Getting Strange Popups in my google chrome browser [Solved]

Hello ONewbieO, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• Ensure you are following this topic. Click [external image: etYzdbu.png] at the top of the page. 
   

======================================================
 
Please run the following diagnostic scans so I can ascertain the state of your computer.
 
STEP 1
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
[external image: YARWD1t.png.pagespeed.ce.nvhmVeYDe3.png] TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select [external image: xAVOiBNU.jpg.pagespeed.ic.H5HC6LkiJX.jpg] Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach the file in your next reply.
   

======================================================
 
STEP 3
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• TDSSKiller log (attached)

Addition.txt

Please consider the following suggestion, and proceed with the instructions below. 

[external image: goGMWSt.gif]Spybot S&D No Longer Recommended

——————————

MVPS.org is no longer recommending Spybot S&D due to poor testing results (scroll down and read under Freeware Antispyware Products).

I would advise uninstalling Spybot S&D. The presence of this programme can make the cleaning of your computer more difficult. You can uninstall the programme by:

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for Spybot, right-click the entry and click Uninstall.

Please inform me of your decision.

 
STEP 1
[external image: 6JO0hXH.png] Revo Uninstaller

• Please download and install Revo Uninstaller Free.
• Double-click Revo Uninstaller to run the programme. 
• From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.
  • BlockIt Ad remover
  • GS-Supporter 1.80
  • Pando Media Booster
  • SW-Booster
  • SW-Sustainer 1.80
  • System Speedup 
• ​Double-click the programme. 
• When prompted if you want to uninstall click Yes.
• Ensure the Moderate option is selected and click Next.
• The programme uninstaller will run. If prompted again click Yes.
• Work your way through the uninstaller, ensuring you read each page thoroughly.
• Note: Ensure you decline offers of additional software if applicable. 
• Once the built-in uninstaller is finished click Next.
• Once the programme has searched for leftovers click Next.
• Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
• When prompted click Yes, followed by Next.
• Click Select all, followed by Delete.
• When prompted click Yes, followed by Next.
• Once done click Finish.
   

STEP 2
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  HKLM-x32\…\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761536 2013-12-26] ()
  C:\Program Files (x86)\Mobogenie
  Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {0a8bc460-30c1-11e3-bed5-2cd05a10fb35} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {40339722-5963-11e3-beef-2cd05a10fb35} - "E:\AUTORUN_BANDLUXE.EXE" /EjectCDROM
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {577f0689-8a42-11e2-be73-2cd05a10fb35} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {577f06b5-8a42-11e2-be73-2cd05a10fb35} - "F:\setup_vmc_lite.exe" /checkApplicationPresence
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {577f0718-8a42-11e2-be73-2cd05a10fb35} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {63851795-3a0a-11e3-bede-2cd05a10fb35} - "E:\LaunchU3.exe" -a
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {9c71d1d7-2f4b-11e3-bed4-001e101fabfe} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {9c71d201-2f4b-11e3-bed4-001e101fabfe} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {9c71d23d-2f4b-11e3-bed4-001e101fabfe} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {ab3cfbfc-2c87-11e3-bed2-001e101f54a1} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {ab3cfcb4-2c87-11e3-bed2-001e101f54a1} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {ab3cfd58-2c87-11e3-bed2-001e101f54a1} - "E:\AutoRun.exe"
  HKU\S-1-5-21-336608445-27866453-704810108-1001\…\MountPoints2: {dadf6686-a2a2-11e2-be84-001e101f0b99} - "F:\LGAutoRun.exe"
  AppInit_DLLs: C:\PROGRA~2\GS-ENA~1\ASSIST~2.DLL => C:\Program Files (x86)\GS-Enabler\Assistant_x64.dll [2759168 2014-12-18] ()
  AppInit_DLLs:  C:\PROGRA~2\SW-BOO~1\ASSIST~2.DLL => C:\Program Files (x86)\SW-Booster\Assistant_x64.dll [4210176 2014-12-18] ()
  C:\Program Files (x86)\GS-Enabler
  C:\Program Files (x86)\SW-Booster
  AppInit_DLLs-x32: c:\progra~2\sw-boo~1\assist~1.dll => c:\Program Files (x86)\SW-Booster\Assistant.dll [4296192 2014-12-18] ()
  GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
  CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
  Startup: C:\Users\KengLing\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
  ShortcutTarget: start.lnk -> C:\Users\KengLing\vbvds\76469.vbs (No File)
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://websearch.fix…&cc=SG&unqvl=61
  HKU\S-1-5-21-336608445-27866453-704810108-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.fix…&cc=SG&unqvl=61
  SearchScopes: HKLM-x32 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.fix…&cc=SG&unqvl=61
  SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.fix…&cc=SG&unqvl=61
  SearchScopes: HKU\S-1-5-21-336608445-27866453-704810108-1001 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.fix…&cc=SG&unqvl=61
  SearchScopes: HKU\S-1-5-21-336608445-27866453-704810108-1001 -> {119CD317-C309-419C-9642-ACC45439850A} URL = http://websearch.ask…66-D98EFD1A3192
  SearchScopes: HKU\S-1-5-21-336608445-27866453-704810108-1001 -> {57E44609-825C-4084-B237-B3A01BC4D771} URL = 
  SearchScopes: HKU\S-1-5-21-336608445-27866453-704810108-1001 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.fix…&cc=SG&unqvl=61
  BHO: GoSaVe -> {8f7e6959-8579-43ce-a9fb-a197faead952} -> C:\Program Files (x86)\GoSaVe\slYtCdM7ytVne7.x64.dll No File
  BHO: GoSaevE -> {a2d0d05a-2688-42aa-a89b-044c5a5bc82c} -> C:\Program Files (x86)\GoSaevE\IngeI1qVcxPImW.x64.dll No File
  C:\Program Files (x86)\GoSaVe
  C:\Program Files (x86)\GoSaevE
  BHO: No Name -> {E1F592C9-D4CB-6EE0-1289-DC7134D4D845} ->  No File
  BHO-x32: GoSaVe -> {8f7e6959-8579-43ce-a9fb-a197faead952} -> C:\Program Files (x86)\GoSaVe\slYtCdM7ytVne7.dll No File
  BHO-x32: GoSaevE -> {a2d0d05a-2688-42aa-a89b-044c5a5bc82c} -> C:\Program Files (x86)\GoSaevE\IngeI1qVcxPImW.dll No File
  Toolbar: HKU\S-1-5-21-336608445-27866453-704810108-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
  FF Plugin-x32: @funshion.com/npFunshion -> C:\Users\KengLing\funshion\funshiontools\npFunshion.dll No File
  FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  C:\Program Files (x86)\Pando Networks
  FF Plugin HKU\S-1-5-21-336608445-27866453-704810108-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha268\ff
  FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta10446\ff
  C:\Program Files (x86)\MediaPlayerV1
  C:\Program Files (x86)\VideoPlayerV3
  FF Extension: No Name - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta10446\ff [Not Found]
  FF Extension: No Name - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha268\ff [Not Found]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2014-12-19]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-12-19]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\epindigjbiphgfhnmlpcocaiafjgbabe [2014-12-19]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-12-19]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnpoebddognhfcnfbfjdbgmgadkmmdkj [2014-12-19]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkgfemnodkdnenmfkblebnkjpckkjcae [2014-12-19]
  CHR Extension: (No Name) - C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfidmkgnfgnkihnjeklbekckimkipmoe [2014-12-19]
  CHR Extension: (50Coupons) - C:\ProgramData\oncanfeampaccccenbclhjlgdkdeeinn\ [2014-12-19]
  C:\ProgramData\oncanfeampaccccenbclhjlgdkdeeinn
  R2 D0E87C27; c:\Program Files (x86)\SW-Booster\AssistantSvc.dll [174928 2014-12-18] () [File not signed]
  S2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X]
  S2 e81a9dc1; "C:\windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\AssistantSvc.dll",service
  S2 mcbootdelaystartsvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
  S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [X]
  S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [X]
  S3 hwusbdev; \SystemRoot\system32\DRIVERS\ewusbdev.sys [X]
  S3 hwusbfake; \SystemRoot\system32\DRIVERS\ewusbfake.sys [X]
  2014-12-18 16:16 - 2014-12-18 16:16 - 00001041 _____ () C:\Users\Public\Desktop\System Speedup.lnk
  2014-12-18 16:15 - 2014-12-18 16:15 - 00003036 _____ () C:\windows\System32\Tasks\System Speedup_UPDATES
  2014-12-18 16:15 - 2014-12-18 16:15 - 00002734 _____ () C:\windows\System32\Tasks\SW-Booster-S-792098896
  2014-12-18 16:15 - 2014-12-18 16:15 - 00000496 _____ () C:\windows\Tasks\SW-Booster-S-792098896.job
  2014-12-18 16:15 - 2014-12-18 16:15 - 00000312 _____ () C:\windows\Tasks\System Speedup_UPDATES.job
  2014-12-18 16:15 - 2014-12-18 16:15 - 00000304 _____ () C:\windows\Tasks\System Speedup_DEFAULT.job
  2014-12-18 16:15 - 2014-12-18 16:15 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
  2014-12-18 16:14 - 2014-12-18 16:15 - 00000000 ____D () C:\Users\KengLing\AppData\Local\SwvUpdater
  2014-12-18 16:14 - 2014-12-18 16:14 - 00002880 _____ () C:\windows\System32\Tasks\System Speedup_DEFAULT
  2014-12-18 16:13 - 2014-12-18 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
  2014-12-18 16:13 - 2014-12-18 16:16 - 00000000 ____D () C:\Program Files (x86)\System Speedup
  2014-12-18 16:13 - 2014-12-18 16:13 - 00000944 ____H () C:\Users\KengLing\funshion.ini
  2014-12-18 16:13 - 2014-12-18 16:13 - 00000000 ____D () C:\ProgramData\GoSaevE
  ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)
  ShellIconOverlayIdentifiers-x32: [GiraffeOverlay] -> {E1D78D6A-8183-8F10-108D-8850224DC790} => C:\Users\KengLing\AppData\Local\Giraffe\FunSambar.dll (Funshion)
  C:\Users\Public\Fundata
  2014-12-15 13:12 - 2014-12-15 13:12 - 00001144 _____ () C:\Users\KengLing\Desktop\Live PC Help.lnk
  2014-12-15 12:48 - 2014-12-18 16:15 - 00000000 ____D () C:\ProgramData\BlockIt Ad remover
  2014-12-10 23:03 - 2014-12-10 23:03 - 00000000 ____D () C:\Users\KengLing\AppData\Roaming\ASP
  2014-12-09 02:09 - 2014-12-09 02:09 - 00000000 ____D () C:\ProgramData\oncanfeampaccccenbclhjlgdkdeeinn
  2014-11-26 09:35 - 2014-12-18 16:15 - 00000000 ____D () C:\Users\KengLing\AppData\Roaming\FunTV
  Folder: C:\Users\KengLing\AppData\Roaming\Zoo
  2014-12-18 16:15 - 2014-09-26 10:18 - 00000000 ____D () C:\ProgramData\Mini - Adblocker
  2014-12-18 16:15 - 2014-07-28 02:00 - 00000000 ____D () C:\Users\KengLing\AppData\Roaming\Funshion
  2014-12-18 16:15 - 2014-07-04 02:05 - 00000000 ___HD () C:\Users\Public\FunAcce
  2014-12-18 16:15 - 2014-01-04 17:50 - 00000000 ____D () C:\Users\KengLing\AppData\Local\genienext
  2014-12-18 16:15 - 2013-11-14 11:27 - 00000000 ____D () C:\ProgramData\mcache
  2014-12-18 16:13 - 2014-10-24 22:40 - 00000000 ____D () C:\ProgramData\Yellow AdBlocker
  2014-12-15 15:01 - 2014-05-10 23:20 - 00000000 ____D () C:\Users\KengLing\AppData\Roaming\System Speedup
  2014-12-15 13:12 - 2014-05-10 23:21 - 00000000 ____D () C:\ProgramData\Systweak
  2014-12-15 13:12 - 2014-05-10 23:20 - 00000000 ____D () C:\Users\KengLing\AppData\Roaming\systweak
  2014-12-14 21:36 - 2014-05-10 23:20 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
  2014-12-09 02:12 - 2014-01-05 17:42 - 00000000 ____D () C:\ProgramData\365559d05cf6c3a4
  2014-12-06 21:39 - 2014-07-15 21:06 - 00000000 ____D () C:\Users\KengLing\AppData\Local\Giraffe
  Folder: C:\Users\KengLing\AppData\Roaming\iy
  C:\Users\KengLing\AppData\Local\Temp\089709F389a.exe
  C:\Users\KengLing\AppData\Local\Temp\0f049aE2.exe
  C:\Users\KengLing\AppData\Local\Temp\70A39618E9FE.exe
  C:\Users\KengLing\AppData\Local\Temp\DataCard_Setup64.exe
  C:\Users\KengLing\AppData\Local\Temp\drvprosetup.exe
  C:\Users\KengLing\AppData\Local\Temp\ebE3BbfcB36.exe
  C:\Users\KengLing\AppData\Local\Temp\kwuninsthelper.exe
  C:\Users\KengLing\AppData\Local\Temp\LiveSupport_setup.exe
  C:\Users\KengLing\AppData\Local\Temp\optprosetup.exe
  C:\Users\KengLing\AppData\Local\Temp\ResetDevice.exe
  C:\Users\KengLing\AppData\Local\Temp\Tmp1400843114_Greenil.dll
  C:\Users\KengLing\AppData\Local\Temp\Tmp1406484046_Greenil.dll
  C:\Users\KengLing\AppData\Local\Temp\Tmp1416965757_greenil.dll
  Task: {33674A10-3841-41A7-B6BA-BF920AC1AF7E} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
  C:\Program Files (x86)\RegClean Pro
  Task: {70CEBE38-B50B-4260-8E6E-12960BDD3433} - \KwRunAsStdUser Task1622 No Task File <==== ATTENTION
  Task: {B02BB574-F3D1-404D-A72D-86D8027F4CDE} - System32\Tasks\System Speedup => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe [2014-12-18] (System Speedup)
  Task: {CA900987-F717-4571-87AF-51A37B2EA578} - \KwRunAsStdUser Task21221 No Task File <==== ATTENTION
  Task: {F153D15D-BF67-4DC8-91FC-82F3A6F4778A} - \KwRunAsStdUser Task21012 No Task File <==== ATTENTION
  Task: C:\windows\Tasks\SW-Booster-S-792098896.job => c:\programdata\trusted publisher\sw-booster\SW-Booster.exe <==== ATTENTION
  Task: C:\windows\Tasks\System Speedup_DEFAULT.job => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
  Task: C:\windows\Tasks\System Speedup_UPDATES.job => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
  C:\Program Files (x86)\System Speedup
  CMD: ipconfig /flushdns
  CMD: netsh winsock reset all
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 3
[external image: EtQetiM.png] Uninstall/Reinstall Chrome

• Follow these instructions on how to backup your Chrome bookmarks: Backup Chrome Bookmarks
• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall.
  • Google Chrome
• Follow the prompts.
• Reboot if necessary.
• Download and install [external image: U5NwUGc.png.pagespeed.ce.fQOA5bLO8d.png] Google Chrome.
   

STEP 4
[external image: BY4dvz9.png] AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

– File and folder backups are made for anything removed using this tool. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 

STEP 5
[external image: E3feWj5.png] Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Create a System Restore Point. For instructions, please refer to the following link (W8) | link (W7) | link (Vista).
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

======================================================

STEP 6
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Did you uninstall Spybot?
• Did the programmes uninstall OK?
• Fixlog.txt
• Did Chrome uninstall/reinstall OK?
• AdwCleaner[S0].txt
• JRT.txt

Spybot uninstalled . 

Programmes uninstalled ok . 

Chrome uninstall and reinstalled ok 

3 Log files are below . 

Fixlog.txt

FRST.txt

Fixlog.txt