Solved Coupons

joshcoupon · Dec 1, 2014

Got this problem after installing a script program called celtx. Also had Obrana installed but I think i've gotten rid of that.

argus · Dec 2, 2014

Helllo,

Before we begin, please note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The logs can take some time to research, so please be patient with me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

Right-click on

icon and select

Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on

icon and select

Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

Code:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

joshcoupon · Dec 2, 2014

Zoek.exe v5.0.0.0 Updated 29-11-2014
Tool run by josh on 02-Dec-14 at 15:54:47.78.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\josh\Desktop\zoek.exe.scr [Scan all users] [Script inserted]

==== System Restore Info ======================

02-Dec-14 3:59:20 PM Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\PROGRA~2\AGEIA Technologies deleted successfully
C:\PROGRA~2\Hi-Rez Studios deleted successfully
C:\PROGRA~2\Pando Networks deleted successfully
C:\PROGRA~2\R.G. Games deleted successfully
C:\PROGRA~2\Razer deleted successfully
C:\PROGRA~2\Wondershare deleted successfully
C:\PROGRA~2\COMMON~1\Blizzard Entertainment deleted successfully
C:\Program Files\ATI Technologies deleted successfully
C:\PROGRA~3\Oracle deleted successfully
C:\Users\josh\AppData\Roaming\Awesomium deleted successfully
C:\Users\josh\AppData\Roaming\GetRightToGo deleted successfully
C:\Users\josh\AppData\Roaming\Opera deleted successfully
C:\Users\josh\AppData\Local\Opera deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vToolbarUpdater3.2.0 deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\vToolbarUpdater3.2.0 deleted successfully

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\Users\josh\.android deleted
C:\PROGRA~2\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml deleted
C:\PROGRA~2\COMMON~1\Wondershare deleted
C:\found.000 deleted
C:\Users\josh\AppData\Roaming\Wondershare deleted
C:\PROGRA~3\AVG Web TuneUp deleted
C:\PROGRA~3\AVG Security Toolbar deleted
C:\PROGRA~3\AVG Secure Search deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\josh\AppData\Local\Wondershare deleted
C:\Users\josh\AppData\Local\cache deleted
C:\Users\josh\AppData\LocalLow\AVG Web TuneUp deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Web TuneUp deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Nation toolbar deleted
C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default\searchplugins\avg-secure-search.xml deleted
C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default\jetpack deleted
C:\Users\josh\AppData\Local\TempFullTiltUkSetup.exe deleted
"C:\PROGRA~2\AVG Web TuneUp\vprot.exe" deleted
"C:\PROGRA~2\COMMON~1\AVG Secure Search\vToolbarUpdater\3.2.0\log4cplusU.dll" deleted
"C:\PROGRA~2\AVG Web TuneUp" deleted
"C:\PROGRA~2\COMMON~1\AVG Secure Search" deleted
"C:\PROGRA~2\COMMON~1\AVG Secure Search\vToolbarUpdater" deleted
"C:\PROGRA~2\COMMON~1\AVG Secure Search\vToolbarUpdater\3.2.0" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\josh\AppData\Roaming\Greyfirst\Celtx\Profiles\oxp2gpge.default
- Undetermined - C:\Program Files (x86)\Celtx\extensions\calendar-timezones@mozilla.org
- Undetermined - C:\Program Files (x86)\Celtx\extensions\default-palette@celtx.com
- Undetermined - C:\Program Files (x86)\Celtx\extensions\emoticons-msn-smileys@m513901.de
- Undetermined - C:\Program Files (x86)\Celtx\extensions\inspector@mozilla.org
- Undetermined - C:\Program Files (x86)\Celtx\extensions\messagestyle-blackened@addons.instantbird.org
- Undetermined - C:\Program Files (x86)\Celtx\extensions\messagestyle-depth@addons.instantbird.org
- Undetermined - C:\Program Files (x86)\Celtx\extensions\messagestyle-minimal20@addons.instantbird.org

ProfilePath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default
- Undetermined - exif_viewer@mozilla.doslash.org
- Undetermined - tineye@ideeinc.com
- AVG Web TuneUp - %ProfilePath%\extensions\avg@toolbar
- Exif Viewer - %ProfilePath%\extensions\exif_viewer@mozilla.doslash.org.xpi
- Reddit Enhancement Suite - %ProfilePath%\extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi
- TinEye Reverse Image Search - %ProfilePath%\extensions\tineye@ideeinc.com.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default
F6D12679B9112358AC705A1308156F59 - C:\Users\josh\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player
0C8597DBC74AAF5179471BA013E3C6B4 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director

==== Deleted Firefox Extensions ======================

C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default\extensions\avg@toolbar deleted

==== Chromium Look ======================

Google Voice Search Hotword (Beta) - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
AdBlock - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Google Dictionary (by Google) - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja
GrammarBase - Web Grammar Checker - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\plklmneddckmpnnkjldofmaegchjmoea

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyServer"="http=127.0.0.1:9881;https=127.0.0.1:9881"
"ProxyOverride"="<local>"
"ProxyEnable"=dword:00000001

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\SOE-C:/Users/josh/AppData/Local/Sony Online Entertainment/ApplicationUpdater deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\josh\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\josh\AppData\Local\Mozilla\Firefox\Profiles\sshboobq.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\josh\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=465 folders=243 135348568 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\josh\AppData\Local\Temp will be emptied at reboot
C:\Users\postgres\AppData\Local\Temp emptied successfully
C:\Users\postgres.josh-PC\AppData\Local\Temp emptied successfully
C:\Users\POSTGR~1.JOS\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\josh\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 02-Dec-14 at 16:26:55.43 ======================

argus · Dec 2, 2014

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on

icon and select

Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

Code:

default-palette@celtx.com;ff
emoticons-msn-smileys@m513901.de;ff
inspector@mozilla.org;ff
messagestyle-blackened@addons.instantbird.org;ff
messagestyle-depth@addons.instantbird.org;ff
messagestyle-minimal20@addons.instantbird.org;ff
C:\Program Files (x86)\Celtx;fs
C:\Users\josh\AppData\Roaming\Greyfirst\Celtx;fs
createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

joshcoupon · Dec 2, 2014

Zoek.exe v5.0.0.0 Updated 29-11-2014
Tool run by josh on 02-Dec-14 at 17:30:09.68.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\josh\Desktop\zoek.exe.scr [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-12-02-162655.log 8999 bytes

==== System Restore Info ======================

02-Dec-14 5:33:26 PM Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\josh\AppData\Roaming\Greyfirst\Celtx\Profiles\oxp2gpge.default

user.js not found
---- Lines default-palette@celtx.com modified from prefs.js ----

user_pref("extensions.enabledItems", "calendar-timezones@mozilla.org:0.1.2008d,default-palette@celtx.com:1.0,emoticons-msn-smileys@m513901.de:0.1,insp
---- Lines emoticons-msn-smileys@m513901.de modified from prefs.js ----

user_pref("extensions.enabledItems", "calendar-timezones@mozilla.org:0.1.2008d,disabled:1.0,emoticons-msn-smileys@m513901.de:0.1,inspector@mozilla.org
---- Lines inspector@mozilla.org modified from prefs.js ----

user_pref("extensions.enabledItems", "calendar-timezones@mozilla.org:0.1.2008d,disabled:1.0,disabled:0.1,inspector@mozilla.org:2.0.0,messagestyle-blac
---- Lines messagestyle-blackened@addons.instantbird.org modified from prefs.js ----

user_pref("extensions.enabledItems", "calendar-timezones@mozilla.org:0.1.2008d,disabled:1.0,disabled:0.1,disabled:2.0.0,messagestyle-blackened@addons.
---- Lines messagestyle-depth@addons.instantbird.org modified from prefs.js ----

user_pref("extensions.enabledItems", "calendar-timezones@mozilla.org:0.1.2008d,disabled:1.0,disabled:0.1,disabled:2.0.0,disabled:0.9,messagestyle-dept
---- Lines messagestyle-minimal20@addons.instantbird.org modified from prefs.js ----

user_pref("extensions.enabledItems", "calendar-timezones@mozilla.org:0.1.2008d,disabled:1.0,disabled:0.1,disabled:2.0.0,disabled:0.9,disabled:1.1,mess
---- FireFox user.js and prefs.js backups ----

prefs__0550_.backup

ProfilePath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__0550_.backup

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\Program Files (x86)\Celtx not found
C:\Program Files (x86)\Celtx\extensions\default-palette@celtx.com not found
C:\Program Files (x86)\Celtx\extensions\emoticons-msn-smileys@m513901.de not found
C:\Program Files (x86)\Celtx\extensions\inspector@mozilla.org not found
C:\Program Files (x86)\Celtx\extensions\messagestyle-blackened@addons.instantbird.org not found
C:\Program Files (x86)\Celtx\extensions\messagestyle-depth@addons.instantbird.org not found
C:\Program Files (x86)\Celtx\extensions\messagestyle-minimal20@addons.instantbird.org not found
C:\Users\josh\AppData\Roaming\Greyfirst\Celtx deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default
- Undetermined - exif_viewer@mozilla.doslash.org
- Undetermined - tineye@ideeinc.com
- Exif Viewer - %ProfilePath%\extensions\exif_viewer@mozilla.doslash.org.xpi
- Reddit Enhancement Suite - %ProfilePath%\extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi
- TinEye Reverse Image Search - %ProfilePath%\extensions\tineye@ideeinc.com.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default
F6D12679B9112358AC705A1308156F59 - C:\Users\josh\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player
0C8597DBC74AAF5179471BA013E3C6B4 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director

==== Chromium Look ======================

Google Voice Search Hotword (Beta) - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
AdBlock - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Google Dictionary (by Google) - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja
GrammarBase - Web Grammar Checker - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\plklmneddckmpnnkjldofmaegchjmoea

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\josh\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OUGFG9U will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\josh\AppData\Local\Mozilla\Firefox\Profiles\sshboobq.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\josh\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=508 folders=249 144356156 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\josh\AppData\Local\Temp will be emptied at reboot
C:\Users\postgres\AppData\Local\Temp emptied successfully
C:\Users\postgres.josh-PC\AppData\Local\Temp emptied successfully
C:\Users\POSTGR~1.JOS\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

************************************************************************************************

EDIT: Accidently ran with antivirus enabled. So I've rerun it with it disabled and here's the follow up zoek results

************************************************************************************************

Zoek.exe v5.0.0.0 Updated 29-11-2014
Tool run by josh on 02-Dec-14 at 18:16:45.59.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\josh\Desktop\zoek.exe.scr [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-12-02-162655.log 8999 bytes
C:\zoek-results2014-12-02-175659.log 8102 bytes

==== System Restore Info ======================

02-Dec-14 6:17:19 PM Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\Users\josh\AppData\Roaming\Greyfirst deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__0627_.backup

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\Program Files (x86)\Celtx not found
C:\Users\josh\AppData\Roaming\Greyfirst\Celtx not found

==== Firefox Extensions ======================

ProfilePath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default
- Undetermined - exif_viewer@mozilla.doslash.org
- Undetermined - tineye@ideeinc.com
- Exif Viewer - %ProfilePath%\extensions\exif_viewer@mozilla.doslash.org.xpi
- Reddit Enhancement Suite - %ProfilePath%\extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi
- TinEye Reverse Image Search - %ProfilePath%\extensions\tineye@ideeinc.com.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\josh\AppData\Roaming\Mozilla\Firefox\Profiles\sshboobq.default
F6D12679B9112358AC705A1308156F59 - C:\Users\josh\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player
0C8597DBC74AAF5179471BA013E3C6B4 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director

==== Chromium Look ======================

Google Voice Search Hotword (Beta) - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
AdBlock - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Google Dictionary (by Google) - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja
GrammarBase - Web Grammar Checker - josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\plklmneddckmpnnkjldofmaegchjmoea

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\josh\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OUGFG9U will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\josh\AppData\Local\Mozilla\Firefox\Profiles\sshboobq.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\josh\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=509 folders=249 144373302 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\josh\AppData\Local\Temp will be emptied at reboot
C:\Users\postgres\AppData\Local\Temp emptied successfully
C:\Users\postgres.josh-PC\AppData\Local\Temp emptied successfully
C:\Users\POSTGR~1.JOS\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\josh\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\josh\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OUGFG9U" not found
"C:\Users\josh\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OUGFG9U" not found

==== EOF on 02-Dec-14 at 18:33:52.16 ======================

argus · Dec 2, 2014

How is the situation now?

joshcoupon · Dec 2, 2014

Everything's fixed now, thanks a lot. If I wasn't a broke student I'd donate something. Appreciate your time spent helping.

argus · Dec 2, 2014

Download DelFix by Xplode and save it to your desktop.

Run the tool by right click on the

icon and Run as administrator option.
Make sure that these ones are checked:
- Remove disinfection tools
- Purge system restore
- Reset system settings
Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Search

Search

Solved Coupons

joshcoupon

New Member

Attachments

argus

Former MalwareTips Staff

Attachments

joshcoupon

New Member

Attachments

argus

Former MalwareTips Staff

joshcoupon

New Member

argus

Former MalwareTips Staff

joshcoupon

New Member

argus

Former MalwareTips Staff

You may also like...