Solved Spy Alert
- Thread starter John Gilbert
- Start date
John Gilbert
Posts: 22 +0
Should I run "Scan" or "Search Files" ?
John Gilbert
Posts: 22 +0
You first said "Run FRST(FRST64)". "run" does not seem the same as "open", so I was asking which part to "run"..If all I need to do is open FRST64 and press the Fix button, that's easy.
John Gilbert
Posts: 22 +0
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by John at 2014-03-27 11:26:04 Run:1
Running from C:\Users\John\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] - rmdir /s /q "\SearchProtect"
AppInit_DLLs: C:\PROGRA~2\Optimizer => C:\PROGRA~2\Optimizer File Not Found
AppInit_DLLs-x32: c:\progra~2\optimizer => "c:\progra~2\optimizer" File Not Found
BHO-x32: No Name - {CC3C8D60-29D6-4880-B9D8-443C4CBA2BEC} - No File
Toolbar: HKCU - No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File
2014-02-18 15:32 - 2014-02-18 15:32 - 00000000 ____D () C:\ProgramData\SpyAlert
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:13828
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3322283&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP436F0080-782F-47F5-8A01-29C952F56258&SSPV=
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: http://search.conduit.com/Results.a...-47F5-8A01-29C952F56258&q={searchTerms}&SSPV=
C:\Users\John\msgFilterRules.dat
C:\Users\John\popstate.dat
C:\Users\John\AppData\Local\Temp\BackupSetup.exe
C:\Users\John\AppData\Local\Temp\ICReinstall_adwcleaner-3-012-52716-en-setup.exe
C:\Users\John\AppData\Local\Temp\Quarantine.exe
C:\Users\John\AppData\Local\Temp\RegClean6.exe
C:\Users\John\AppData\Local\Temp\sqlite3.exe
Task: {1D3A6BC4-CB27-4C5B-992E-013D8770AA69} - \MySearchDial No Task File
Task: {1EB78641-802C-4C65-A606-55795922A442} - \hdtotal1.2-codedownloader No Task File
Task: {37A78369-EFE0-4B1B-BD62-A9E4D53949C1} - \RegClean Pro No Task File
Task: {426E6B76-AC00-44A4-9DB3-FFF05F25DBF5} - \hdtotal1.2-enabler No Task File
Task: {6C4B032E-0D1B-46EA-931C-0977DAF47EB3} - \hdtotal1.2-updater No Task File
Task: {712428B4-0088-4353-9629-11C0FAE1F59E} - \Advanced System Protector_startup No Task File
Task: {7923722B-1413-4B46-A18F-63F5B5A32B7B} - \BackgroundContainer Startup Task No Task File
Task: {7BB5AF8F-9A4A-4447-8DD7-87E18B2FEB2E} - \RegClean Pro_UPDATES No Task File
Task: {84295653-8CF6-4801-B4EB-9ED02639742C} - \PC SpeedUp Service Deactivator No Task File
Task: {A41A0483-6579-45E9-8264-BCBD1BB9C703} - \hdtotal1.2-chromeinstaller No Task File
Task: {B625706C-A1AE-44F2-8F90-04F15D4EDB7C} - \hdtotal1.2-firefoxinstaller No Task File
Task: {D8053927-1A0C-4F26-954F-B26588384090} - \RegClean Pro_DEFAULT No Task File
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:792D4CF1
AlternateDataStreams: C:\ProgramData\TEMP:A8ADE5D8
AlternateDataStreams: C:\ProgramData\TEMP
287FACF
AlternateDataStreams: C:\ProgramData\TEMP3A96964
AlternateDataStreams: C:\ProgramData\TEMPFC5A2B2
AlternateDataStreams: C:\Users\John\SkyDrive:ms-properties
*****************
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpUninstallDeleteDir => Value deleted successfully.
"C:\\PROGRA~2\\Optimizer" => Value Data removed successfully.
"c:\\progra~2\\optimizer" => Value Data removed successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC3C8D60-29D6-4880-B9D8-443C4CBA2BEC} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{CC3C8D60-29D6-4880-B9D8-443C4CBA2BEC} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} => Value deleted successfully.
HKCR\CLSID\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A13C2648-91D4-4BF3-BC6D-0079707C4389} => Value deleted successfully.
HKCR\CLSID\{A13C2648-91D4-4BF3-BC6D-0079707C4389} => Key deleted successfully.
C:\ProgramData\SpyAlert => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3322283&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP436F0080-782F-47F5-8A01-29C952F56258&SSPV= ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchKeyword: conduit.search ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchProvider: Conduit Search ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchURL: http://search.conduit.com/Results.a...-47F5-8A01-29C952F56258&q={searchTerms}&SSPV= ==> The Chrome "Settings" can be used to fix the entry.
C:\Users\John\msgFilterRules.dat => Moved successfully.
C:\Users\John\popstate.dat => Moved successfully.
C:\Users\John\AppData\Local\Temp\BackupSetup.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\ICReinstall_adwcleaner-3-012-52716-en-setup.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\RegClean6.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\sqlite3.exe => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1D3A6BC4-CB27-4C5B-992E-013D8770AA69} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1D3A6BC4-CB27-4C5B-992E-013D8770AA69} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MySearchDial => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1EB78641-802C-4C65-A606-55795922A442} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EB78641-802C-4C65-A606-55795922A442} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-codedownloader => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{37A78369-EFE0-4B1B-BD62-A9E4D53949C1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{37A78369-EFE0-4B1B-BD62-A9E4D53949C1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{426E6B76-AC00-44A4-9DB3-FFF05F25DBF5} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{426E6B76-AC00-44A4-9DB3-FFF05F25DBF5} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-enabler => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6C4B032E-0D1B-46EA-931C-0977DAF47EB3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C4B032E-0D1B-46EA-931C-0977DAF47EB3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-updater => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{712428B4-0088-4353-9629-11C0FAE1F59E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{712428B4-0088-4353-9629-11C0FAE1F59E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector_startup => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7923722B-1413-4B46-A18F-63F5B5A32B7B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7923722B-1413-4B46-A18F-63F5B5A32B7B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BackgroundContainer Startup Task => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7BB5AF8F-9A4A-4447-8DD7-87E18B2FEB2E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7BB5AF8F-9A4A-4447-8DD7-87E18B2FEB2E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_UPDATES => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{84295653-8CF6-4801-B4EB-9ED02639742C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{84295653-8CF6-4801-B4EB-9ED02639742C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC SpeedUp Service Deactivator => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A41A0483-6579-45E9-8264-BCBD1BB9C703} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A41A0483-6579-45E9-8264-BCBD1BB9C703} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-chromeinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B625706C-A1AE-44F2-8F90-04F15D4EDB7C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B625706C-A1AE-44F2-8F90-04F15D4EDB7C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-firefoxinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D8053927-1A0C-4F26-954F-B26588384090} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8053927-1A0C-4F26-954F-B26588384090} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_DEFAULT => Key deleted successfully.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\ProgramData\TEMP => ":792D4CF1" ADS removed successfully.
C:\ProgramData\TEMP => ":A8ADE5D8" ADS removed successfully.
C:\ProgramData\TEMP => "287FACF" ADS removed successfully.
C:\ProgramData\TEMP => "3A96964" ADS removed successfully.
C:\ProgramData\TEMP => "FC5A2B2" ADS removed successfully.
"C:\Users\John\SkyDrive" => ":ms-properties" ADS not found.
==== End of Fixlog ====
Ran by John at 2014-03-27 11:26:04 Run:1
Running from C:\Users\John\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] - rmdir /s /q "\SearchProtect"
AppInit_DLLs: C:\PROGRA~2\Optimizer => C:\PROGRA~2\Optimizer File Not Found
AppInit_DLLs-x32: c:\progra~2\optimizer => "c:\progra~2\optimizer" File Not Found
BHO-x32: No Name - {CC3C8D60-29D6-4880-B9D8-443C4CBA2BEC} - No File
Toolbar: HKCU - No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File
2014-02-18 15:32 - 2014-02-18 15:32 - 00000000 ____D () C:\ProgramData\SpyAlert
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:13828
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3322283&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP436F0080-782F-47F5-8A01-29C952F56258&SSPV=
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: http://search.conduit.com/Results.a...-47F5-8A01-29C952F56258&q={searchTerms}&SSPV=
C:\Users\John\msgFilterRules.dat
C:\Users\John\popstate.dat
C:\Users\John\AppData\Local\Temp\BackupSetup.exe
C:\Users\John\AppData\Local\Temp\ICReinstall_adwcleaner-3-012-52716-en-setup.exe
C:\Users\John\AppData\Local\Temp\Quarantine.exe
C:\Users\John\AppData\Local\Temp\RegClean6.exe
C:\Users\John\AppData\Local\Temp\sqlite3.exe
Task: {1D3A6BC4-CB27-4C5B-992E-013D8770AA69} - \MySearchDial No Task File
Task: {1EB78641-802C-4C65-A606-55795922A442} - \hdtotal1.2-codedownloader No Task File
Task: {37A78369-EFE0-4B1B-BD62-A9E4D53949C1} - \RegClean Pro No Task File
Task: {426E6B76-AC00-44A4-9DB3-FFF05F25DBF5} - \hdtotal1.2-enabler No Task File
Task: {6C4B032E-0D1B-46EA-931C-0977DAF47EB3} - \hdtotal1.2-updater No Task File
Task: {712428B4-0088-4353-9629-11C0FAE1F59E} - \Advanced System Protector_startup No Task File
Task: {7923722B-1413-4B46-A18F-63F5B5A32B7B} - \BackgroundContainer Startup Task No Task File
Task: {7BB5AF8F-9A4A-4447-8DD7-87E18B2FEB2E} - \RegClean Pro_UPDATES No Task File
Task: {84295653-8CF6-4801-B4EB-9ED02639742C} - \PC SpeedUp Service Deactivator No Task File
Task: {A41A0483-6579-45E9-8264-BCBD1BB9C703} - \hdtotal1.2-chromeinstaller No Task File
Task: {B625706C-A1AE-44F2-8F90-04F15D4EDB7C} - \hdtotal1.2-firefoxinstaller No Task File
Task: {D8053927-1A0C-4F26-954F-B26588384090} - \RegClean Pro_DEFAULT No Task File
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:792D4CF1
AlternateDataStreams: C:\ProgramData\TEMP:A8ADE5D8
AlternateDataStreams: C:\ProgramData\TEMP
287FACFAlternateDataStreams: C:\ProgramData\TEMP
3A96964AlternateDataStreams: C:\ProgramData\TEMP
FC5A2B2AlternateDataStreams: C:\Users\John\SkyDrive:ms-properties
*****************
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpUninstallDeleteDir => Value deleted successfully.
"C:\\PROGRA~2\\Optimizer" => Value Data removed successfully.
"c:\\progra~2\\optimizer" => Value Data removed successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC3C8D60-29D6-4880-B9D8-443C4CBA2BEC} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{CC3C8D60-29D6-4880-B9D8-443C4CBA2BEC} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} => Value deleted successfully.
HKCR\CLSID\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A13C2648-91D4-4BF3-BC6D-0079707C4389} => Value deleted successfully.
HKCR\CLSID\{A13C2648-91D4-4BF3-BC6D-0079707C4389} => Key deleted successfully.
C:\ProgramData\SpyAlert => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3322283&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP436F0080-782F-47F5-8A01-29C952F56258&SSPV= ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchKeyword: conduit.search ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchProvider: Conduit Search ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchURL: http://search.conduit.com/Results.a...-47F5-8A01-29C952F56258&q={searchTerms}&SSPV= ==> The Chrome "Settings" can be used to fix the entry.
C:\Users\John\msgFilterRules.dat => Moved successfully.
C:\Users\John\popstate.dat => Moved successfully.
C:\Users\John\AppData\Local\Temp\BackupSetup.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\ICReinstall_adwcleaner-3-012-52716-en-setup.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\RegClean6.exe => Moved successfully.
C:\Users\John\AppData\Local\Temp\sqlite3.exe => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1D3A6BC4-CB27-4C5B-992E-013D8770AA69} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1D3A6BC4-CB27-4C5B-992E-013D8770AA69} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MySearchDial => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1EB78641-802C-4C65-A606-55795922A442} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EB78641-802C-4C65-A606-55795922A442} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-codedownloader => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{37A78369-EFE0-4B1B-BD62-A9E4D53949C1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{37A78369-EFE0-4B1B-BD62-A9E4D53949C1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{426E6B76-AC00-44A4-9DB3-FFF05F25DBF5} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{426E6B76-AC00-44A4-9DB3-FFF05F25DBF5} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-enabler => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6C4B032E-0D1B-46EA-931C-0977DAF47EB3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C4B032E-0D1B-46EA-931C-0977DAF47EB3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-updater => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{712428B4-0088-4353-9629-11C0FAE1F59E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{712428B4-0088-4353-9629-11C0FAE1F59E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector_startup => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7923722B-1413-4B46-A18F-63F5B5A32B7B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7923722B-1413-4B46-A18F-63F5B5A32B7B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BackgroundContainer Startup Task => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7BB5AF8F-9A4A-4447-8DD7-87E18B2FEB2E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7BB5AF8F-9A4A-4447-8DD7-87E18B2FEB2E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_UPDATES => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{84295653-8CF6-4801-B4EB-9ED02639742C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{84295653-8CF6-4801-B4EB-9ED02639742C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC SpeedUp Service Deactivator => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A41A0483-6579-45E9-8264-BCBD1BB9C703} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A41A0483-6579-45E9-8264-BCBD1BB9C703} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-chromeinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B625706C-A1AE-44F2-8F90-04F15D4EDB7C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B625706C-A1AE-44F2-8F90-04F15D4EDB7C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\hdtotal1.2-firefoxinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D8053927-1A0C-4F26-954F-B26588384090} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8053927-1A0C-4F26-954F-B26588384090} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_DEFAULT => Key deleted successfully.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\ProgramData\TEMP => ":792D4CF1" ADS removed successfully.
C:\ProgramData\TEMP => ":A8ADE5D8" ADS removed successfully.
C:\ProgramData\TEMP => "
287FACF" ADS removed successfully.C:\ProgramData\TEMP => "
3A96964" ADS removed successfully.C:\ProgramData\TEMP => "
FC5A2B2" ADS removed successfully."C:\Users\John\SkyDrive" => ":ms-properties" ADS not found.
==== End of Fixlog ====
Broni
Posts: 56,041 +517
Last scans...
Download Security Check from here or here and save it to your Desktop.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.
Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
Please run a free online scan with the ESET Online Scanner
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.
- Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Other Services
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
- Disable your antivirus program
- Click on "Run ESET Online Scanner" button.
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, click on List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
John Gilbert
Posts: 22 +0
Results of screen317's Security Check version 0.99.81
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
WinPatrol 2009 (Outdated! Latest version is WinPatrol 2012)
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 51
Adobe Flash Player 12.0.0.77
Adobe Reader 10.1.9 Adobe Reader out of Date!
Mozilla Firefox 16.0.2 Firefox out of Date!
Mozilla Thunderbird (24.1.1)
Google Chrome 33.0.1750.146
Google Chrome 33.0.1750.154
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
WinPatrol winpatrol.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
BillP Studios WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
WinPatrol 2009 (Outdated! Latest version is WinPatrol 2012)
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 51
Adobe Flash Player 12.0.0.77
Adobe Reader 10.1.9 Adobe Reader out of Date!
Mozilla Firefox 16.0.2 Firefox out of Date!
Mozilla Thunderbird (24.1.1)
Google Chrome 33.0.1750.146
Google Chrome 33.0.1750.154
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
WinPatrol winpatrol.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
BillP Studios WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
John Gilbert
Posts: 22 +0
Farbar Service Scanner Version: 25-02-2014
Ran by John (administrator) on 28-03-2014 at 10:19:05
Running from "C:\Users\John\Downloads"
Microsoft Windows 8.1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
IE proxy is enabled.
ProxyServer: http=127.0.0.1:13828
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2014-03-11 23:32] - [2014-01-29 03:47] - 2543960 ____A (Microsoft Corporation) ECC68BD5347BDE9631EE68274858A41F
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll
[2014-03-11 23:32] - [2013-10-25 01:48] - 1571328 ____A (Microsoft Corporation) 8077537B1600AF493E7EE1A7A5C90799
C:\Program Files\Windows Defender\MsMpEng.exe
[2014-03-11 23:32] - [2013-10-30 19:29] - 0023824 ____A (Microsoft Corporation) 7CE5405B192AC912B9405F72386C7D4B
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Ran by John (administrator) on 28-03-2014 at 10:19:05
Running from "C:\Users\John\Downloads"
Microsoft Windows 8.1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
IE proxy is enabled.
ProxyServer: http=127.0.0.1:13828
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2014-03-11 23:32] - [2014-01-29 03:47] - 2543960 ____A (Microsoft Corporation) ECC68BD5347BDE9631EE68274858A41F
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll
[2014-03-11 23:32] - [2013-10-25 01:48] - 1571328 ____A (Microsoft Corporation) 8077537B1600AF493E7EE1A7A5C90799
C:\Program Files\Windows Defender\MsMpEng.exe
[2014-03-11 23:32] - [2013-10-30 19:29] - 0023824 ____A (Microsoft Corporation) 7CE5405B192AC912B9405F72386C7D4B
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
John Gilbert
Posts: 22 +0
10 threats found. Took a bit over 4 hours
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptimizerPro.exe.vir a variant of Win32/SpeedingUpMyPC application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir a variant of Win32/AdWare.SpeedingUpMyPC.D application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir a variant of Win32/Adware.SpeedingUpMyPC.C application
C:\FRST\Quarantine\C\Users\John\AppData\Local\Temp\ICReinstall_adwcleaner-3-012-52716-en-setup.exe.xBAD a variant of Win32/Injected.F trojan
C:\Program Files (x86)\View-Password-soft\Uninstall.exe a variant of Win32/AdWare.AddLyrics.AH application
C:\Program Files (x86)\View-Password-soft\View-.exe a variant of Win32/AdWare.AddLyrics.AI application
C:\Program Files (x86)\View-Password-soft\ViewPassword157.exe a variant of Win32/AdWare.AD150.B application
C:\Program Files (x86)\View-Password-soft\ViewPassword_wd.exe a variant of Win32/AdWare.AD150.B application
C:\Users\John\Downloads\adwcleaner-3-012-52716-en-setup.exe a variant of Win32/Injected.F trojan
C:\Users\John\Downloads\Player-Chrome.exe a variant of Win32/AdWare.iBryte.T application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptimizerPro.exe.vir a variant of Win32/SpeedingUpMyPC application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir a variant of Win32/AdWare.SpeedingUpMyPC.D application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir a variant of Win32/Adware.SpeedingUpMyPC.C application
C:\FRST\Quarantine\C\Users\John\AppData\Local\Temp\ICReinstall_adwcleaner-3-012-52716-en-setup.exe.xBAD a variant of Win32/Injected.F trojan
C:\Program Files (x86)\View-Password-soft\Uninstall.exe a variant of Win32/AdWare.AddLyrics.AH application
C:\Program Files (x86)\View-Password-soft\View-.exe a variant of Win32/AdWare.AddLyrics.AI application
C:\Program Files (x86)\View-Password-soft\ViewPassword157.exe a variant of Win32/AdWare.AD150.B application
C:\Program Files (x86)\View-Password-soft\ViewPassword_wd.exe a variant of Win32/AdWare.AD150.B application
C:\Users\John\Downloads\adwcleaner-3-012-52716-en-setup.exe a variant of Win32/Injected.F trojan
C:\Users\John\Downloads\Player-Chrome.exe a variant of Win32/AdWare.iBryte.T application
Broni
Posts: 56,041 +517
You have to either delete them manually or re-run Eset.
You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.
==============================
Your computer is clean
1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download
Double-click Delfix.exe to start the tool.
Make sure the following items are checked:
- Activate UAC (optional; some users prefer to keep it off)
- Remove disinfection tools
- Create registry backup
- Purge System Restore
- Reset system settings
Once finished a logfile will be created. You don't have to attach it to your next reply.
2. Make sure Windows Updates are current.
3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!
4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)
5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.
7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).
8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.
9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.
10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.
11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642
12. Please, let me know, how your computer is doing.
John Gilbert
Posts: 22 +0
Yes, it seems to be. Still some things to do, download & re-run those tools removed when cleaning up. Apologies for the delay in responding - in the middle of moving my office on top of everything else. I will be down for the weekend, but will check back in when I am up and running again, hopefully by Monday or Tuesday.
Thanks for your help & patience with this "newbie"
Thanks for your help & patience with this "newbie"
Similar threads
