Gosave ads

[downsouthlady75]

I need help, everytime I go online through google chrome or even internet explorer, those gosave ads pop up. I'm not sure what was downloaded to start those ads from popping up. Thanks for your help.

 

[argus]

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Task: {D1A820A8-BC75-4B81-8B33-9F1542D5561E} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:373E1720
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www2.delta-search.com/?babsrc=HP_ss&mntrId=123DE840F2B8AFD7&affID=124768&tsp=5006
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 - DefaultScope {C84F77B0-71FD-41E8-8822-DC0C378CC8C2} URL =
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3321738&octid=EB_ORIGINAL_CTID&ISID=M549080CE-38E1-460C-BAB5-F2171F0062CA&SearchSource=58&CUI=&UM=2&UP=SP0858826E-56D5-4D84-A0FB-91A38AD0D620&q={searchTerms}&SSPV=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=123DE840F2B8AFD7&affID=124768&tsp=5006
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKCU - {C84F77B0-71FD-41E8-8822-DC0C378CC8C2} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3303799&CUI=UN22108128146461240&UM=2
BHO: YoiutUbeeAdBBLoocke -> {01e22b9b-5de8-4bff-b959-b191b995c435} -> C:\Program Files (x86)\YoiutUbeeAdBBLoocke\0FGY1VZoucqo9L.x64.dll ()
C:\Program Files (x86)\YoiutUbeeAdBBLoocke
BHO: GeoSave -> {a78b7c0e-778e-469a-b38f-9d71a02d6ee4} -> C:\Program Files (x86)\GeoSave\X65FLrc0QEuXu8.x64.dll ()
C:\Program Files (x86)\GeoSave
BHO-x32: YoiutUbeeAdBBLoocke -> {01e22b9b-5de8-4bff-b959-b191b995c435} -> C:\Program Files (x86)\YoiutUbeeAdBBLoocke\0FGY1VZoucqo9L.dll ()
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} ->  No File
BHO-x32: DownloadTerms -> {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} -> C:\Users\Joana\AppData\Local\DownloadTerms\temp.dat No File
BHO-x32: Movies Toolbar (Dist. by Somoto Ltd.) -> {3444c3c5-6c56-4a16-a453-832b05bf6ea4} -> C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll No File
BHO-x32: Fast Free Converter 4.1 -> {8232785C-5C98-4A6E-B7B4-911FFBED7582} -> C:\PROGRA~2\FASTFR~1\FASTFR~1\FASTFR~1.DLL No File
BHO-x32: GeoSave -> {a78b7c0e-778e-469a-b38f-9d71a02d6ee4} -> C:\Program Files (x86)\GeoSave\X65FLrc0QEuXu8.dll ()
C:\Program Files (x86)\GeoSave
BHO-x32: No Name -> {D4563F7A-358C-47BC-A1C9-47B539BD19BF} ->  No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Movies Toolbar (Dist. by Somoto Ltd.) - {3444c3c5-6c56-4a16-a453-832b05bf6ea4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
CHR Extension: (GoSAuvei) - C:\Users\Joana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gladbfpmmgghjhoahgfigcbdhchjldoc [2014-10-18]
C:\Users\Joana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gladbfpmmgghjhoahgfigcbdhchjldoc
CHR Extension: (Browser Extension) - C:\Users\Joana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhahncknpppipmgjchbbhehkfglelepf [2014-10-18]
C:\Users\Joana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhahncknpppipmgjchbbhehkfglelepf
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
EmptyTemp:

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


3. Run FRST/FRST64 and press the Fix button just once and wait.
[size=8pt]If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.[/size]

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.





************** Next ******************





Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

[size=8pt]Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.[/size]

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

************** Next ******************







Please download Zoek tool by Smeenk (

) from here and save it to your Desktop.
Unpack the archive...

• Close any open browsers and temporarily disable your AntiVirus program. (if it is necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool. Please wait while the tool does not start...
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:
  
  

  filesrcm;
  startupall;
  skipfix-iedefaults;
  firefoxlook;
  chromelook;

  
  
• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"