Vosteran Hijack help needed please

Theres quite a bit to do.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

~~~

Please disable SpyBot TeaTimer.

SPYBOT TEATIMER

Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts.
If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
Exit Spybot S&D when done and reboot your computer.
(When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

~~~~~

Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on Google Chrome
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

Also please uninstall Optimizer Pro v3.2.

~~

Once uninstalled, download again from this link.
http://www.google.com/chrome/

~~~

Running from C:\Users\[removed]\Downloads

It's best we move Farbar's to desktop.

Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.


Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


[external image: FRSTfix.JPG]

 

start
CloseProcesses:
HKLM-x32\…\RunOnce: [DelTr270303369] => cmd.exe /c rd /s /q "C:\Users\Mark\AppData\Roaming\WSE_Vosteran"
HKU\S-1-5-21-4044005535-2863482562-1548477820-1000\…\RunOnce: [WSE_Vosteran] => [X]
HKU\S-1-5-21-4044005535-2863482562-1548477820-1000\…\RunOnce: [PriceFountain] => [X]
HKU\S-1-5-21-4044005535-2863482562-1548477820-1000\…\RunOnce: [DelTr270303369] => cmd.exe /c rd /s /q "C:\Users\Mark\AppData\Roaming\WSE_Vosteran"
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=303474610&ir=
SearchScopes: HKU\S-1-5-21-4044005535-2863482562-1548477820-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=303474610&ir=
CHR dev: Chrome dev build detected! <======= ATTENTION
R2 c7522d84; c:\Program Files (x86)\Optimizer Pro 3.27\OptProMon.dll [2462800 2015-01-18] ()
c:\Program Files (x86)\Optimizer Pro 3.27
R1 {16a92140-918d-4afb-9edb-46f22437bb10}Gw64; C:\Windows\System32\drivers\{16a92140-918d-4afb-9edb-46f22437bb10}Gw64.sys [48792 2015-01-25] (StdLib)
C:\Windows\System32\drivers\{16a92140-918d-4afb-9edb-46f22437bb10}Gw64.sys
R1 {915cb94b-b4d8-4c0e-83b4-61409471b1c3}Gw64; C:\Windows\System32\drivers\{915cb94b-b4d8-4c0e-83b4-61409471b1c3}Gw64.sys [48792 2015-01-22] (StdLib)
R1 {ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}Gw64; C:\Windows\System32\drivers\{ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}Gw64.sys [48792 2015-01-15] (StdLib)
R1 {ecd6aae4-019c-44b2-a0e5-570904275d66}Gw64; C:\Windows\System32\drivers\{ecd6aae4-019c-44b2-a0e5-570904275d66}Gw64.sys [48792 2015-01-16] (StdLib)
2015-01-25 08:22 - 2015-01-25 05:44 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{16a92140-918d-4afb-9edb-46f22437bb10}Gw64.sys
2015-01-22 17:42 - 2015-01-22 12:54 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{915cb94b-b4d8-4c0e-83b4-61409471b1c3}Gw64.sys
C:\Windows\System32\drivers\{915cb94b-b4d8-4c0e-83b4-61409471b1c3}Gw64.sys
C:\Windows\System32\drivers\{ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}Gw64.sys
C:\Windows\System32\drivers\{ecd6aae4-019c-44b2-a0e5-570904275d66}Gw64.sys
2015-02-17 19:50 - 2015-02-17 21:40 - 00000000 ____D () C:\Program Files (x86)\SMaRRtComapare
2015-02-17 19:50 - 2015-02-17 19:50 - 00000000 ____D () C:\Program Files (x86)\surfikeeepiti
2015-02-15 11:30 - 2015-02-15 11:30 - 00000000 ____D () C:\ProgramData\pfmffafgdbaniofilhkiajcmjoaajiom
2015-02-15 11:30 - 2015-02-15 11:30 - 00000000 ____D () C:\Program Files (x86)\savienShoap
2015-02-15 11:30 - 2015-02-15 11:30 - 00000000 ____D () C:\Program Files (x86)\Rambler News
2015-02-13 19:46 - 2015-02-13 19:46 - 00000000 ____D () C:\Program Files (x86)\DisucounttLocator
2015-02-08 20:09 - 2015-02-08 20:09 - 00000000 ____D () C:\ProgramData\CouponFactory
2015-02-06 13:07 - 2015-02-17 21:40 - 00000000 ____D () C:\Program Files (x86)\dEaal2deualit
2015-02-06 13:07 - 2015-02-17 21:40 - 00000000 ____D () C:\Program Files (x86)\CoOlSaLeCoupon
EmptyTemp:
Hosts:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~

[external image: BY4dvz9.png]AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.
• – File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  [external image: thisisujrt.gif]
  Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
  *****
  please post
  Fixlog.txt
  C:\AdwCleaner.txt
  JRT.txt