vGrabber toolbar

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  *vgrabber*
  *incredibar*
  
  :regfind
  vgrabber
  incredibar

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Please see below: SystemLook 30.07.11 by jpshortstuff Log created at 08:32 on 12/07/2012 by user Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== filefind ========== Searching for "*vgrabber*" No files found. Searching for "*incredibar*" C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.incredibar.com_0.localstorage –a—- 3072 bytes [13:18 11/07/2012] [13:18 11/07/2012] E884CB4E91208F8B7F2D0A43451B39D7 C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.incredibar.com_0.localstorage-journal –a—- 3608 bytes [13:18 11/07/2012] [13:18 11/07/2012] 3024BC5271E54E7B9B916DDCBB801989 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\421NG11A\mystart.incredibar[1].xml –a—- 13 bytes [00:27 10/07/2012] [00:27 10/07/2012] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VK3H8QJI\mystart.incredibar[1].xml –a—- 13 bytes [12:39 10/07/2012] [12:39 10/07/2012] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 ========== regfind ========== Searching for "vgrabber" [HKEY_CURRENT_USER\Software\FLEXnet\Connect\db\Vgrabber Toolbar.ini] [HKEY_CURRENT_USER\Software\FLEXnet\Connect\db\vGrabber.ini] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}] "DisplayName"="Vgrabber Customized Web Search" [HKEY_LOCAL_MACHINE\SOFTWARE\Conduit\AppPaths\vgrabber.exe] [HKEY_USERS\S-1-5-21-3657083141-290413805-2333710366-1001\Software\FLEXnet\Connect\db\Vgrabber Toolbar.ini] [HKEY_USERS\S-1-5-21-3657083141-290413805-2333710366-1001\Software\FLEXnet\Connect\db\vGrabber.ini] [HKEY_USERS\S-1-5-21-3657083141-290413805-2333710366-1001\Software\Microsoft\Internet Explorer\SearchScopes\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}] "DisplayName"="Vgrabber Customized Web Search" Searching for "incredibar" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{72A3461B-2275-4A38-96D4-43D1CEEC0965}"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\user\AppData\Local\Temp\incredibar_installer.exe|Name=IncrediBar Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{CDF0EC05-1FD3-4804-AA56-D28A40BBC35A}"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\user\AppData\Local\Temp\incredibar_installer.exe|Name=IncrediBar Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{72A3461B-2275-4A38-96D4-43D1CEEC0965}"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\user\AppData\Local\Temp\incredibar_installer.exe|Name=IncrediBar Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{CDF0EC05-1FD3-4804-AA56-D28A40BBC35A}"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\user\AppData\Local\Temp\incredibar_installer.exe|Name=IncrediBar Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{72A3461B-2275-4A38-96D4-43D1CEEC0965}"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\user\AppData\Local\Temp\incredibar_installer.exe|Name=IncrediBar Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{CDF0EC05-1FD3-4804-AA56-D28A40BBC35A}"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\user\AppData\Local\Temp\incredibar_installer.exe|Name=IncrediBar Installer|" -= EOF =-

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Services
  
  :Otl
  IE - HKCU\..\SearchScopes\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3059010
  
  :Commands
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Change All homepages back again reboot and if it stays this time.

Please see below the new OTL report: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: user ->Temp folder emptied: 10045630 bytes ->Temporary Internet Files folder emptied: 67467657 bytes ->Google Chrome cache emptied: 18298207 bytes ->Flash cache emptied: 2407 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 106116 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 92.00 mb OTL by OldTimer - Version 3.2.53.1 log created on 07132012_112025 Files\Folders moved on Reboot… File\Folder C:\Users\user\AppData\Local\Temp\A3DOfc_83c3dd7d-f776-4054-8954-b1205fb80d84.u3d not found! C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. File\Folder C:\Users\user\AppData\Local\Temp\PDFMCustom.dot not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF019EF6537609D998.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF0FF8C52E3B435F7D.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF3F025D57F886C66F.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF47F8181D16EE4395.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF5713B198A3DFC641.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF587A22FD362223E3.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF604AC7D4E8A03A9B.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF6EB7C37166689BC6.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF8956CA3C5E627EEF.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DF90B793B88C82FB71.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DFA400E0FC8035C202.TMP not found! File\Folder C:\Users\user\AppData\Local\Temp\~DFB713085CCD44DB73.TMP not found! C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3NY5B96\search[2].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3NY5B96\tag[1].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3NY5B96\xd_receiver[1].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN0J5WR1\ads[1].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN0J5WR1\login_status[1].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4T2C1V6Y\google_ca[1].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4T2C1V6Y\search[2].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2FZTF9K3\google_ca[1].htm moved successfully. C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2FZTF9K3\search[2].htm moved successfully. PendingFileRenameOperations files… File C:\Users\user\AppData\Local\Temp\A3DOfc_83c3dd7d-f776-4054-8954-b1205fb80d84.u3d not found! File C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found! File C:\Users\user\AppData\Local\Temp\PDFMCustom.dot not found! File C:\Users\user\AppData\Local\Temp\~DF019EF6537609D998.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF0FF8C52E3B435F7D.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF3F025D57F886C66F.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF47F8181D16EE4395.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF5713B198A3DFC641.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF587A22FD362223E3.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF604AC7D4E8A03A9B.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF6EB7C37166689BC6.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF8956CA3C5E627EEF.TMP not found! File C:\Users\user\AppData\Local\Temp\~DF90B793B88C82FB71.TMP not found! File C:\Users\user\AppData\Local\Temp\~DFA400E0FC8035C202.TMP not found! File C:\Users\user\AppData\Local\Temp\~DFB713085CCD44DB73.TMP not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3NY5B96\search[2].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3NY5B96\tag[1].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3NY5B96\xd_receiver[1].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN0J5WR1\ads[1].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN0J5WR1\login_status[1].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4T2C1V6Y\google_ca[1].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4T2C1V6Y\search[2].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2FZTF9K3\google_ca[1].htm not found! File C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2FZTF9K3\search[2].htm not found! Registry entries deleted on Reboot… My computer work fines now, I restarted it a few times to ensure it doesn't come back. I am very glad that I found your website, I would never be able to do that on my own, as I usually try to do by reading different forums. You make it so easy, the instructions and the copy paste. Thank you so much for all the advice, I will proceed with the housekeeping!

You're welcome,glad we could help


Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.