Unable to remove Scorpion Saver

7

72MonteCJ

New Member
Thread author
Nov 30, 2013
5
I have followed the 6 Steps to the letter and still get the following error when trying to Uninstall Scorpion Saver:

Could not open key:
HKEY_CURRENT_USER32\software\Wow6432Node\microsoft\windows\current version\policies\ext\CLSID. Verify that you have sufficient access to that key, or contact your support personnel
 
TwinHeadedEagle

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hi,


Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
  • Click on the Scan button.
  • After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Post logfile will also be saved in the C:\AdwCleaner folder.



Please download aswMBR and save it to your desktop.

Double click aswMBR.exe to start the tool.
  • Select Yes if prompted to download the Avast database.
  • Click Scan
  • Upon completion of the scan ( Scan finished successfully ) click Save log and save it to your desktop, and post that log in your next reply for review.
    Note: do NOT attempt any Fix yet.



Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
 
7

72MonteCJ

New Member
Thread author
Nov 30, 2013
5
Shoot, I did so much yesterday and last night that I forgot that I already had an ADWCleaner file. I will post the ones from last night and the one I just ran now. So, there will be 3 Files from adwCleaner along with the 3 attachments. Sorry for the confusion.

# AdwCleaner v3.013 - Report created 29/11/2013 at 22:24:15
# Updated 24/11/2013 by Xplode
# Operating System : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Username : Chris - CHRIS-PC
# Running from : C:\Users\Chris\Downloads\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\END
File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\adawaretb.xml
File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\search.xml
File Found : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\searchplugins\Conduit.xml
File Found : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\searchplugins\conduit-search.xml
File Found : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\searchplugins\search-the-web.xml
File Found : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\user.js
File Found : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
File Found : C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser
Folder Found : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Folder Found : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Folder Found : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Found : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Folder Found : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\{d2cf9842-af95-48cd-b873-bfbb48cd7f5e}
Folder Found C:\Program Files (x86)\Common Files\337
Folder Found C:\Program Files (x86)\Conduit
Folder Found C:\Program Files (x86)\MyPC Backup
Folder Found C:\Program Files (x86)\optimizer pro
Folder Found C:\Program Files (x86)\PC Speed Maximizer
Folder Found C:\Program Files (x86)\Toolbar Cleaner
Folder Found C:\ProgramData\apn
Folder Found C:\ProgramData\blekko toolbars
Folder Found C:\ProgramData\Conduit
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer
Folder Found C:\ProgramData\Search Protection
Folder Found C:\ProgramData\Tarma Installer
Folder Found C:\ProgramData\Trymedia
Folder Found C:\ProgramData\VisualBee
Folder Found C:\Users\Chris\AppData\Local\Conduit
Folder Found C:\Users\Chris\AppData\Local\DefineExt
Folder Found C:\Users\Chris\AppData\Local\Temp\AirInstaller
Folder Found C:\Users\Chris\AppData\Local\Temp\apn
Folder Found C:\Users\Chris\AppData\Local\Temp\WinZipper
Folder Found C:\Users\Chris\AppData\Local\visualbeeexe
Folder Found C:\Users\Chris\AppData\LocalLow\adawaretb
Folder Found C:\Users\Chris\AppData\LocalLow\AVG Security Toolbar
Folder Found C:\Users\Chris\AppData\LocalLow\Conduit
Folder Found C:\Users\Chris\AppData\LocalLow\PriceGong
Folder Found C:\Users\Chris\AppData\Roaming\337
Folder Found C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\adawaretb
Folder Found C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\CT3298581
Folder Found C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\FCTB
Folder Found C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Smartbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\AppDataLow\Software\DynConIE
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\InstalledThirdPartyPrograms
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\adawaretb
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Found : HKCU\Software\pc speed maximizer
Key Found : HKCU\Software\SmartBar
Key Found : HKCU\Software\visualbee
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\InstalledThirdPartyPrograms
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Found : [x64] HKCU\Software\pc speed maximizer
Key Found : [x64] HKCU\Software\SmartBar
Key Found : [x64] HKCU\Software\visualbee
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\Software\adawaretb
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3268934
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3291325
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3298581
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3303002
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3310511
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Desksvc
Key Found : HKLM\Software\hdcode
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adawaretb
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_963508d2
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Key Found : HKLM\Software\omigaplusSvc
Key Found : HKLM\Software\SP Global
Key Found : HKLM\Software\SProtector
Key Found : HKLM\Software\Toolbar Cleaner
Key Found : HKLM\Software\V9
Key Found : HKLM\Software\visualbee
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : [x64] HKLM\SOFTWARE\DomaIQ
Key Found : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Found : [x64] HKLM\SOFTWARE\Tarma Installer
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Search Protection]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16520


-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\prefs.js ]

Line Found : user_pref("CT3268934.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3268934.FirstTime", "true");
Line Found : user_pref("CT3268934.FirstTimeFF3", "true");
Line Found : user_pref("CT3268934.LoginRevertSettingsEnabled", true);
Line Found : user_pref("CT3268934.RevertSettingsEnabled", true);
Line Found : user_pref("CT3268934.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Found : user_pref("CT3268934.UserID", "UN30719686266778296");
Line Found : user_pref("CT3268934.addressBarTakeOverEnabledInHidden", "true");
Line Found : user_pref("CT3268934.browser.search.defaultthis.engineName", true);
Line Found : user_pref("CT3268934.defaultSearch", "true");
Line Found : user_pref("CT3268934.enableAlerts", "always");
Line Found : user_pref("CT3268934.enableSearchFromAddressBar", "true");
Line Found : user_pref("CT3268934.firstTimeDialogOpened", "true");
Line Found : user_pref("CT3268934.fixPageNotFoundError", "true");
Line Found : user_pref("CT3268934.fixPageNotFoundErrorInHidden", "true");
Line Found : user_pref("CT3268934.fixUrls", true);
Line Found : user_pref("CT3268934.installId", "conduitinstaller.exe");
Line Found : user_pref("CT3268934.installType", "conduitnsisintegration");
Line Found : user_pref("CT3268934.isCheckedStartAsHidden", true);
Line Found : user_pref("CT3268934.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3268934.isFirstTimeToolbarLoading", "false");
Line Found : user_pref("CT3268934.isNewTabEnabled", true);
Line Found : user_pref("CT3268934.isPerformedSmartBarTransition", "true");
Line Found : user_pref("CT3268934.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Line Found : user_pref("CT3268934.keyword", true);
Line Found : user_pref("CT3268934.migrateAppsAndComponents", true);
Line Found : user_pref("CT3268934.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fmilwaukee.craigslist.org%2F\",\"EB_MAIN_FRAME_TITLE\":\"craigslist%3A%20milwaukee%20classifi[...]
Line Found : user_pref("CT3268934.openThankYouPage", "false");
Line Found : user_pref("CT3268934.openUninstallPage", "true");
Line Found : user_pref("CT3268934.revertSettingsEnabled", "TRUE");
Line Found : user_pref("CT3268934.searchInNewTabEnabledInHidden", "true");
Line Found : user_pref("CT3268934.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3268934.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Line Found : user_pref("CT3268934.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Line Found : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3268934\"}");
Line Found : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://Vgrabberv11.OurToolbar.com//xpi\"}");
Line Found : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Vgrabber v1\"}");
Line Found : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3268934.serviceLayer_services_login_10.13.40.15_lastUpdate", "1383095475085");
Line Found : user_pref("CT3268934.serviceLayer_services_serviceMap_lastUpdate", "1383080904694");
Line Found : user_pref("CT3268934.serviceLayer_services_toolbarSettings_lastUpdate", "1383102674634");
Line Found : user_pref("CT3268934.serviceLayer_services_translation_lastUpdate", "1383080905116");
Line Found : user_pref("CT3268934.settingsINI", true);
Line Found : user_pref("CT3268934.shouldFirstTimeDialog", "false");
Line Found : user_pref("CT3268934.smartbar.CTID", "CT3268934");
Line Found : user_pref("CT3268934.smartbar.Uninstall", "0");
Line Found : user_pref("CT3268934.smartbar.homepage", true);
Line Found : user_pref("CT3268934.smartbar.toolbarName", "Vgrabber v1 ");
Line Found : user_pref("CT3268934.startPage", "userChanged");
Line Found : user_pref("CT3268934.toolbarBornServerTime", "10-10-2013");
Line Found : user_pref("CT3268934.toolbarCurrentServerTime", "30-10-2013");
Line Found : user_pref("CT3268934.toolbarDisabled", "true");
Line Found : user_pref("CT3268934_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1383105536251,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Found : user_pref("CT3298581.FF19Solved", "true");
Line Found : user_pref("CT3298581.UserID", "UN19385342612703755");
Line Found : user_pref("CT3298581.browser.search.defaultthis.engineName", "true");
Line Found : user_pref("CT3298581.fullUserID", "UN19385342612703755.IN.20131029194624");
Line Found : user_pref("CT3298581.installDate", "29/10/2013 19:46:25");
Line Found : user_pref("CT3298581.installSessionId", "{D4C300B9-B088-43C9-AA10-CFDA8C1D9D92}");
Line Found : user_pref("CT3298581.installSp", "TRUE");
Line Found : user_pref("CT3298581.installerVersion", "1.8.0.14");
Line Found : user_pref("CT3298581.keyword", "true");
Line Found : user_pref("CT3298581.originalHomepage", "www.google.com");
Line Found : user_pref("CT3298581.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Found : user_pref("CT3298581.originalSearchEngine", "Vgrabber v1 Customized Web Search");
Line Found : user_pref("CT3298581.originalSearchEngineName", "Vgrabber v1 Customized Web Search");
Line Found : user_pref("CT3298581.searchRevert", "false");
Line Found : user_pref("CT3298581.searchUserMode", "2");
Line Found : user_pref("CT3298581.smartbar.homepage", "true");
Line Found : user_pref("CT3298581.toolbarInstallDate", "29-10-2013 19:46:24");
Line Found : user_pref("CT3298581.versionFromInstaller", "10.21.1.7");
Line Found : user_pref("CT3298581.xpeMode", "0");
Line Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3298581&octid=CT3298581&SearchSource=61&CUI=UN19385342612703755&UM=2&UP=SP4EF16A64-09AB-494E-81CF-3D730F318E9E");
Line Found : user_pref("Smartbar.ConduitSearchEngineList", "Vgrabber v1 Customized Web Search");
Line Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Found : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3268934");
Line Found : user_pref("aol_toolbar.default.homepage.check", false);
Line Found : user_pref("aol_toolbar.default.search.check", false);
Line Found : user_pref("browser.search.defaultthis.engineName", "MixiDJ V45 Customized Web Search");
Line Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298581&CUI=UN19385342612703755&UM=2&SearchSource=3&q={searchTerms}");
Line Found : user_pref("extensions.A8qNh2.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self==window.top){var script=document.createElement('script');script.ty[...]
Line Found : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Found : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Found : user_pref("extensions.crossrider.bic", "142064abb3ee4e761db8856b38687c13");
Line Found : user_pref("extensions.dynconff.cache.espn.go.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\">\r\n <newjs>\r\[...]
Line Found : user_pref("extensions.dynconff.cache.malwaretips.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\">\r\n <newjs[...]
Line Found : user_pref("extensions.dynconff.cache.udmserve.net.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\">\r\n <newjs>\r[...]
Line Found : user_pref("extensions.dynconff.cache.www.amazon.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1121_1524_1146_1169_1540_1120_1348_1474_1482_1493_1521\"><content id=\"MB_P1[...]
Line Found : user_pref("extensions.dynconff.cache.www.christmastreemarket.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\"[...]
Line Found : user_pref("smartbar.addressBarOwnerCTID", "CT3298581");
Line Found : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3291325&octid=CT3291325&SearchSource=61&CUI=UN29917917122562726&UM=2&UP=SP1AEF249B-6D98-46EA-B058-F0615AB3871C,hxxp://searc[...]
Line Found : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=,hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298581&Search[...]
Line Found : user_pref("smartbar.defaultSearchOwnerCTID", "CT3298581");
Line Found : user_pref("smartbar.homePageOwnerCTID", "CT3298581");
Line Found : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3268934&SearchSource=13&CUI=SB_CUI&UP=SP1AEF249B-6D98-46EA-B058-F0615AB3871C");
Line Found : user_pref("smartbar.originalSearchAddressUrl", false);
Line Found : user_pref("smartbar.originalSearchEngine", false);
Line Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Found : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Found : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Found : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v

[ File : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : search_url
Found : keyword
Found : search_url
Found : search_url

*************************

AdwCleaner[R0].txt - [19658 octets] - [29/11/2013 22:24:15]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [19719 octets] ##########

# AdwCleaner v3.013 - Report created 29/11/2013 at 22:25:05
# Updated 24/11/2013 by Xplode
# Operating System : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Username : Chris - CHRIS-PC
# Running from : C:\Users\Chris\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

[!] Folder Deleted : C:\ProgramData\apn
[!] Folder Deleted : C:\ProgramData\blekko toolbars
[!] Folder Deleted : C:\ProgramData\Conduit
[!] Folder Deleted : C:\ProgramData\Search Protection
[!] Folder Deleted : C:\ProgramData\Tarma Installer
[!] Folder Deleted : C:\ProgramData\Trymedia
[!] Folder Deleted : C:\ProgramData\VisualBee
[!] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer
[!] Folder Deleted : C:\Program Files (x86)\Conduit
[!] Folder Deleted : C:\Program Files (x86)\MyPC Backup
[!] Folder Deleted : C:\Program Files (x86)\optimizer pro
[!] Folder Deleted : C:\Program Files (x86)\PC Speed Maximizer
[!] Folder Deleted : C:\Program Files (x86)\Toolbar Cleaner
[!] Folder Deleted : C:\Program Files (x86)\Common Files\337
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Conduit
[!] Folder Deleted : C:\Users\Chris\AppData\Local\DefineExt
[!] Folder Deleted : C:\Users\Chris\AppData\Local\visualbeeexe
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Temp\AirInstaller
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Temp\apn
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Temp\WinZipper
[!] Folder Deleted : C:\Users\Chris\AppData\LocalLow\adawaretb
[!] Folder Deleted : C:\Users\Chris\AppData\LocalLow\AVG Security Toolbar
[!] Folder Deleted : C:\Users\Chris\AppData\LocalLow\Conduit
[!] Folder Deleted : C:\Users\Chris\AppData\LocalLow\PriceGong
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\337
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\adawaretb
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\FCTB
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Smartbar
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\CT3298581
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[!] Folder Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\{d2cf9842-af95-48cd-b873-bfbb48cd7f5e}
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
[!] Folder Deleted : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
File Deleted : C:\END
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\adawaretb.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\searchplugins\Conduit.xml
File Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\searchplugins\conduit-search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\search.xml
File Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\searchplugins\search-the-web.xml
File Deleted : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\user.js
File Deleted : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
File Deleted : C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Search Protection]
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_963508d2
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3268934
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3291325
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298581
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3303002
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3310511
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\InstalledThirdPartyPrograms
Key Deleted : HKCU\Software\pc speed maximizer
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKCU\Software\visualbee
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\DynConIE
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\adawaretb
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Desksvc
Key Deleted : HKLM\Software\hdcode
Key Deleted : HKLM\Software\omigaplusSvc
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\Toolbar Cleaner
Key Deleted : HKLM\Software\V9
Key Deleted : HKLM\Software\visualbee
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adawaretb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\adawaretb
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Key Deleted : [x64] HKLM\SOFTWARE\DomaIQ
Key Deleted : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16520


-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\prefs.js ]

Line Deleted : user_pref("CT3268934.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3268934.FirstTime", "true");
Line Deleted : user_pref("CT3268934.FirstTimeFF3", "true");
Line Deleted : user_pref("CT3268934.LoginRevertSettingsEnabled", true);
Line Deleted : user_pref("CT3268934.RevertSettingsEnabled", true);
Line Deleted : user_pref("CT3268934.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Deleted : user_pref("CT3268934.UserID", "UN30719686266778296");
Line Deleted : user_pref("CT3268934.addressBarTakeOverEnabledInHidden", "true");
Line Deleted : user_pref("CT3268934.browser.search.defaultthis.engineName", true);
Line Deleted : user_pref("CT3268934.defaultSearch", "true");
Line Deleted : user_pref("CT3268934.enableAlerts", "always");
Line Deleted : user_pref("CT3268934.enableSearchFromAddressBar", "true");
Line Deleted : user_pref("CT3268934.firstTimeDialogOpened", "true");
Line Deleted : user_pref("CT3268934.fixPageNotFoundError", "true");
Line Deleted : user_pref("CT3268934.fixPageNotFoundErrorInHidden", "true");
Line Deleted : user_pref("CT3268934.fixUrls", true);
Line Deleted : user_pref("CT3268934.installId", "conduitinstaller.exe");
Line Deleted : user_pref("CT3268934.installType", "conduitnsisintegration");
Line Deleted : user_pref("CT3268934.isCheckedStartAsHidden", true);
Line Deleted : user_pref("CT3268934.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3268934.isFirstTimeToolbarLoading", "false");
Line Deleted : user_pref("CT3268934.isNewTabEnabled", true);
Line Deleted : user_pref("CT3268934.isPerformedSmartBarTransition", "true");
Line Deleted : user_pref("CT3268934.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Line Deleted : user_pref("CT3268934.keyword", true);
Line Deleted : user_pref("CT3268934.migrateAppsAndComponents", true);
Line Deleted : user_pref("CT3268934.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fmilwaukee.craigslist.org%2F\",\"EB_MAIN_FRAME_TITLE\":\"craigslist%3A%20milwaukee%20classifi[...]
Line Deleted : user_pref("CT3268934.openThankYouPage", "false");
Line Deleted : user_pref("CT3268934.openUninstallPage", "true");
Line Deleted : user_pref("CT3268934.revertSettingsEnabled", "TRUE");
Line Deleted : user_pref("CT3268934.searchInNewTabEnabledInHidden", "true");
Line Deleted : user_pref("CT3268934.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3268934\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://Vgrabberv11.OurToolbar.com//xpi\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Vgrabber v1\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3268934.serviceLayer_services_login_10.13.40.15_lastUpdate", "1383095475085");
Line Deleted : user_pref("CT3268934.serviceLayer_services_serviceMap_lastUpdate", "1383080904694");
Line Deleted : user_pref("CT3268934.serviceLayer_services_toolbarSettings_lastUpdate", "1383102674634");
Line Deleted : user_pref("CT3268934.serviceLayer_services_translation_lastUpdate", "1383080905116");
Line Deleted : user_pref("CT3268934.settingsINI", true);
Line Deleted : user_pref("CT3268934.shouldFirstTimeDialog", "false");
Line Deleted : user_pref("CT3268934.smartbar.CTID", "CT3268934");
Line Deleted : user_pref("CT3268934.smartbar.Uninstall", "0");
Line Deleted : user_pref("CT3268934.smartbar.homepage", true);
Line Deleted : user_pref("CT3268934.smartbar.toolbarName", "Vgrabber v1 ");
Line Deleted : user_pref("CT3268934.startPage", "userChanged");
Line Deleted : user_pref("CT3268934.toolbarBornServerTime", "10-10-2013");
Line Deleted : user_pref("CT3268934.toolbarCurrentServerTime", "30-10-2013");
Line Deleted : user_pref("CT3268934.toolbarDisabled", "true");
Line Deleted : user_pref("CT3268934_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1383105536251,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CT3298581.FF19Solved", "true");
Line Deleted : user_pref("CT3298581.UserID", "UN19385342612703755");
Line Deleted : user_pref("CT3298581.browser.search.defaultthis.engineName", "true");
Line Deleted : user_pref("CT3298581.fullUserID", "UN19385342612703755.IN.20131029194624");
Line Deleted : user_pref("CT3298581.installDate", "29/10/2013 19:46:25");
Line Deleted : user_pref("CT3298581.installSessionId", "{D4C300B9-B088-43C9-AA10-CFDA8C1D9D92}");
Line Deleted : user_pref("CT3298581.installSp", "TRUE");
Line Deleted : user_pref("CT3298581.installerVersion", "1.8.0.14");
Line Deleted : user_pref("CT3298581.keyword", "true");
Line Deleted : user_pref("CT3298581.originalHomepage", "www.google.com");
Line Deleted : user_pref("CT3298581.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Deleted : user_pref("CT3298581.originalSearchEngine", "Vgrabber v1 Customized Web Search");
Line Deleted : user_pref("CT3298581.originalSearchEngineName", "Vgrabber v1 Customized Web Search");
Line Deleted : user_pref("CT3298581.searchRevert", "false");
Line Deleted : user_pref("CT3298581.searchUserMode", "2");
Line Deleted : user_pref("CT3298581.smartbar.homepage", "true");
Line Deleted : user_pref("CT3298581.toolbarInstallDate", "29-10-2013 19:46:24");
Line Deleted : user_pref("CT3298581.versionFromInstaller", "10.21.1.7");
Line Deleted : user_pref("CT3298581.xpeMode", "0");
Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3298581&octid=CT3298581&SearchSource=61&CUI=UN19385342612703755&UM=2&UP=SP4EF16A64-09AB-494E-81CF-3D730F318E9E");
Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Vgrabber v1 Customized Web Search");
Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=");
Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3268934");
Line Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Line Deleted : user_pref("aol_toolbar.default.search.check", false);
Line Deleted : user_pref("browser.search.defaultthis.engineName", "MixiDJ V45 Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298581&CUI=UN19385342612703755&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("extensions.A8qNh2.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self==window.top){var script=document.createElement('script');script.ty[...]
Line Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Deleted : user_pref("extensions.crossrider.bic", "142064abb3ee4e761db8856b38687c13");
Line Deleted : user_pref("extensions.dynconff.cache.espn.go.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\">\r\n <newjs>\r\[...]
Line Deleted : user_pref("extensions.dynconff.cache.malwaretips.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\">\r\n <newjs[...]
Line Deleted : user_pref("extensions.dynconff.cache.udmserve.net.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\">\r\n <newjs>\r[...]
Line Deleted : user_pref("extensions.dynconff.cache.www.amazon.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1121_1524_1146_1169_1540_1120_1348_1474_1482_1493_1521\"><content id=\"MB_P1[...]
Line Deleted : user_pref("extensions.dynconff.cache.www.christmastreemarket.com.content", "<package expire=\"3600\" es=\"914\" pcdids=\"_1520_1674_1164_1524_1146_1169_1540_1348_1482_1493_1521\"><content id=\"MB_P1\"[...]
Line Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3298581");
Line Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3291325&octid=CT3291325&SearchSource=61&CUI=UN29917917122562726&UM=2&UP=SP1AEF249B-6D98-46EA-B058-F0615AB3871C,hxxp://searc[...]
Line Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3268934&SearchSource=2&CUI=SB_CUI&q=,hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298581&Search[...]
Line Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3298581");
Line Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3298581");
Line Deleted : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3268934&SearchSource=13&CUI=SB_CUI&UP=SP1AEF249B-6D98-46EA-B058-F0615AB3871C");
Line Deleted : user_pref("smartbar.originalSearchAddressUrl", false);
Line Deleted : user_pref("smartbar.originalSearchEngine", false);
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v

[ File : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : search_url
Deleted : keyword

*************************

AdwCleaner[R0].txt - [19864 octets] - [29/11/2013 22:24:15]
AdwCleaner[S0].txt - [19824 octets] - [29/11/2013 22:25:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [19885 octets] ##########

# AdwCleaner v3.013 - Report created 30/11/2013 at 08:57:21
# Updated 24/11/2013 by Xplode
# Operating System : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Username : Chris - CHRIS-PC
# Running from : C:\Users\Chris\Downloads\AdwCleaner(1).exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16520


-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [19864 octets] - [29/11/2013 22:24:15]
AdwCleaner[R1].txt - [1020 octets] - [30/11/2013 08:56:38]
AdwCleaner[S0].txt - [19998 octets] - [29/11/2013 22:25:05]
AdwCleaner[S1].txt - [943 octets] - [30/11/2013 08:57:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1002 octets] ##########
 

Attachments

  • FRST.txt
    39.9 KB · Views: 112
  • Addition.txt
    24.3 KB · Views: 103
  • aswMBR.txt
    477 bytes · Views: 75
7

72MonteCJ

New Member
Thread author
Nov 30, 2013
5
This should do it:

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-12-01 17:34:26
-----------------------------
17:34:26.595 OS Version: Windows x64 6.0.6002 Service Pack 2
17:34:26.596 Number of processors: 2 586 0x1706
17:34:26.596 ComputerName: CHRIS-PC UserName: Chris
17:34:29.078 Initialize success
17:34:46.205 AVAST engine defs: 13113000
17:34:53.583 The log file has been saved successfully to "C:\Users\Chris\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-12-01 17:34:26
-----------------------------
17:34:26.595 OS Version: Windows x64 6.0.6002 Service Pack 2
17:34:26.596 Number of processors: 2 586 0x1706
17:34:26.596 ComputerName: CHRIS-PC UserName: Chris
17:34:29.078 Initialize success
17:34:46.205 AVAST engine defs: 13113000
17:34:53.583 The log file has been saved successfully to "C:\Users\Chris\Desktop\aswMBR.txt"
17:34:59.416 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-4
17:34:59.419 Disk 0 Vendor: SAMSUNG_HD642JJ 1AA01113 Size: 610480MB BusType: 3
17:34:59.573 Disk 0 MBR read successfully
17:34:59.576 Disk 0 MBR scan
17:34:59.621 Disk 0 Windows VISTA default MBR code
17:34:59.640 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
17:34:59.728 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 15360 MB offset 129024
17:34:59.765 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 595056 MB offset 31586304
17:34:59.879 Disk 0 scanning C:\Windows\system32\drivers
17:35:20.875 Service scanning
17:35:47.643 Modules scanning
17:35:47.649 Disk 0 trace - called modules:
17:35:47.994 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys ataport.SYS pciide.sys
17:35:48.004 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800573b790]
17:35:48.009 3 CLASSPNP.SYS[fffffa6000dccc33] -> nt!IofCallDriver -> [0xfffffa80048b8520]
17:35:48.013 5 acpi.sys[fffffa60008dffde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-4[0xfffffa80048a44b0]
17:35:51.241 AVAST engine scan C:\Windows
17:36:20.059 AVAST engine scan C:\Windows\system32
17:44:17.157 AVAST engine scan C:\Windows\system32\drivers
17:45:22.771 AVAST engine scan C:\Users\Chris
18:23:06.958 Disk 0 MBR has been saved successfully to "C:\Users\Chris\Desktop\MBR.dat"
18:23:07.032 The log file has been saved successfully to "C:\Users\Chris\Desktop\aswMBR.txt"
 
TwinHeadedEagle

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.
 

Attachments

  • fixlist.txt
    1.9 KB · Views: 152
7

72MonteCJ

New Member
Thread author
Nov 30, 2013
5
When I click on the file you attached for me to save I get a new IE tab with this on it:

FF Extension: iZc - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\iZc@nplusc.xe.cx.xpi
FF Extension: No Name - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\{c7b3cf78-9cbc-47b9-ba47-bb84a56069dd}.xpi
C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\iZc@nplusc.xe.cx.xpi
C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\d1eq0g20.default\Extensions\{c7b3cf78-9cbc-47b9-ba47-bb84a56069dd}.xpi
FF Extension: WordOv - C:\Program Files (x86)\Mozilla Firefox\extensions\jzkenlkaloil@kctewplunsmgzuca.org
C:\Program Files (x86)\Mozilla Firefox\extensions\jzkenlkaloil@kctewplunsmgzuca.org
CHR HKLM-x32\...\Chrome\Extension: [iehjklkgijkjfcfmmjmjlmcccholamaf] - C:\Users\Chris\AppData\Local\CRE\iehjklkgijkjfcfmmjmjlmcccholamaf.crx
C:\Users\Chris\AppData\Local\CRE\iehjklkgijkjfcfmmjmjlmcccholamaf.crx
CHR HKLM-x32\...\Chrome\Extension: [dlaidocmldibgopdbjiopphnjhaehnbn] - C:\Users\Chris\AppData\Local\CRE\dlaidocmldibgopdbjiopphnjhaehnbn.crx
C:\Users\Chris\AppData\Local\CRE\dlaidocmldibgopdbjiopphnjhaehnbn.crx
C:\Users\Chris\CTX.DAT
cmd: ipconfig /flushdns
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {E29B42D8-163F-4B4A-AA63-3DBAB8000293} - System32\Tasks\BrowserSafeguard Update Task => C:\Program Files (x86)\Browsersafeguard\uninstall.browsersafeguard.exe <==== ATTENTION
C:\Program Files (x86)\Browsersafeguard
AlternateDataStreams: C:\ProgramData\TEMP:14FFC1B9
AlternateDataStreams: C:\ProgramData\TEMP:5D432CE3
AlternateDataStreams: C:\ProgramData\TEMP:6EE8565A
AlternateDataStreams: C:\ProgramData\TEMP:743A8968
AlternateDataStreams: C:\ProgramData\TEMP:C78DADEA
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
AlternateDataStreams: C:\ProgramData\TEMP:DBC3D477
AlternateDataStreams: C:\Users\Chris\Fwd_ When to cancel your wife's gym membership! ! !.eml:OECustomProperty
 

Similar threads

D
  • Locked
can't remove DodoIneptus
Replies
5
Views
408
Windows Malware Removal Help & Support
nasdaq
nasdaq
D
  • Locked
Unable to remove malware extension in chrome/managed by an organisation
Replies
3
Views
518
Windows Malware Removal Help & Support
nasdaq
nasdaq
L
  • Locked
Unable to remove malware extension in chrome
Replies
2
Views
1,179
Windows Malware Removal Help & Support
nasdaq
nasdaq

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

Quick Navigation

Forum Rules Warning System Welcome Guide Two-factor Authentication

User Menu

Login

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top