[stumpedrick]

I don't know where this spyware has come from.  I have not been able to remove it using procedures I have seen on line. I have not be able to reload the OS ( HP Pavilion laptop) from the "recover partition". I have attached the diag files. Thanks. 

Attached Files

•  Addition.txt   56.88KB   233 downloads
•  FRST.txt   98.68KB   243 downloads

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

I'll be with you shortly with instructions.

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

I'll be with you shortly with instructions.

[zep516]

First
Please remove these programs from your programs an features list, right click on the start panel and click programs an features. In the list find the program listed below and uninstall it.

• Catalina Savings Printer
• DNS Unlocker version 1.3
• New Tab Clock
• Lavasoft AdAwareBrowser
• Web Companion
  If a program will not remove skip it.
  
  Let me know when that is done.

[stumpedrick]

Thanks for the help. This problem is on my wife's computer. I'm working on it.

[stumpedrick]

Saturday -23-16

I attempted to remove all the files. There was a problem with "DNS Unlocker version 1.1" I received a "Run time error" while uninstalling. What do I do now. Should I run the diags again? Thanks 

[zep516]

See if you can uninstall,

• Ad-Aware Antivirus
  You already have AVG, so we need to get rid of Ad-Aware Antivirus. Can't have two running like that
  
  Next
  Download the enclosed file=>  fixlist.txt   5.92KB   229 downloads Save it in the location FRST64 is=>C:\Users\Pat\Downloads, then Run FRST64 and click on the Fix button. Wait until finished.
  The tool will make a log in the location FRST64 is,=> C:\Users\Pat\Downloads, (Fixlog.txt). Please post it to your reply.
  
  Next
  
  Please download AdwCleaner by Xplode onto your Desktop.
• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Click the logfile button and the log will open in Notepad.
• Click on the Clean button follow the prompts.
• A log file will automatically open after the scan has finished and the PC has rebooted.
• Please post the content of that log file with your next answer.
• The report will be saved in the C:\AdwCleaner folder.
  
  Next
  
  Please download Junkware Removal Tool to your Desktop.
  Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
  Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
  The tool will open and start scanning your system.
  Please be patient as this can take a while to complete, depending on your system's specifications.
  On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
  Please post the contents of JRT.txt into your reply.
  
  
  In your next reply post;
• Fixlog.txt
• The AdwCleaner [SO].txt Log
• The JRT.txt Log

[stumpedrick]

I ran the diags and here  are the log files

Fix result of Farbar Recovery Scan Tool (x64) Version:18-01-2016

Ran by Pat (2016-01-28 20:34:37) Run:1

Running from C:\Users\Pat\Downloads

Loaded Profiles: Pat (Available Profiles: Pat)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

CloseProcesses:

CreateRestorePoint:

C:\Program Files (x86)\Lavasoft\Web Companion

HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareTray.exe [9574112 2015-12-09] ()

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM -> {E282DCD1-0B0F-4E80-A06D-FDF2745541B2} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1

SearchScopes: HKLM-x32 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {E282DCD1-0B0F-4E80-A06D-FDF2745541B2} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D011916-A0138A8547457478FA6F&form=CONBDF&conlogo=CT3331967&q={searchTerms}

SearchScopes: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D011916-A0138A8547457478FA6F&form=CONBDF&conlogo=CT3331967&q={searchTerms}

SearchScopes: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={64A03EB5-A4AD-4D77-B592-F2BA43270172}&mid=13601538d22947cd9d7b719a87b8d2c5-e0b04eeee112b39570aaf3a21f7f9b7ec731fc9a&lang=en&ds=AVG&coid=avgtbavg&cmpid=0415av&pr=fr&d=2015-05-22 13:04:59&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://www.bing.com/search?FORM=SL5KDF&PC=SL5K&q={searchTerms}&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> {E282DCD1-0B0F-4E80-A06D-FDF2745541B2} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.2.4.155\AVG Web TuneUp.dll [2015-12-17] (AVG)

BHO-x32: TBSB07898 Class -> {FCBCCB87-9224-4B8D-B117-F56D924BEB18} -> C:\Program Files (x86)\Coupons.com CouponBar\tbcore3.dll => No File

Toolbar: HKLM-x32 - Coupons.com CouponBar - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - C:\Program Files (x86)\Coupons.com CouponBar\tbcore3.dll No File

Toolbar: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> No Name - {41564952-412D-5637-4300-7A786E7484D7} -  No File

Toolbar: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Toolbar: HKU\S-1-5-21-1242277392-240876926-1791514536-1002 -> No Name - {8660E5B3-6C41-44DE-8503-98D99BBECD41} -  No File

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\40.2.4\\npsitesafety.dll [No File]

FF Plugin HKU\S-1-5-21-1242277392-240876926-1791514536-1002: CouponNetwork.com/CMDUniversalCouponPrintActivator -> C:\Users\Pat\AppData\Roaming\CATALI~1\NPBCSK~1.DLL [2013-06-07] (Catalina Marketing Corporation)

R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareService.exe [712432 2015-12-09] ()

R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe [2751760 2016-01-18] (Lavasoft Limited)

C:\Users\Public\Desktop\Lavasoft AdAwareBrowser.lnk

2016-01-18 22:13 - 2016-01-18 22:13 - 00000000 ____D C:\Users\Pat\AppData\Roaming\LavasoftStatistics

2016-01-18 22:12 - 2016-01-19 13:22 - 00002904 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini

2016-01-18 22:12 - 2016-01-19 13:22 - 00002904 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini

2016-01-18 22:12 - 2016-01-18 22:42 - 00000000 ____D C:\Users\Pat\AppData\Roaming\Lavasoft

2016-01-18 22:12 - 2016-01-18 22:13 - 00000000 ____D C:\Users\Pat\AppData\Local\Lavasoft

2016-01-18 22:12 - 2016-01-18 22:13 - 00000000 ____D C:\searchplugins

2016-01-18 22:12 - 2016-01-18 22:11 - 00425744 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll

2016-01-18 22:11 - 2016-01-19 18:12 - 00002409 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2016-01-18 22:11 - 2016-01-18 22:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft

2016-01-18 22:11 - 2016-01-18 22:11 - 00345360 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll

2016-01-18 22:11 - 2016-01-18 22:11 - 00000000 ____D C:\Program Files (x86)\Lavasoft

2016-01-18 22:10 - 2016-01-18 22:10 - 00000000 ____D C:\Program Files\Lavasoft

2016-01-18 22:08 - 2016-01-18 22:08 - 00000000 ____D C:\Program Files\Common Files\Lavasoft

2016-01-18 22:07 - 2016-01-18 22:11 - 00000000 ____D C:\ProgramData\Lavasoft

2016-01-18 22:07 - 2016-01-18 22:07 - 02012464 _____ C:\Users\Pat\Downloads\Adaware_Installer.exe

CMD: bitsadmin /reset /allusers

CMD: netsh winsock reset catalog

CMD: ipconfig /flushdns

RemoveProxy:

hosts:

Emptytemp:

*****************

 

Processes closed successfully.

Restore point was successfully created.

C:\Program Files (x86)\Lavasoft\Web Companion => moved successfully

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AdAwareTray => value removed successfully

"HKLM\SOFTWARE\Policies\Google" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully

HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found. 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E282DCD1-0B0F-4E80-A06D-FDF2745541B2}" => key removed successfully

HKCR\CLSID\{E282DCD1-0B0F-4E80-A06D-FDF2745541B2} => key not found. 

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}" => key removed successfully

HKCR\Wow6432Node\CLSID\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE} => key not found. 

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully

HKCR\Wow6432Node\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found. 

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{E282DCD1-0B0F-4E80-A06D-FDF2745541B2}" => key removed successfully

HKCR\Wow6432Node\CLSID\{E282DCD1-0B0F-4E80-A06D-FDF2745541B2} => key not found. 

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

"HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 

"HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully

"HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully

"HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}" => key removed successfully

HKCR\CLSID\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE} => key not found. 

"HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully

HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found. 

"HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E282DCD1-0B0F-4E80-A06D-FDF2745541B2}" => key removed successfully

HKCR\CLSID\{E282DCD1-0B0F-4E80-A06D-FDF2745541B2} => key not found. 

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully

HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => key not found. 

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}" => key removed successfully

"HKCR\Wow6432Node\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}" => key removed successfully

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{8660E5B3-6C41-44DE-8503-98D99BBECD41} => value removed successfully

"HKCR\Wow6432Node\CLSID\{8660E5B3-6C41-44DE-8503-98D99BBECD41}" => key removed successfully

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{41564952-412D-5637-4300-7A786E7484D7} => value removed successfully

HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => key not found. 

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully

HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found. 

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8660E5B3-6C41-44DE-8503-98D99BBECD41} => value removed successfully

HKCR\CLSID\{8660E5B3-6C41-44DE-8503-98D99BBECD41} => key not found. 

"HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin" => key removed successfully

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\Software\MozillaPlugins\CouponNetwork.com/CMDUniversalCouponPrintActivator => key not found. 

C:\Users\Pat\AppData\Roaming\CATALI~1\NPBCSK~1.DLL => not found.

LavasoftAdAwareService11 => service removed successfully

LavasoftTcpService => service not found.

"C:\Users\Public\Desktop\Lavasoft AdAwareBrowser.lnk" => not found.

C:\Users\Pat\AppData\Roaming\LavasoftStatistics => moved successfully

C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini => moved successfully

C:\WINDOWS\system32\LavasoftTcpServiceOff.ini => moved successfully

C:\Users\Pat\AppData\Roaming\Lavasoft => moved successfully

C:\Users\Pat\AppData\Local\Lavasoft => moved successfully

C:\searchplugins => moved successfully

C:\WINDOWS\system32\LavasoftTcpService64.dll => moved successfully

C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk => moved successfully

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft => moved successfully

C:\WINDOWS\SysWOW64\LavasoftTcpService.dll => moved successfully

C:\Program Files (x86)\Lavasoft => moved successfully

C:\Program Files\Lavasoft => moved successfully

C:\Program Files\Common Files\Lavasoft => moved successfully

C:\ProgramData\Lavasoft => moved successfully

C:\Users\Pat\Downloads\Adaware_Installer.exe => moved successfully

 

=========  bitsadmin /reset /allusers =========

 

 

BITSADMIN version 3.0 [ 7.8.10586 ]

BITS administration utility.

© Copyright 2000-2006 Microsoft Corp.

 

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.

Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

 

{9BF02BAF-AA14-44D9-95D5-B0D10E6F72CD} canceled.

1 out of 1 jobs canceled.

 

========= End of CMD: =========

 

 

=========  netsh winsock reset catalog =========

 

 

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

 

 

========= End of CMD: =========

 

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

 

========= RemoveProxy: =========

 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-21-1242277392-240876926-1791514536-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

 

 

========= End of RemoveProxy: =========

 

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

EmptyTemp: => 1018.7 MB temporary data Removed.

 

 

The system needed a reboot.

 

==== End of Fixlog 20:38:48 ====

 

 

# AdwCleaner v5.031 - Logfile created 30/01/2016 at 19:40:37

# Updated 25/01/2016 by Xplode

# Database : 2016-01-25.3 [Server]

# Operating system : Windows 10 Home  (x64)

# Username : Pat - AT

# Running from : C:\Users\Pat\Desktop\adwcleaner_5.031.exe

# Option : Cleaning

# Support : http://toolslib.net/forum

 

***** [ Services ] *****

 

[x] Service Not Deleted : CouponPrinterService

[-] Service Deleted : vToolbarUpdater40.2.4

 

***** [ Folders ] *****

 

[-] Folder Deleted : C:\Program Files (x86)\Coupons

[-] Folder Deleted : C:\Program Files (x86)\DNS Unlocker

[-] Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

[-] Folder Deleted : C:\Program Files\Common Files\AVG Secure Search

[-] Folder Deleted : C:\ProgramData\apn

[-] Folder Deleted : C:\ProgramData\AVG Secure Search

[-] Folder Deleted : C:\ProgramData\AVG Security Toolbar

[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons

[-] Folder Deleted : C:\Users\Pat\AppData\Local\YSearchUtil

[-] Folder Deleted : C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd

[-] Folder Deleted : C:\Users\Pat\AppData\LocalLow\Toolbar4

 

***** [ Files ] *****

 

[-] File Deleted : C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.re-markit00.re-markit.co_0.localstorage

[-] File Deleted : C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.re-markit00.re-markit.co_0.localstorage-journal

 

***** [ DLLs ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Scheduled tasks ] *****

 

[-] Task Deleted : updateTask

[-] Task Deleted : DNSKINGSTON

[-] Task Deleted : AVG-Secure-Search-Update_0116tb_rel

[-] Task Deleted : DNSKINGSTON

 

***** [ Registry ] *****

 

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE

[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh

[-] Key Deleted : HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E

[-] Key Deleted : HKLM\SOFTWARE\274b96db-f785-ad29-d161-2d0c80d3f798

[-] Key Deleted : HKLM\SOFTWARE\5da059a482fd494db3f252126fbc3d5b

[-] Key Deleted : HKLM\SOFTWARE\Classes\TBSB07898.IEToolbar

[-] Key Deleted : HKLM\SOFTWARE\Classes\TBSB07898.IEToolbar.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\TBSB07898.TBSB07898

[-] Key Deleted : HKLM\SOFTWARE\Classes\TBSB07898.TBSB07898.3

[-] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.TBSB07898

[-] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.TBSB07898.1

[-] Key Deleted : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKCU\Software\darwendlm

[-] Key Deleted : HKCU\Software\PRODUCTSETUP

[-] Key Deleted : HKCU\Software\WEBAPP

[-] Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

[-] Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

[-] Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp

[-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

[-] Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37331C16-3E97-4A20-80D8-BFB43AB0E2FB}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.1.6

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet

[-] Key Deleted : [x64] HKLM\SOFTWARE\AVG Secure Search

[-] Key Deleted : HKU\.DEFAULT\Software\AskPartnerNetwork

[-] Key Deleted : HKU\.DEFAULT\Software\VNT

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{d4fee3d1-1014-4db8-a824-573bf9ab51c7}

[-] Data Restored : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5b8b1c12-4a02-435c-b241-4e7e18624bf0} [NameServer]

[-] Data Restored : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{6b8c3852-60ad-4fa2-8232-f6b163c0ea7f} [NameServer]

[-] Data Restored : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{5b8b1c12-4a02-435c-b241-4e7e18624bf0} [NameServer]

[-] Data Restored : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{6b8c3852-60ad-4fa2-8232-f6b163c0ea7f} [NameServer]

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shopathome.com

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.shopathome.com

[-] Key Deleted : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\re-markit.co

[-] Key Deleted : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\static.re-markit00.re-markit.co

[-] Key Deleted : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\re-markit.co

[-] Key Deleted : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\static.re-markit00.re-markit.co

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BrowserAppCoreService]

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

 

***** [ Web browsers ] *****

 

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : search.conduit.com

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : startnow.com

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : search.yahoo.com

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : mystart.incredibar.com/

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask search

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : websearch

[-] [C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : fcfenmboojpjinhpgggodefccipikbpd

 

*************************

 

:: "Tracing" keys removed

:: Winsock settings cleared

 

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [13684 bytes] ##########

 

 

 

# AdwCleaner v5.031 - Logfile created 30/01/2016 at 19:35:26

# Updated 25/01/2016 by Xplode

# Database : 2016-01-25.3 [Server]

# Operating system : Windows 10 Home  (x64)

# Username : Pat - AT

# Running from : C:\Users\Pat\Desktop\adwcleaner_5.031.exe

# Option : Scan

# Support : http://toolslib.net/forum

 

***** [ Services ] *****

 

Service Found : CouponPrinterService

Service Found : vToolbarUpdater40.2.4

 

***** [ Folders ] *****

 

Folder Found : C:\Program Files (x86)\Coupons

Folder Found : C:\Program Files (x86)\DNS Unlocker

Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search

Folder Found : C:\Program Files\Common Files\AVG Secure Search

Folder Found : C:\ProgramData\apn

Folder Found : C:\ProgramData\AVG Secure Search

Folder Found : C:\ProgramData\AVG Security Toolbar

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons

Folder Found : C:\Users\Pat\AppData\Local\YSearchUtil

Folder Found : C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd

Folder Found : C:\Users\Pat\AppData\LocalLow\Toolbar4

 

***** [ Files ] *****

 

File Found : C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.re-markit00.re-markit.co_0.localstorage

File Found : C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.re-markit00.re-markit.co_0.localstorage-journal

 

***** [ DLL ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Scheduled tasks ] *****

 

Task Found : updateTask

Task Found : DNSKINGSTON

Task Found : AVG-Secure-Search-Update_0116tb_rel

Task Found : DNSKINGSTON

 

***** [ Registry ] *****

 

Key Found : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE

Key Found : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh

Key Found : HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E

Key Found : HKLM\SOFTWARE\274b96db-f785-ad29-d161-2d0c80d3f798

Key Found : HKLM\SOFTWARE\5da059a482fd494db3f252126fbc3d5b

Key Found : HKLM\SOFTWARE\Classes\TBSB07898.IEToolbar

Key Found : HKLM\SOFTWARE\Classes\TBSB07898.IEToolbar.1

Key Found : HKLM\SOFTWARE\Classes\TBSB07898.TBSB07898

Key Found : HKLM\SOFTWARE\Classes\TBSB07898.TBSB07898.3

Key Found : HKLM\SOFTWARE\Classes\Toolbar3.TBSB07898

Key Found : HKLM\SOFTWARE\Classes\Toolbar3.TBSB07898.1

Key Found : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd

Key Found : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}

Key Found : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}

Key Found : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}

Key Found : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}

Key Found : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

Key Found : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}

Key Found : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}

Key Found : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}

Key Found : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}

Key Found : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}

Key Found : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}

Key Found : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}

Key Found : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}

Key Found : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}

Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}

Key Found : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKCU\Software\darwendlm

Key Found : HKCU\Software\PRODUCTSETUP

Key Found : HKCU\Software\WEBAPP

Key Found : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Key Found : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Found : HKCU\Software\AppDataLow\Software\adawarebp

Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Found : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37331C16-3E97-4A20-80D8-BFB43AB0E2FB}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.1.6

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet

Key Found : [x64] HKLM\SOFTWARE\AVG Secure Search

Key Found : HKU\.DEFAULT\Software\AskPartnerNetwork

Key Found : HKU\.DEFAULT\Software\VNT

Key Found : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{d4fee3d1-1014-4db8-a824-573bf9ab51c7}

Data Found : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5b8b1c12-4a02-435c-b241-4e7e18624bf0} [NameServer] - 199.203.131.145,82.163.143.167

Data Found : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{6b8c3852-60ad-4fa2-8232-f6b163c0ea7f} [NameServer] - 199.203.131.145,82.163.143.167

Data Found : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{5b8b1c12-4a02-435c-b241-4e7e18624bf0} [NameServer] - 199.203.131.145,82.163.143.167

Data Found : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{6b8c3852-60ad-4fa2-8232-f6b163c0ea7f} [NameServer] - 199.203.131.145,82.163.143.167

Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shopathome.com

Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.shopathome.com

Key Found : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\re-markit.co

Key Found : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\static.re-markit00.re-markit.co

Key Found : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\re-markit.co

Key Found : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\static.re-markit00.re-markit.co

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BrowserAppCoreService]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

 

***** [ Web browsers ] *****

 

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : search.conduit.com

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : startnow.com

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : ask.com

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : aol.com

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : search.yahoo.com

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : mystart.incredibar.com/

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : ask search

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : websearch

[C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : fcfenmboojpjinhpgggodefccipikbpd

 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [12876 bytes] ##########

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.2 (01.06.2016)

Operating System: Windows 10 Home x64 

Ran by Pat (Administrator) on Sat 01/30/2016 at 20:20:01.52

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 9 

 

Successfully deleted: C:\ProgramData\10413984953952079700 (Folder) 

Successfully deleted: C:\ProgramData\3950b9cf0000556f (Folder) 

Successfully deleted: C:\ProgramData\Avg_Update_0116av (Folder) 

Successfully deleted: C:\ProgramData\Avg_Update_1215av (Folder) 

Successfully deleted: C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage-journal (File) 

Successfully deleted: C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage (File) 

Successfully deleted: C:\WINDOWS\system32\Tasks\0116avUpdateInfo (Task)

Successfully deleted: C:\WINDOWS\system32\Tasks\1215avUpdateInfo (Task)

Successfully deleted: C:\WINDOWS\wininit.ini (File) 

 

 

 

Registry: 1 

 

Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\CouponPrinterService (Registry Key) 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sat 01/30/2016 at 20:23:15.19

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Thank you very much. Should the system be running better now? It is still in bad shape. I have never seen Chrome so infected.

[zep516]

Hello,

I know it's in bad shape so keep following along, we have a ways to go here. Lots to do

Next
Please reset Chrome

How to reset Chrome browser settings;

1.In the top-right corner of the browser window, click the Chrome menu
2.Select Settings.
3.At the bottom, click Show advanced settings.
4.Under the section "Reset settings,” click Reset settings.
5.In the dialog that appears, click Reset.

Next

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
• Reboot your computer if prompted.
  
  
  Posting the Malwarebytes log.
• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• post that saved log to your next reply.

[zep516]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.