yikes, your system is heavily infected.
Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as
fixlist.txt
NOTE. It's important that both files,
FRST/FRST64 and
fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow)
start
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found
AppInit_DLLs-x32: c:\progra~2\browse~1\sprote~1.dll => "c:\progra~2\browse~1\sprote~1.dll" File Not Found
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKLM-x32 - DefaultScope {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {01bd49d7-c76b-4310-8beb-14d7e5f322c6} URL = http://search.easylifeapp.com/?q={searchTerms}&pid=388&src=ie2&r=2013/05/12&hid=3446745559&lg=EN&cc=US
SearchScopes: HKLM-x32 - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {01bd49d7-c76b-4310-8beb-14d7e5f322c6} URL = http://search.easylifeapp.com/?q={searchTerms}&pid=388&src=ie2&r=2013/05/12&hid=3446745559&lg=EN&cc=US
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF NewTab: hxxp://search.conduit.com/?ctid=CT3319733&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPC00D18AC-2904-4750-B950-0949C7CAC3CF
FF SearchEngineOrder.1: EasyLife
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "EasyLife");: user_pref("browser.search.order.1,S", "EasyLife");
FF Homepage: google.com
FF Keyword.URL: hxxp://search.easylifeapp.com/?pid=388&src=ff2&r=2013/05/12&hid=3446745559&lg=EN&cc=US&l=1&q=
FF user.js: detected! => C:\Users\talon\AppData\Roaming\Mozilla\Firefox\Profiles\lv532xay.default\user.js
FF SearchPlugin: C:\Users\talon\AppData\Roaming\Mozilla\Firefox\Profiles\lv532xay.default\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: Conduit Engine - C:\Users\talon\AppData\Roaming\Mozilla\Firefox\Profiles\lv532xay.default\Extensions\engine@conduit.com [2011-05-09]
CHR HomePage: http:\/\/search.conduit.com\/?ctid=CT3319733&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPC00D18AC-2904-4750-B950-0949C7CAC3CF&SSPV=
CHR StartupUrls: "hxxp://search.conduit.com/?ctid=CT3319733&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPC00D18AC-2904-4750-B950-0949C7CAC3CF&SSPV="
CHR DefaultSearchKeyword: trovi.search
CHR DefaultSearchURL: http:\/\/search.conduit.com\/Results.aspx?gd=&ctid=CT3319733&octid=EB_ORIGINAL_CTID&ISID=&SearchSource=58&CUI=&UM=5&UP=SPC00D18AC-2904-4750-B950-0949C7CAC3CF&q={searchTerms}&SSPV=CHR DefaultNewTabURL:
CHR Extension: (Extutil) - C:\Users\talon\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-01-28]
CHR Extension: (Managera) - C:\Users\talon\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-01-28]
CHR HKLM-x32\...\Chrome\Extension: [dhdepfaagokllfmhfbcfmocaeigmoebo] - C:\Users\talon\AppData\Local\Savings Sidekick\Chrome\Savings Sidekick.crx [2013-10-03]
C:\Users\talon\AppData\Local\Temp\6_Offer_15.exe
C:\Users\talon\AppData\Local\Temp\ApplicationUpdate.Client.dll
C:\Users\talon\AppData\Local\Temp\DM.exe
C:\Users\talon\AppData\Local\Temp\drm_dyndata_7380015.dll
C:\Users\talon\AppData\Local\Temp\Gw2.exe
C:\Users\talon\AppData\Local\Temp\ICReinstall_Setup.exe
C:\Users\talon\AppData\Local\Temp\nscA614.exe
C:\Users\talon\AppData\Local\Temp\nsdA8D4.exe
C:\Users\talon\AppData\Local\Temp\nseAB94.exe
C:\Users\talon\AppData\Local\Temp\nspF986.exe
C:\Users\talon\AppData\Local\Temp\nsrFC47.exe
C:\Users\talon\AppData\Local\Temp\nssFF07.exe
C:\Users\talon\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\talon\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\talon\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\talon\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\talon\AppData\Local\Temp\nvStInst.exe
C:\Users\talon\AppData\Local\Temp\ose00000.exe
C:\Users\talon\AppData\Local\Temp\patcher_lib.dll
C:\Users\talon\AppData\Local\Temp\patcher_update.exe
C:\Users\talon\AppData\Local\Temp\rootsupd.exe
C:\Users\talon\AppData\Local\Temp\SearchProtectINT.exe
C:\Users\talon\AppData\Local\Temp\Shockwave_Installer_FF.exe
C:\Users\talon\AppData\Local\Temp\TempRealCharacterBuilderUpdater.exe
C:\Users\talon\AppData\Local\Temp\UNINSTALLER-6352.exe
C:\Users\talon\AppData\Local\Temp\vcredist_x64.exe
Savings Sidekick (HKLM-x32\...\Savings Sidekick) (Version: 1.18.149.149 - 215 Apps) <==== ATTENTION
end
Run
FRST/FRST64 and press the
Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
****************
AdwCleaner by Xplode
Click on this link to download :
ADWCleaner
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your
desktop.
Do not click on any links in the top Advertisment.
Close all open windows and browsers.
- Right click the AdwCleaner icon
on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
*****
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
- NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.
************************
Please download
Malwarebytes Anti-Malware to your desktop
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
Install the progamme and select
update
Once it has updated select
Settings >
Detection and Protection
Tick
Scan for rootkits
Go back to the Dashboard and select
Threat Scan and then click on Scan Now
If threats are detected, click the Apply Actions button, MBAM will ask for a reboot.
On completion of the scan (or after the reboot) select
View Detailed Log
Select
Export > Select text file and save to the desktop
Attach/Post that log
Please post:
fixlist.txt
C:\AdwCleaner.txt
MBAM log
may need to make multiple post.
