[spappala]

They take me to : (http://www-search.info/?src=us)

[Advertisements]

Hmm it must be attached to a shortcut somewhere

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Scan.
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S0].txt as well.

[Essexboy]

Hmm it must be attached to a shortcut somewhere

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Scan.
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S0].txt as well.

[spappala]

# AdwCleaner v4.201 - Logfile created 19/04/2015 at 12:38:23

# Updated 08/04/2015 by Xplode

# Database : 2015-04-19.3 [Server]

# Operating system : Windows 8.1  (x64)

# Username : Cassandra - CASS

# Running from : C:\Users\Cassandra\Desktop\adwcleaner_4.201.exe

# Option : Cleaning

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Scheduled tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Web browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17416

 

 

-\\ Mozilla Firefox v36.0.4 (x86 en-US)

 

 

*************************

 

AdwCleaner[R0].txt - [19669 bytes] - [25/03/2015 09:47:32]

AdwCleaner[R1].txt - [3978 bytes] - [25/03/2015 12:30:05]

AdwCleaner[R2].txt - [1007 bytes] - [25/03/2015 14:15:31]

AdwCleaner[R3].txt - [1035 bytes] - [19/04/2015 12:35:10]

AdwCleaner[S0].txt - [19854 bytes] - [25/03/2015 11:56:00]

AdwCleaner[S1].txt - [4070 bytes] - [25/03/2015 12:33:43]

AdwCleaner[S2].txt - [962 bytes] - [19/04/2015 12:38:23]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1020  bytes] ##########

[Essexboy]

I will not give up

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint:
FF Extension: Adblock Plus - C:\Users\Cassandra\AppData\Roaming\Mozilla\Firefox\Profiles\t0br9jd4.default-1429236470791\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-16]
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[spappala]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-04-2015 04

Ran by Cassandra at 2015-04-19 15:03:26 Run:4

Running from C:\Users\Cassandra\Desktop

Loaded Profiles: Cassandra (Available profiles: Cassandra & Administrator)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

CreateRestorePoint:

FF Extension: Adblock Plus - C:\Users\Cassandra\AppData\Roaming\Mozilla\Firefox\Profiles\t0br9jd4.default-1429236470791\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-16]

Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

RemoveProxy:

EmptyTemp:

CMD: bitsadmin /reset /allusers

*****************

 

Restore point was successfully created.

C:\Users\Cassandra\AppData\Roaming\Mozilla\Firefox\Profiles\t0br9jd4.default-1429236470791\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi => Moved successfully.

 

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

 

The operation completed successfully.

 

 

 

========= End of Reg: =========

 

 

========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

 

The operation completed successfully.

 

 

 

========= End of Reg: =========

 

 

========= RemoveProxy: =========

 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.

HKU\S-1-5-21-3221937665-1828410790-1616708693-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.

HKU\S-1-5-21-3221937665-1828410790-1616708693-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.

 

 

========= End of RemoveProxy: =========

 

 

=========  bitsadmin /reset /allusers =========

 

 

BITSADMIN version 3.0 [ 7.7.9600 ]

BITS administration utility.

© Copyright 2000-2006 Microsoft Corp.

 

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.

Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

 

{38F92EA5-34A6-4E89-82BE-7D93CC0CC413} canceled.

1 out of 1 jobs canceled.

 

========= End of CMD: =========

 

EmptyTemp: => Removed 240.7 MB temporary data.

 

 

The system needed a reboot. 

 

==== End of Fixlog 15:04:58 ====

[Essexboy]

Still there ?

[spappala]

Yes unfortunately. I'm not connected to any network, open IE and it seems to be trying to connect to (S3.amazonaws.com). 

[Essexboy]

Do you use amazon cloud at all ?

[spappala]

No it is not being used. I can take a look, perhaps it's preinstalled with Win 8? Should I uninstall Amazon Cloud if it is installed?

 

update: Not seeing Amazon Cloud in installed programs and I've never used it.

Edited by spappala, 19 April 2015 - 02:02 PM.

[Essexboy]

No I could not see it either in the logs

Could you run FRST again please but this time I will just need the shortcut txt

[spappala]

Users shortcut scan result (x64) Version: 15-04-2015 04
Ran by Cassandra at 2015-04-19 16:18:19
Running from C:\Users\Cassandra\Desktop
Boot Mode: Normal
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
  
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://usa-aa.s3-website-us-east-1.amazonaws.com/?grp=6
ShortcutWithArgument: C:\Users\Cassandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://usa-aa.s3-website-us-east-1.amazonaws.com/?grp=6
ShortcutWithArgument: C:\Users\Cassandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://usa-aa.s3-website-us-east-1.amazonaws.com/?grp=6
 
 ==================== End of log =============================

Edited by Essexboy, 19 April 2015 - 02:51 PM.

[spappala]

Wow you totally called that, and thank you for not giving up. I'm looking over the log myself and it seems to have altered the quick launch shortcuts. Awaiting your instructions before I proceed.

[Essexboy]

Grand, I will use FRST to fix them. Do you wish me to remove all of the shortcuts listed ? (I will leave the bad boys for others to reference)

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://usa-aa.s3-website-us-east-1.amazonaws.com/?grp=6
ShortcutWithArgument: C:\Users\Cassandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://usa-aa.s3-website-us-east-1.amazonaws.com/?grp=6
ShortcutWithArgument: C:\Users\Cassandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://usa-aa.s3-website-us-east-1.amazonaws.com/?grp=6
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[spappala]

Yes, can we remove all the shortcuts?

[Essexboy]

How's that