Search:

thanks will try that.

how can I load spybot on to my "D" Drive as my "C" drive does not have much room left.
It does not seem to give me an option to custom instal.

Hi

Thank you very much for all your help. I hope you have gained something from all this I have. I am sorry if I mucked up your weekend.

ok
how do we do that

Hi

looking good I can even see my emails again

hi

second attempt

there were no \MetafileODBCRoot.exe in the Rogue Killer file


ComboFix 14-10-15.01 - bob 10/20/2014 17:37:13.3.2 - x64
Microsoft Windows 7 Ultimate ...

sorry forgot to say No I did not knowingly install this I thought it might have been windows 7 software.

C:\Users\bob\AppData
Application Data folder
...

your combofix report

ComboFix 14-10-15.01 - bob 10/20/2014 13:01:09.2.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.4086.2712 [GMT 1:00]
Running from:...

Hi
just to start as I had already edited the proxy settings in the registry this is the Rogue Killer file before any deletions you have asked for as you see there are only the last four that mach...

Hi again
well I went to Services to put windows defender back to Auto as it was in manual.

while I was there I looked at what else was running in Auto and Manual. remote desktop was in Auto so I...

Hi

the suspicious. path. JavakeyboardNative.exe C:\Users\Bob\AppData\

This is not found on the C drive. there are is no AppData file/folder.

the first folder is Contacts

is this...

hi
this is the new rogue killer report.

RogueKiller V10.0.2.0 [Oct 16 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website :...

Hi
Good morning

the first Rkill.EXE worked fine

Rkill 2.6.8 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about...

Hi
well its my bed time again will look out for you tomorrow.

thanks

Hi
just checked the registry, there is no sign of the entries there but the proxy address is still being put into the "use proxy" window.

Hi
well have run repair and MiniToolBox

results

MiniToolBox by Farbar Version: 21-07-2014
Ran by bob (administrator) on 19-10-2014 at 19:33:27
Running from "C:\Users\bob\Downloads"...

OK
so I have just rebooted. the registry entries for the proxy are all still there as before. they must have something hidden somewere else to put it all back.

Hi
ok here are the 2 reports


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-10-2014
Ran by bob at 2014-10-19 14:01:36 Run:3
Running from C:\Users\bob\Desktop...

Ok
on my other computer there is only

ProxyEnable REG_DWORD 0x0000000 (0)

does this help

Hi
I have just looked in to the registry on this machine. below are the entries picked up by Rogue Killer.
...

Hi
Good morning

I have run the Malwarebytes Anti-Rootkit twice "No Maleware Found" both times.

I have checked on another computer in the house, this computer does not need to use Proxy's....

OK
just finished the EST scan .

C:\Users\bob\AppData\Roaming\QY JS/Toolbar.Crossrider.C potentially unwanted application
C:\Users\bob\AppData\Roaming\XZQE JS/Toolbar.Crossrider.C potentially...

hi
sorry had to stop to go to church.

I have tried running Rogue Killer in safe mode and reset browsers. IE stayed in automatic while in safe mode but reverted to "use Proxy" once run up...

also did the browser resets with no change.

Hi
have run Rogue Killer twice each time the first two lines you wanted cleaned, are replaced. the third deleted. the forth gives an error[2] message. all four appeared as the original scan on the...

Hi
have just checked the Proxy settings. they still revert to "use Proxy" after I change them to auto. no I an shore I should not be using a proxy.

Hi
still getting the unwanted windows.

after running the fix and computer run back up I got this when trying to get back to this forum

The proxy server is refusing connections



Firefox...

Good Morning.

ok last night as I was preparing to shut down the computer IE closing programs " ComboFix" was still running waiting for the antivirus software to be shut down. when I clicked yes...

have just checked the proxy window. it does not stay at "automatic", it always reverts back to "use proxy"

going to bed will look out for you tomorrow morning.


thanks

I am having trouble shutting down both spybot and avira as they avira is not on my system tray and spybot window does not have a "mode" choice ??
I have reset both firefox and internet explorer....

I note that the proxy setup does not stay in automatic although there is no information in the two small windows.

this does not show up in the remove software panel
Wajam Internet Enhancer

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-10-2014
Ran by bob at 2014-10-17 14:18:22...

I am running windows 7 64bit. I have some how got an infection that is more annoying than anything. it also prevents me seeing my emails.

here are the requested files

Additional scan result of...

hi Juliet

have done what you asked. Thanks for the tips as well, I will share that information with my son and daughter.

thanks again for all your help much appreciated.

Hi Juliet

Sorry past my bet time us OAP's need our shut eye. will check again in the morning.

hi Juliet
still going fine. The only thing that gets me now is an "image" named in Task Manager "mbamservice.exe" uses my hard drive and most of the memory just as I was about to run FRST
I think...

hi Juliet

results

C:\AdwCleaner\Quarantine\C\Documents and Settings\millam\Application Data\Mozilla\Firefox\Profiles\nlv5wxzw.default\Extensions\firefox@lemurleap.info.xpi.vir Win32/BrowseFox.B...

hi Juliet

yes its there. copied it to clipboard then pasted it here.

the computer has been working fine all day, no more unwanted windows opening.

I am running malwarebytes again will post...

Hi Juliet

have run malwarebytes it found four PUPS and removed them. for some reason I could not get the log to save to the desk top. if you know where to look I will find it for you.

I have to...

Hi Juliet

as asked for the program did not highlight and problems. running new malwarebytes now



# AdwCleaner v3.023 - Report created 02/04/2014 at 15:54:49
# Updated 01/04/2014 by Xplode...

Ok the oldtimers ran ok in safe mode. removed some 180 temp files.

the Icon still disappears when the computer is run up in normal mode.

hi Juliet

the log I posted has today's date and time # AdwCleaner v3.023 - "Report created 02/04/2014 at 12:14:34"

the adwcleaner only showed the Pirrit to be cleaned. so I assume it has...

hi Juliet

here is the adwcleaner file.

I down loaded http://oldtimer.geekstogo.com/TFC.exe but it hangs up. tried it twice. then deleted it and down loaded it again with the same results. it...

ok back up and running. first thing I notice is that the password keeper is working again. but I have only just turned it on will try other things while I wait.



Fix result of Farbar...

I have got as far as "AdwCleaner by Xplode" but it is not on my desk top and you did not give a link to where I can down load it. I tried a quick web search but got a registry cleaner not what you...

might have given you the same one twice sorry

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01
Ran by millam (administrator) on BOB-276AB2C0593 on 01-04-2014...

as requested.



Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-03-2014 01
Ran by millam at 2014-04-01 20:06:01
Running from C:\Documents and Settings\millam\My...

sorry the attach file is not zipped my computer does not give me the option to SENT IT TO.

my problem.
when opening another window e.g. selecting an article in a newspaper, an additional window...

no all ok now thanks once again

thank you very much for your time. all clear now.
just for info any idea what zlob rtk did.
zlob dns changer prevented me defraging my computer.
on the spybot scan page you get a message to click...