ede00b5fda56b7325dcd5bcbea7a0d&lang=en&ds=AVG&pr=fr&d=2013-09-08 11:40:37&v=15.4.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
[C:\Users\Diane\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Diane\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN37796190102680813&ctid=CT3279417&UM=2&UP=SPE976D00A-ED9D-49CC-A654-102429AA4DD3&SSPV=

*************************

AdwCleaner[R0].txt - [9223 bytes] - [16/03/2015 15:46:13]
AdwCleaner[R1].txt - [9276 bytes] - [17/03/2015 15:59:05]
AdwCleaner[S0].txt - [9315 bytes] - [17/03/2015 16:01:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9374  bytes] ##########

Farbar Service Scanner Version: 17-01-2015
Ran by Diane (administrator) on 17-03-2015 at 16:15:42
Running from "C:\Users\Diane\Desktop"
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcsvc.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed

**** End of log ****

[Advertisements]

Great, and no worries about the FRST fix running once or twice.

 

Are you still having Windows Update trouble?  Can you please try it and let me know?

[DanoNH]

Great, and no worries about the FRST fix running once or twice.

 

Are you still having Windows Update trouble?  Can you please try it and let me know?

[ginnyjoe]

I can't seem to get into it at all now. The wheel by the cursor just keeps turning. I will shut down and try again.

[DanoNH]

OK, we are not out of tools or options yet, so hang in there!  I'm preparing next steps for you...  We will fix it!

[ginnyjoe]

Still the same cannot get updates.

[DanoNH]

Acknowledged, thanks.  Waiting on approval again. 

[DanoNH]

Hello ginnyjoe,
 
Here are our next steps.
 
First
Install and Run Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware from Here or Here

• Double Click the downloaded mbam-setup-x.x.x.xxxx.exe to install the application.  (x.x.x.xxxx represents the current version number).
  
  
• During installation, make sure to uncheck Enable free trial of Malwarebytes Anti-Malware Premium, then click Finish.  You can always upgrade later :
  
  
  
• If an update is found, it will download and install the latest updates automatically:
  
  
  
• Now select the Settings tab, and check the box next to Scan for rootkits:
  
  
  
• Go back to the Dashboard tab, and click the Scan Now button:
  
  
  
• The scan may take some time to finish,so please be patient.
  
  
  
• When the scan is complete, it will show you the results.  (This one is clean):
  
  
  
• Make sure that everything is checked, and click Quarantine All (or similar).
  
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.  (See Extra Note below)  If the log doesn't open, select View detailed log in the Scan tab:
  
  
  
• The log is automatically saved by MBAM and can be viewed by going to the History tab and clicking on Application Logs:
  
  
  
• Choose the latest Scan Log, and click on the View button:
  
  
  
• In the bottom of the Scanning History Log window that opens, you can click on Export > Save to Text file (*.txt).  Save the report to your Desktop.
  
  
  
• Copy & Paste the entire contents of the report log in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

*** In your next reply, I need you to Copy&Paste the contents of the MBAM log file.
 
 
 
Second
Run Microsoft's System Update Readiness tool

• Download the System Update Readiness Tool for Windows Vista (KB947821).
• Follow the instructions on that page to run the tool. 
• Accept any UAC Adminstrator prompts if asked. 
• After the tool completes, reboot your computer.

Try to access Windows Update again and let me know how it goes...

Edited by DanoNH, 18 March 2015 - 08:22 AM.

[DanoNH]

Just so you know, the edit of my last post was formatting only of the list in the Second step...

[ginnyjoe]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18/03/2015
Scan Time: 11:46:47 AM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.03.18.04
Rootkit Database: v2015.02.25.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Diane

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 331871
Time Elapsed: 27 min, 3 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

[ginnyjoe]

I can't seem to install the file. will let you know what it says when I try. It says Installer encountered an error\;OX80240009.

[ginnyjoe]

Got the file installed. Then I did a restart and tried to get updates but no luck.

[DanoNH]

Do you get any other error message, or perhaps the same one about restarting the computer and trying again?

[DanoNH]

Hello ginnyjoe,

In addition to my last posted question, I need to ask you some detailed questions, and request that you respond with the most detailed answers you can give, numbered the same as the corresponding questions.

Are you ready?

• How old is the laptop?
• When did you first notice that Windows Update wasn't working (days, weeks, months)?
• Has a Norton application or a McAfee application EVER been installed on the computer since you bought it?
• Have you run any "registry cleaners" on the system?

Now lets continue trying to get Windows Update working...

First
Run the System File Checker tool (SFC.exe)

To do this, follow these steps:

• Open an administrative Command Prompt window.
• At the command prompt, type sfc /scannow (note the space in the middle), and then press Enter.
• After the scan is finished, try to install updates again.

Second
Run the Microsoft Windows repair utility CheckDisk:

• Right-click Start and select Explore.
• Right-click Drive C and select Properties.
• Click the Tools tab.
• In the Error-checking section, click Check Now.
• Select the following options:
  • Automatically fix file system errors
  • Scan for and attempt recovery of bad sectors
• Click Start.
  You see the following message:
  

  "The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk.
  These files can be accessed only by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?"

• Click Yes.
• Restart your computer to allow the disk check to complete.

Finally
Scan with ListChkDskResult

Please download ListChkDskResult by SleepyDude and save it to your desktop.

• Right-click on the icon and select Run as Administrator to start the tool.
• A message about checking Windows Event Log will pop-up. Click OK.
• Wait patiently until a notepad window opens. This won't take long.
• The displayed logfile will be also saved to your desktop as ListChkDskResult.txt.

Please include the content of this file in your next reply.

[ginnyjoe]

The laptop is about 6 years old. She said she hasn't used the computer in about a year. When she started it up she could not get the updates. Norton was on it when she purchased it. Have not run any registry cleaner. I did the sfc/scannow then I tried to do the updates but same result. I also ran the CheckDisk. Now I am trying to run ListChkDsk result but this is the message I get. Can't find script engine "VBScript.Encode"for script "C:\Users\Diane\AppData\Local\Temp\RarSFX0\ListChkdskResult.vbe". I didn't think this would be so difficult. Thanks for taking the time to help me out. My sister said she would take it in but I would rather keep trying as long as you want to also.

 

ginnyjoe

[DanoNH]

Thank you, and you're welcome.  So the System File Checker or CheckDisk tools did not report any issues that got fixed? 

 

We are not out of options yet here, and Windows Update issues can be quite tedious to sort out.  I appreciate your patience and sticking with me through these steps.  I'm here for the duration...