Page 2 of 9 FirstFirst 123456 ... LastLast
Results 11 to 20 of 83

Thread: How so I remove AdChoices?

  1. #11
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Scan with SystemLook

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:

      Code:
      :regfind
      *Adpeak*
      adchoice
      :filefind
      *adchoice*
      *Adpeak*
      :folderfind
      *adchoice*
      *Adpeak*
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

    Note: The log can also be found on your Desktop entitled SystemLook.txt

    ********************

    Next: Disconnect from the internet. If you are on Cable or DSL unplug your computer from the modem.
    Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
    This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

    Click on this link Here to see a list of programs that should be disabled.
    The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
    Save this as "CFScript.txt" including quotes and change the "Save as type" to "All Files" and place it on your desktop.
    Folder::
    c:\users\Gary\AppData\Local\EmieBrowserModeList
    ClearJavaCache::


    Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.



    CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    If there are internet issues afterward:

    *In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.


    Chrome:
    Select -> Tools menu -> then "Options", then go to "Change Proxy Settings", then "LAN Settings" , then take out the check mark for "Use a proxy server for your LAN" if set, unless you set this up yourself.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  2. #12
    Member
    Join Date
    Nov 2014
    Posts
    71

    Default

    No Success yet. Logs below:

    SystemLook 30.07.11 by jpshortstuff
    Log created at 18:00 on 29/11/2014 by Gary
    Administrator - Elevation successful
    WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

    ========== regfind ==========

    Searching for "*Adpeak*"
    No data found.

    Searching for "adchoice"
    No data found.

    ========== filefind ==========

    Searching for "*adchoice*"
    No files found.

    Searching for "*Adpeak*"
    No files found.

    ========== folderfind ==========

    Searching for "*adchoice*"
    No folders found.

    Searching for "*Adpeak*"
    No folders found.

    -= EOF =-


    ComboFix 14-11-25.01 - Gary 11/29/2014 21:20:59.2.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3894.1719 [GMT -5:00]
    Running from: c:\users\Gary\Documents\Desktop\ComboFix.exe
    Command switches used :: c:\users\Gary\Documents\Desktop\CFScript.txt
    AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
    SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Gary\AppData\Local\EmieBrowserModeList
    c:\users\Gary\AppData\Local\EmieBrowserModeList\container.dat
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-10-28 to 2014-11-30 )))))))))))))))))))))))))))))))
    .
    .
    2014-11-30 02:26 . 2014-11-30 02:26 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-11-30 02:26 . 2014-11-30 02:26 -------- d-----w- c:\users\Administrator\AppData\Local\temp
    2014-11-29 22:59 . 2014-11-29 22:59 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D5601C24-501A-49EC-8358-0EF87EFE2C47}\offreg.dll
    2014-11-29 12:13 . 2014-11-02 04:20 11632448 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D5601C24-501A-49EC-8358-0EF87EFE2C47}\mpengine.dll
    2014-11-28 16:05 . 2014-11-28 16:05 -------- d-----w- c:\program files (x86)\ESET
    2014-11-28 15:44 . 2014-11-28 15:44 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-11-28 15:44 . 2014-11-28 15:44 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2014-11-28 15:44 . 2014-10-01 16:11 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-11-28 15:44 . 2014-10-01 16:11 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-11-28 15:44 . 2014-10-01 16:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-11-28 14:37 . 2014-11-02 04:20 11632448 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2014-11-28 14:22 . 2014-11-28 14:22 -------- d-----w- c:\windows\ERUNT
    2014-11-28 10:59 . 2014-11-28 10:59 -------- d-----w- c:\users\Gary\AppData\Roaming\LavasoftStatistics
    2014-11-28 10:59 . 2014-11-28 11:12 213 ----a-w- C:\prefs.js
    2014-11-28 10:59 . 2014-11-28 11:12 -------- d-----w- C:\searchplugins
    2014-11-28 10:59 . 2014-11-27 15:44 358736 ----a-w- c:\windows\system32\LavasoftTcpService64.dll
    2014-11-28 10:59 . 2014-11-27 15:44 312424 ----a-w- c:\windows\SysWow64\LavasoftTcpService.dll
    2014-11-27 23:54 . 2014-11-28 13:57 -------- d-----w- C:\FRST
    2014-11-27 23:53 . 2014-11-27 23:53 -------- d-----w- C:\RegBackup
    2014-11-27 23:52 . 2014-11-27 23:52 -------- d-----w- c:\program files (x86)\Tweaking.com
    2014-11-21 06:53 . 2014-09-17 14:05 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{256D28CD-A6CA-49E0-ABB1-B4C9DB37F784}\gapaengine.dll
    2014-11-21 00:00 . 2014-11-21 00:00 -------- d-----w- c:\users\Gary\AppData\Roaming\LEGO Company
    2014-11-20 23:55 . 2014-11-20 23:55 -------- d-----w- c:\program files (x86)\LEGO Company
    2014-11-19 10:51 . 2014-11-11 03:08 241152 ----a-w- c:\windows\system32\pku2u.dll
    2014-11-19 10:51 . 2014-11-11 03:08 728064 ----a-w- c:\windows\system32\kerberos.dll
    2014-11-19 10:51 . 2014-11-11 02:44 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
    2014-11-19 10:51 . 2014-11-11 02:44 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
    2014-11-14 14:08 . 2014-11-14 14:08 -------- d-----w- c:\users\Gary\AppData\Local\Apps
    2014-11-14 13:35 . 2014-11-14 13:35 -------- d-----w- c:\users\Gary\AppData\Roaming\MyTurboPC.com
    2014-11-14 13:35 . 2014-11-14 13:45 -------- d-----w- c:\programdata\MyTurboPC.com
    2014-11-14 11:08 . 2014-11-14 11:09 -------- d-----w- C:\temp
    2014-11-14 11:08 . 2014-11-14 11:08 -------- d-----w- C:\dvmexp
    2014-11-14 11:05 . 2014-11-28 14:17 -------- d-----w- C:\AdwCleaner
    2014-11-12 12:17 . 2014-08-21 06:43 1882624 ----a-w- c:\windows\system32\msxml3.dll
    2014-11-12 12:16 . 2014-09-19 09:42 342016 ----a-w- c:\windows\system32\schannel.dll
    2014-11-06 21:32 . 2014-11-06 21:32 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
    2014-11-06 21:32 . 2014-11-06 21:32 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
    2014-11-06 21:32 . 2014-11-06 21:32 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
    2014-11-06 21:32 . 2014-11-06 21:32 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
    2014-11-06 21:32 . 2014-11-06 21:32 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
    2014-11-06 21:32 . 2014-11-06 21:32 -------- d-----w- c:\program files (x86)\QuickTime
    2014-11-06 21:29 . 2014-11-06 21:29 -------- d-----w- c:\program files\iPod
    2014-11-06 21:29 . 2014-11-06 21:30 -------- d-----w- c:\programdata\E1864A66-75E3-486a-BD95-D1B7D99A84A7
    2014-11-06 21:29 . 2014-11-06 21:30 -------- d-----w- c:\program files\iTunes
    2014-11-06 21:29 . 2014-11-06 21:30 -------- d-----w- c:\program files (x86)\iTunes
    2014-10-31 12:58 . 2014-10-31 12:58 -------- d-----w- c:\program files (x86)\Garmin GPS Plugin
    2014-10-31 12:58 . 2014-10-31 12:58 -------- d-----w- c:\program files\Garmin GPS Plugin
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-11-27 16:39 . 2012-06-15 09:27 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-11-27 16:39 . 2011-12-23 17:22 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-11-13 08:00 . 2011-06-17 11:52 103374192 ----a-w- c:\windows\system32\MRT.exe
    2014-10-30 11:25 . 2011-06-08 17:27 275080 ------w- c:\windows\system32\MpSigStub.exe
    2014-10-29 23:07 . 2014-10-29 23:07 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2014-10-02 19:23 . 2014-10-02 19:23 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
    2014-10-02 19:23 . 2014-10-02 19:23 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
    2014-09-25 02:08 . 2014-10-01 10:33 371712 ----a-w- c:\windows\system32\qdvd.dll
    2014-09-25 01:40 . 2014-10-01 10:33 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
    2014-09-17 14:05 . 2011-08-11 21:07 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
    2014-09-09 22:11 . 2014-09-24 10:36 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-09-09 21:47 . 2014-09-24 10:36 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-09-04 05:23 . 2014-10-14 17:27 424448 ----a-w- c:\windows\system32\rastls.dll
    2014-09-04 05:04 . 2014-10-14 17:27 372736 ----a-w- c:\windows\SysWow64\rastls.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HPAdvisorDock"="c:\program files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe" [2010-01-28 1712184]
    "HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe" [2010-01-28 1712184]
    "ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2008-10-20 210208]
    "Backblaze"="c:\program files (x86)\Backblaze\bzbui.exe" [2014-11-26 493672]
    "iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-10-17 43816]
    "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2014-10-17 43816]
    "GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2014-10-21 688984]
    "HP Photosmart 7520 series (NET)"="c:\program files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "DiskeeperSystray"="c:\program files (x86)\Executive Software\Diskeeper\DkIcon.exe" [2004-10-05 176216]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
    "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
    "Wondershare Helper Compact.exe"="c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2014-08-26 2087776]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-26 271744]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Backblaze"="c:\program files (x86)\Backblaze\bzbui.exe" [2014-11-26 493672]
    .
    c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Monitor Ink Alerts - HP Photosmart 7520 series (Network).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Photosmart 7520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=TH45C721R505YY;CONNECTION=NW;MONITOR=1; [2009-7-13 45568]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE /tsr [2007-4-19 64864]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs"=1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ DPPassFilter scecli
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
    R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
    R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
    S1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys;c:\windows\SYSNATIVE\DRIVERS\dvmio.sys [x]
    S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2010/08/16 12:36];c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl;c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl [x]
    S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
    S2 bzserv;Backblaze Service;c:\program files (x86)\Backblaze\bzserv.exe;c:\program files (x86)\Backblaze\bzserv.exe [x]
    S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
    S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
    S2 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [x]
    S2 dlbk_device;dlbk_device;c:\windows\system32\dlbkcoms.exe;c:\windows\SYSNATIVE\dlbkcoms.exe [x]
    S2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe;c:\windows\SYSNATIVE\dlcxcoms.exe [x]
    S2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\QuickWeb\QW.SYS\config\DVMExportService.exe;c:\swsetup\QuickWeb\QW.SYS\config\DVMExportService.exe [x]
    S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
    S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
    S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
    S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
    S2 IHA_MessageCenter;IHA_MessageCenter;c:\program files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe;c:\program files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [x]
    S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
    S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-11-26 17:34 1087304 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.71\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-15 16:39]
    .
    2014-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-12 20:23]
    .
    2014-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-12 20:23]
    .
    2014-11-28 c:\windows\Tasks\HPCeeScheduleForGary.job
    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 09:43]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-01-18 451072]
    "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-01-20 611896]
    "HPToneControl"="c:\program files\Hewlett-Packard\HPToneControl\HPTonectl.exe" [2009-08-20 107832]
    "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2009-12-16 8192]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-06-12 487424]
    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-29 161304]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-29 386584]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-29 415256]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-11-12 21720]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    TCP: DhcpNameServer = 192.168.1.1 71.243.0.12
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Wow6432Node-HKLM-Run-<NO NAME> - (no file)
    AddRemove-HTPE3 - c:\windows\System32\Unwise32.exe
    AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
    "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
    @Denied: (2) (LocalSystem)
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,65,69,5d,3f,f3,4d,47,b0,0d,6d,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,65,69,5d,3f,f3,4d,47,b0,0d,6d,\
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.15"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
    @="?????????????????? v1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
    @="?????????????????? v2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2014-11-29 21:28:29
    ComboFix-quarantined-files.txt 2014-11-30 02:28
    ComboFix2.txt 2014-11-29 12:00
    .
    Pre-Run: 73,962,446,848 bytes free
    Post-Run: 73,878,700,032 bytes free
    .
    - - End Of File - - 6E905AC0C99D0697291E71B4B546A97A

  3. #13
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    This thing is hung in your browsers, grrrrrrr

    Please Uninstall
    MyTurboPC ---> customer reviews complain of poor results using this application.

    ~~~~~~~~~~~~

    Adblock Plus
    Please download and install the above, this tool can block unwanted adds and I use it myself.

    ~~~~~~~~~~~~~~

    We may have run through the directions below once before but let's try this again, after resetting the browsers please reboot the computer.


    Complete any of the steps below that relate to the browsers you use.

    Disable Plug-ins in Google Chrome
    • Click the Chrome menu on the browser toolbar.
    • Select Settings.
    • Scroll down to Show advanced settings...
    • Locate the Privacy Section, select Content Settings
    • In the pop up window scroll to Plug-Ins, select Disable individual plug-ins...
    • Locate the following plug-ins and set them to Disable:
    • AdChoices
    • NEXT

    =========================

    Delete cache and other browser data in Chrome
    • Select Tools.
    • Select Clear browsing data.
    • In the dialogue that appears, select the highlighted check-boxes for the types of information that you want to remove.
    • Clear browsing history
    • Clear download history
    • Empty the cache
    • Delete cookies and other site and plug-in data
    • Clear saved passwords
    • Clear saved Auto-fill form data
    • Clear data from hosted apps
    • De-authorize content licenses
    • Use the menu at the top to select the amount of data that you want to delete. Select beginning of time to delete everything.
    • Click Clear browsing data.

    =========================

    Disable FireFox plug-in
    • At the top of the Firefox window, click on the Firefox button (Tools menu in Windows XP), and then click Add-ons. The Add-ons Manager tab will open.
    • In the Add-ons Manager tab, select the Extensions or Appearance panel.
    • Select the add-on you wish to disable.
    • AdChoices
    • McAfee Security Scan
    • Click the Disable button.
    • Click Restart now if it pops up. Your tabs will be saved and restored after the restart.

    =========================

    Flush the FireFox Cache
    (these directions are specific to Firefox 19, if you have a different version the exact steps might be slightly different)
    • In Firefox, Options
    • Select Options
    • Select Privacy tab
    • Find the section that reads: You might want to clear your recent history or remove individual cookies
    • Select clear your recent history
    • Click the Details drop-down arrow
    • Make sure a check mark is placed in the following boxes:
    • Cookies
    • Cache
    • Next select the Time Range to Clear drop-down menu
    • Select Everything (this will only delete all the cookies and cache, and will save the other items not selected)
    • Click Clear Now

    =========================

    Manage Add-Ons in Internet Explorer
    • Locate the in the upper right hand corner of the Internet Explorer browser window.
    • Left click, then choose Manage add-ons > Toolbars and Extensions
    • Locate the following add-ons (if present)
    • AdChoices
    • Select the add-on, and click the Disable button.
    • Do this for each entry present, then close

    =========================


    Clear Browser Cache in IE11
    • Close all Internet Explorer and Windows Explorer windows that are currently open.
    • Open Internet Explorer.
    • Click the Tools button , and then select theGeneral tab, then select Browsing history select the Delete button.
    • Select the check box next to each of the following categories.
    • Temporary Internet files and website files
    • Cookies and website data
    • History
    • Click Delete

    =========================
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  4. #14
    Member
    Join Date
    Nov 2014
    Posts
    71

    Default

    Good morning Juliet,

    The saga continues.

    I am unable to find MyTurboPC in the control panel "Programs and Features". Your post leaves me with the impression that you know it's there, but I don't know how to remove it.

    I installed AdBlock Plus and it sort of works in the sense that it blocks the ad, but the ad is still able to tab the pages down which makes clicking on moving targets challenging and annoying. True, you can no longer see the add, but the browsing experience is still pretty annoying.

    I cleared the plugins and browsing data but it didn't seem to help.

    Thank you for your continued help as this is clearly a nasty infection.

    Best regards,
    Gary

  5. #15
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    It's been a pistol hasn't it.

    Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy.
    Paste this into the open notepad. save it to the Desktop as fixlist.txt
    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
    It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

    start
    2014-11-14 08:35 - 2014-11-14 08:45 - 00000000 ____D () C:\ProgramData\MyTurboPC.com
    2014-11-14 08:35 - 2014-11-14 08:35 - 00000000 ____D () C:\Users\Gary\AppData\Roaming\MyTurboPC.com
    c:\users\Gary\AppData\Roaming\MyTurboPC.com
    c:\programdata\MyTurboPC.com
    EmptyTemp:
    Hosts:
    End
    Open FRST/FRST64 and press the Fix button just once and wait.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


    ~~~~~~~~~~~~~
    We'll try using FRST to search for this

    Double click Frst64.exe to launch it.
    FRST will start to run.


    When the tool opens click Yes to the disclaimer.
    Copy/Paste or Type the following line into the Search: box.

    AdChoices


    Press the Search Registry button.
    When finished searching a log will open on your Desktop ... Search.txt
    Please post both these logs in your next reply.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  6. #16
    Member
    Join Date
    Nov 2014
    Posts
    71

    Default

    A pistol indeed. See logs attached.

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-12-2014
    Ran by Gary at 2014-12-01 20:06:38 Run:2
    Running from C:\Users\Gary\Documents\Desktop
    Loaded Profile: Gary (Available profiles: Gary)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    start
    2014-11-14 08:35 - 2014-11-14 08:45 - 00000000 ____D () C:\ProgramData\MyTurboPC.com
    2014-11-14 08:35 - 2014-11-14 08:35 - 00000000 ____D () C:\Users\Gary\AppData\Roaming\MyTurboPC.com
    c:\users\Gary\AppData\Roaming\MyTurboPC.com
    c:\programdata\MyTurboPC.com
    EmptyTemp:
    Hosts:
    End
    *****************

    C:\ProgramData\MyTurboPC.com => Moved successfully.
    C:\Users\Gary\AppData\Roaming\MyTurboPC.com => Moved successfully.
    "c:\users\Gary\AppData\Roaming\MyTurboPC.com" => File/Directory not found.
    "c:\programdata\MyTurboPC.com" => File/Directory not found.
    C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
    Hosts was reset successfully.
    EmptyTemp: => Removed 25.5 MB temporary data.


    The system needed a reboot.

    ==== End of Fixlog ====

    Farbar Recovery Scan Tool (x64) Version: 01-12-2014
    Ran by Gary at 2014-12-01 20:13:30
    Running from C:\Users\Gary\Documents\Desktop
    Boot Mode: Normal

    ================== Search Registry: "AdChoices" ===========


    ====== End Of Search ======

    Best regards,
    Gary

  7. #17
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    well phoey!

    OK, I've asked a colleague to take a peak and try to locate what I'm not finding.

    Will most likely be some time tomorrow.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  8. #18
    Member
    Join Date
    Nov 2014
    Posts
    71

    Default

    Thank you for all your help,
    Gary

    Quote Originally Posted by Juliet View Post
    well phoey!

    OK, I've asked a colleague to take a peak and try to locate what I'm not finding.

    Will most likely be some time tomorrow.

  9. #19
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    We need to disable Tea Timer.
    To temporarally close TeaTimer and restart it later:

    Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
    TeaTimer closes.
    Restart TeaTimer:
    Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
    Double click TeaTimer.exe to start it.


    If you have any complications trying to disable Tea Timer, we might have to uninstall and reinstall later.

    ~~~~~~~~~~~~~~~~~~~~~~~
    We need to temporarily uninstall Google Chrome. You have Firefox onboard to use till Google Chrome can be re-installed.

    Instructions on how to backup your Favourites/Bookmarks


    NEXT***

    Please download and install Revo Uninstaller Free
    • Double click Revo Uninstaller to run it.
    • From the list of programs double click on The Program to remove Google Chrome
    • When prompted if you want to uninstall click Yes.
    • Be sure the Moderate option is selected then click Next.
    • The program will run, If prompted again click Yes
    • when the built-in uninstaller is finished click on Next.
    • Once the program has searched for leftovers click Next.
    • Check/tick the bolded items only on the list then click Delete
    • when prompted click on Yes and then on next.
    • put a check on any folders that are found and select delete
    • when prompted select yes then on next
    • Once done click Finish.



    ~~~~~~~~~~~~~~~~~~~~~~

    Please download RogueKiller and save it to your desktop.

    You can check here if you're not sure if your computer is 32-bit or 64-bit
    • Download RogueKiller to your desktop.

    • Quit all running programs.
    • For Windows XP, double-click to start.
    • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
    • Read and accept the EULA (End User Licene Agreement)
    • Click Scan to scan the system.
    • When the scan completes Close the program > Don't Fix anything!
    • Don't run any other options, they're not all bad!!
    • Post back the report which should be located on your desktop.



    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

    Please locate SystemLook you downloaded earlier. Please delete.
    I want you to download and use a different version

    SystemLook (x64)


    • Please download SystemLook (x64) and save the file to your Desktop.
    • Right-Click SystemLook.exe / SystemLook_x64.exe and select [img=http://i.imgur.com/AVOiBNU.jpg] Run as administrator to run the programme.
    • Copy the entire contents of the codebox below and paste into the textfield.
      Code:
      :filefind
      AdChoices
      :folderfind
      AdChoices
      :regfind
      AdChoices
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt


    Please post
    RogueKiller log
    SystemLook Log
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  10. #20
    Member
    Join Date
    Nov 2014
    Posts
    71

    Default

    I don't see TeaTimer in the system tray. Should I proceed without it?
    Gary

    Quote Originally Posted by Juliet View Post
    We need to disable Tea Timer.
    To temporarally close TeaTimer and restart it later:

    Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
    TeaTimer closes.
    Restart TeaTimer:
    Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
    Double click TeaTimer.exe to start it.


    If you have any complications trying to disable Tea Timer, we might have to uninstall and reinstall later.

    ~~~~~~~~~~~~~~~~~~~~~~~
    We need to temporarily uninstall Google Chrome. You have Firefox onboard to use till Google Chrome can be re-installed.

    Instructions on how to backup your Favourites/Bookmarks


    NEXT***

    Please download and install Revo Uninstaller Free
    • Double click Revo Uninstaller to run it.
    • From the list of programs double click on The Program to remove Google Chrome
    • When prompted if you want to uninstall click Yes.
    • Be sure the Moderate option is selected then click Next.
    • The program will run, If prompted again click Yes
    • when the built-in uninstaller is finished click on Next.
    • Once the program has searched for leftovers click Next.
    • Check/tick the bolded items only on the list then click Delete
    • when prompted click on Yes and then on next.
    • put a check on any folders that are found and select delete
    • when prompted select yes then on next
    • Once done click Finish.



    ~~~~~~~~~~~~~~~~~~~~~~

    Please download RogueKiller and save it to your desktop.

    You can check here if you're not sure if your computer is 32-bit or 64-bit
    • Download RogueKiller to your desktop.

    • Quit all running programs.
    • For Windows XP, double-click to start.
    • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
    • Read and accept the EULA (End User Licene Agreement)
    • Click Scan to scan the system.
    • When the scan completes Close the program > Don't Fix anything!
    • Don't run any other options, they're not all bad!!
    • Post back the report which should be located on your desktop.



    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

    Please locate SystemLook you downloaded earlier. Please delete.
    I want you to download and use a different version

    SystemLook (x64)


    • Please download SystemLook (x64) and save the file to your Desktop.
    • Right-Click SystemLook.exe / SystemLook_x64.exe and select [img=http://i.imgur.com/AVOiBNU.jpg] Run as administrator to run the programme.
    • Copy the entire contents of the codebox below and paste into the textfield.
      Code:
      :filefind
      AdChoices
      :folderfind
      AdChoices
      :regfind
      AdChoices
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt


    Please post
    RogueKiller log
    SystemLook Log

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •