Can't remove Crypted.Gen virus

Hi,

 

My daughter got a virus after installing a required driver that was in a zip file for a Huion Graphic Drawing Tablet that she received for Christmas.

 

We have ran Microsoft Virus and Malware removal scan and Avira and nothing works.  Avira keeps popping up on IE and Chrome stating that it has detected the virus and it acts like it quarantines it but then it's still there.  Both Chrome and IE webpages have been over taken with words that contain hyperlinks, pop up ads, and websites offering to help you fix your computer. 

 

Here are the specs on her computer.  Sony VAIO laptop, 64-bit,  Intel Core i5-3210M CPU @ 2.50GHz, 6GB RAM, WIndows 7 Home Premium w/service pack 1.

 

TIA for your assistance!

 

Here is the aswMBR Log and following are the other two logs from FRST64:

 

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.



Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan
click on Browse, and upload the following file for analysis:

C:\Program Files (x86)\IocingRuwl\IocingRuwl.exe


Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

~~~~~~~~~~~~~~~~~~~~

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

• [external image: xehzOq95.png.pagespeed.ic.1o1xpAkZbO.png]Backup Internet Explorer Favourites
• [external image: xQlf57ne.png.pagespeed.ic.SnwgqhVB9v.jpg]Backup Firefox Bookmarks
• [external image: U5NwUGc.png]Backup Chrome Bookmarks
  
  ~~~~~~~~

Proceed with the reset once done.

• [external image: xehzOq95.png.pagespeed.ic.1o1xpAkZbO.png]Internet Explorer: How to reset Internet Explorer settings
• [external image: xQlf57ne.png.pagespeed.ic.SnwgqhVB9v.jpg]Firefox: Reset Firefox
• [external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings

~~~~~~~~~

Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
 

start
CloseProcesses:
C:\Users\GrayBush\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe
HKU\S-1-5-21-2753690234-888831857-2254222751-1000\…\Run: [Obrona Block Ads] => "C:\Users\GrayBush\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" –hidden
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=<http://127.0.0.1:9880>
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/…rc=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2753690234-888831857-2254222751-1000 -> DefaultScope {3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} URL = http://search.condui…8451549382&UM=2
SearchScopes: HKU\S-1-5-21-2753690234-888831857-2254222751-1000 -> {3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} URL = http://search.condui…8451549382&UM=2
CHR HKLM-x32\…\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
R2 IocingRuwl; C:\Program Files (x86)\IocingRuwl\IocingRuwl.exe [4316160 2015-01-07] () [File not signed] <==== ATTENTION
2015-01-07 13:59 - 2015-01-07 14:08 - 00000000 ____D () C:\Users\GrayBush\AppData\Local\Obrona Block Ads
2015-01-07 13:59 - 2015-01-07 13:59 - 00000000 ____D () C:\Users\GrayBush\AppData\Roaming\OpenCandy
C:\Users\GrayBush\AppData\Local\Temp\avgnt.exe
C:\Users\GrayBush\AppData\Local\Temp\COMAP.EXE
C:\Users\GrayBush\AppData\Local\Temp\ConsumerInputSetup.exe
C:\Users\GrayBush\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpc_mldr.dll
C:\Users\GrayBush\AppData\Local\Temp\GLF1183.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLF1955.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLF1BB7.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLFDB8B.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLFE30B.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLFE506.EXE
C:\Users\GrayBush\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\GrayBush\AppData\Local\Temp\ObronaBlockAds.exe
C:\Users\GrayBush\AppData\Local\Temp\OfficeSetup.exe
C:\Users\GrayBush\AppData\Local\Temp\oi_{69A83661-3F7F-4D4B-B939-4BBA5D108631}.exe
C:\Users\GrayBush\AppData\Local\Temp\Setup.X86.en-US_O365HomePremRetail_d1f8befe-aca6-4c46-9c3b-fbb3be34211d_TX_PR_.exe
C:\Users\GrayBush\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe
C:\Users\GrayBush\AppData\Local\Temp\SpOrder.dll
C:\Users\GrayBush\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\GrayBush\AppData\Local\Temp\_isF673.exe
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {0A481A39-7140-405C-96E0-6DF03DDF7D30} - System32\Tasks\RPC => C:\Program Files (x86)\Bull Softwares\Reg Pro Cleaner\RegProCleaner.exe
AlternateDataStreams: C:\ProgramData\Temp:D287FACF
AlternateDataStreams: C:\ProgramData\Temp:D3A96964
EmptyTemp:
Hosts:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


*******
[external image: BY4dvz9.png]AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

– File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


[external image: thisisujrt.gif]
Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~
please post
Virus total results
Fixlog.txt
C:\AdwCleaner.txt
JRT.txt

https://www.virustotal.com/en/file/87b136ded59ef1fe4ffe91af3a9bfff891ab55e1d2dca969231026b2778f7237/analysis/1420858935/

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-01-2015
Ran by [removed] at 2015-01-09 19:15:39 Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
C:\Users\GrayBush\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe
HKU\S-1-5-21-2753690234-888831857-2254222751-1000\…\Run: [Obrona Block Ads] => "C:\Users\GrayBush\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" –hidden
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=<http://127.0.0.1:9880>
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/…rc=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2753690234-888831857-2254222751-1000 -> DefaultScope {3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} URL = http://search.condui…8451549382&UM;=2
SearchScopes: HKU\S-1-5-21-2753690234-888831857-2254222751-1000 -> {3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} URL = http://search.condui…8451549382&UM;=2
CHR HKLM-x32\…\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
R2 IocingRuwl; C:\Program Files (x86)\IocingRuwl\IocingRuwl.exe [4316160 2015-01-07] () [File not signed] <==== ATTENTION
2015-01-07 13:59 - 2015-01-07 14:08 - 00000000 ____D () C:\Users\GrayBush\AppData\Local\Obrona Block Ads
2015-01-07 13:59 - 2015-01-07 13:59 - 00000000 ____D () C:\Users\GrayBush\AppData\Roaming\OpenCandy
C:\Users\GrayBush\AppData\Local\Temp\avgnt.exe
C:\Users\GrayBush\AppData\Local\Temp\COMAP.EXE
C:\Users\GrayBush\AppData\Local\Temp\ConsumerInputSetup.exe
C:\Users\GrayBush\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpc_mldr.dll
C:\Users\GrayBush\AppData\Local\Temp\GLF1183.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLF1955.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLF1BB7.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLFDB8B.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLFE30B.EXE
C:\Users\GrayBush\AppData\Local\Temp\GLFE506.EXE
C:\Users\GrayBush\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\GrayBush\AppData\Local\Temp\ObronaBlockAds.exe
C:\Users\GrayBush\AppData\Local\Temp\OfficeSetup.exe
C:\Users\GrayBush\AppData\Local\Temp\oi_{69A83661-3F7F-4D4B-B939-4BBA5D108631}.exe
C:\Users\GrayBush\AppData\Local\Temp\Setup.X86.en-US_O365HomePremRetail_d1f8befe-aca6-4c46-9c3b-fbb3be34211d_TX_PR_.exe
C:\Users\GrayBush\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe
C:\Users\GrayBush\AppData\Local\Temp\SpOrder.dll
C:\Users\GrayBush\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\GrayBush\AppData\Local\Temp\_isF673.exe
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\GrayBush\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {0A481A39-7140-405C-96E0-6DF03DDF7D30} - System32\Tasks\RPC => C:\Program Files (x86)\Bull Softwares\Reg Pro Cleaner\RegProCleaner.exe
AlternateDataStreams: C:\ProgramData\Temp:D287FACF
AlternateDataStreams: C:\ProgramData\Temp:D3A96964
EmptyTemp:
Hosts:
End

*****************

Processes closed successfully.
"C:\Users\GrayBush\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" => File/Directory not found.
HKU\S-1-5-21-2753690234-888831857-2254222751-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Obrona Block Ads => value deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
HKU\ProxyEnable: Internet Explorer proxy is enabled.\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Value not found.
HKU\ProxyServer: http=<http://127.0.0.1:9880>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKU\S-1-5-21-2753690234-888831857-2254222751-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-2753690234-888831857-2254222751-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3FF070FA-2C6C-4F04-957A-99A93E2F7AD3}" => Key deleted successfully.
HKCR\CLSID\{3FF070FA-2C6C-4F04-957A-99A93E2F7AD3} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
IocingRuwl => Service deleted successfully.
C:\Users\GrayBush\AppData\Local\Obrona Block Ads => Moved successfully.
C:\Users\GrayBush\AppData\Roaming\OpenCandy => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\COMAP.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\ConsumerInputSetup.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpc_mldr.dll => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\GLF1183.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\GLF1955.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\GLF1BB7.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\GLFDB8B.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\GLFE30B.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\GLFE506.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\nitro_reader3_64.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\ObronaBlockAds.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\OfficeSetup.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\oi_{69A83661-3F7F-4D4B-B939-4BBA5D108631}.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\Setup.X86.en-US_O365HomePremRetail_d1f8befe-aca6-4c46-9c3b-fbb3be34211d_TX_PR_.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\SpOrder.dll => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\UNINSTALL.EXE => Moved successfully.
C:\Users\GrayBush\AppData\Local\Temp\_isF673.exe => Moved successfully.
"HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => Key deleted successfully.
"HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
"HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => Key deleted successfully.
"HKU\S-1-5-21-2753690234-888831857-2254222751-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0A481A39-7140-405C-96E0-6DF03DDF7D30}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A481A39-7140-405C-96E0-6DF03DDF7D30}" => Key deleted successfully.
C:\Windows\System32\Tasks\RPC => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RPC" => Key deleted successfully.
C:\ProgramData\Temp => ":D287FACF" ADS removed successfully.
C:\ProgramData\Temp => ":D3A96964" ADS removed successfully.
"C:\Windows\System32\Drivers\etc\hosts" => Could not move.
Could not reset Hosts.
EmptyTemp: => Removed 2.2 GB temporary data.

The system needed a reboot.

==== End of Fixlog 19:17:36 ====

 

# AdwCleaner v4.107 - Report created 09/01/2015 at 19:48:31
# Updated 07/01/2015 by Xplode
# Database : 2015-01-03.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : GrayBush - MSCLAPTOP
# Running from : C:\Users\GrayBush\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_toolbar.utorrent.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Found : C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\Consumer Input
Folder Found : C:\Users\GrayBush\AppData\Local\Conduit
Folder Found : C:\Users\GrayBush\AppData\LocalLow\Conduit

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AppDataLow\Software\Smartbar
Key Found : HKCU\Software\Compete
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Google\Chrome\Extensions\dknkjnkhedbanphkkpbpcgoblmkbfhlf
Key Found : HKCU\Software\Pokki
Key Found : HKCU\Software\Red Sky
Key Found : HKCU\Software\Softonic
Key Found : [x64] HKCU\Software\Compete
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\Pokki
Key Found : [x64] HKCU\Software\Red Sky
Key Found : [x64] HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4F77-802C-5B295919C205}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Found : HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Found : HKLM\SOFTWARE\Classes\PCProxy.DataContainer
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3225826
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{ED721A76-8160-4DA0-A18E-7FD7C4574774}
Key Found : HKLM\SOFTWARE\CompeteInc
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dknkjnkhedbanphkkpbpcgoblmkbfhlf
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE91F9CE-0900-4E2A-B673-F3F6E4FC54D9}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v

-\\ Google Chrome v

[C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource;=49&CUI;=UN32736152876624257&ctid;=CT3225826&UM;=2
[C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource;=49&CUI;=UN32736152876624257&ctid;=CT3225826&UM;=2
[C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\GrayBush\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.netflix.com/WiSearch?raw_query=∾_category_type=none∾_rel_posn=-1∾_abs_posn=-1&v1;={searchTerms}&search;_submit=

*************************

AdwCleaner[R0].txt - [8316 octets] - [09/01/2015 19:48:31]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [8376 octets] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Fri 01/09/2015 at 20:43:57.28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2753690234-888831857-2254222751-1000\Software\Microsoft\Internet Explorer\Main\\Start Page

 

~~~ Registry Keys

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Folder] "C:\Users\GrayBush\appdata\local\cre"
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{13CCEBD0-8B00-4EE5-8E37-C9F07128C660}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{1DBADFD8-41CA-4F25-B648-A5354CA0D83D}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{3F68EA44-7B32-42F4-9E63-1EE9B1171B19}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{57549FB3-20F8-4AB1-BC7C-E4F9E296D563}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{68571D31-612C-4CAA-8C32-D30E906CE831}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{6F6E6F5D-9038-44BE-A14A-E808108A57E7}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{A1BC5B44-CC70-467A-A46C-5640B0671529}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{A2408D42-BE08-49AF-AECF-EDA371D82FA0}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{A2A7EE68-418D-4DE5-83A3-8F76F3F1FB06}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{C018F01B-ED92-40D4-8DA3-1292424DC7E7}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{C73100D0-67F4-48F0-973F-BA421CD69B02}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{CC8A7D15-EA63-4D9C-9C9F-2A89C94E96E2}
Successfully deleted: [Empty Folder] C:\Users\GrayBush\appdata\local\{DC2928B9-5DC2-44A0-8F4C-5FFB22E331B1}

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 01/09/2015 at 20:45:54.61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~