Please help

Hi and welcome

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.
 
~~~~~~~~~~~~~

Running from C:\Users\[removed]\Downloads

It's best we move Farbar's to desktop.

Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.


Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


[external image: FRSTfix.JPG]

 

start
CreateRestorePoint:
CloseProcesses:
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
HKLM\…\AppCertDlls: [x64] -> c:\program files\settings manager\systemk\x64\sysapcrt.dll
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {253C47C6-A263-4056-AFAD-6046361B8A2A} URL =
SearchScopes: HKU\S-1-5-21-4147716943-903763243-1518506203-1001 -> {253C47C6-A263-4056-AFAD-6046361B8A2A} URL = http://search.condui…7178701164&UM=2
FF user.js: detected! => C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\user.js [2014-10-05]
FF user.js: detected! => C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\4st1tlx8.Default User 3\user.js [2014-10-05]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\browser\plugins\npMozCouponPrinter.dll [2012-10-19] (Coupons, Inc.)
CHR HKLM\…\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [Not Found]
CHR HKLM\…\Chrome\Extension: [lgnbhdnimikkoodkogjlcllngimhlapp] - C:\Program Files\FTDownloader.com\FTDownloader10.crx [Not Found]
2015-03-22 19:28 - 2014-10-05 20:40 - 00000000 ____D () C:\Program Files\Web Protect
C:\Users\Dads\26.05.03.EXE
C:\Users\Dads\3510 print driver.exe
C:\Users\Dads\Adaware_Installer.exe
C:\Users\Public\AlexaNSISPlugin.5812.dll
Task: {83575147-0FC4-47FB-9095-F25055CBDBC8} - System32\Tasks\DIS => C:\Users\Dads\AppData\Roaming\DIS.exe <==== ATTENTION
Task: C:\Windows\Tasks\DIS.job => C:\Users\Dads\AppData\Roaming\DIS.exe <==== ATTENTION
C:\Users\Dads\AppData\Roaming\DIS.exe
Task: {B635ABB1-EBA1-4FD1-9925-07B832C82EC8} - \BackgroundContainer Startup Task No Task File <==== ATTENTION
Task: {E4A7F9D2-C4A4-4EA9-B8F0-936B55EEE09E} - System32\Tasks\LWBVSUPC => C:\Users\Dads\AppData\Roaming\LWBVSUPC.exe <==== ATTENTION
Task: C:\Windows\Tasks\LWBVSUPC.job => C:\Users\Dads\AppData\Roaming\LWBVSUPC.exe <==== ATTENTION
C:\Users\Dads\AppData\Roaming\LWBVSUPC.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pcwatch.sys => ""="Driver" <==== ATTENTION
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect => ""="service" <==== ATTENTION
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\pcwatch.sys => ""="Driver" <==== ATTENTION
EmptyTemp:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~``

[external image: BY4dvz9.png]AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

– File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~`

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Double-click on the setup file (mbam-setup.exe), then click on Run to install.
• Malwarebytes will automatically open to it's Dashboard. If you have never run this version, you should see a red note at the top indicating "A scan has never been run on your system"
• Click on Update Now to download the current database definitions, then click the Scan Now >> button.
• If you have run this version before, you should see a green note at the top indicating "Your system is fully protected".
• You will be prompted to update Malwarebytes…click on the Update Now button.
• The THREAT SCAN will automatically begin.
• When the scan has completed, the results will be displayed. Click on Quarantine All, then click on Apply Actions.
• To complete any actions taken you will be prompted to restart your computer…click on Yes. Failure to reboot normally will prevent Malwarebytes from removing all the malware.
• After rebooting the computer, copy and paste the mbam.log in your next reply.

To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 1)

• Open Malwarebytes Anti-Malware.
• Click the History Tab at the top and select Application Logs.
• Select (check) the box next to Scan Log. Choose the most current scan.
• Click the View button.
• Click Copy to Clipboard at the bottom…come back to this thread, click Add Reply, then right-click and choose Paste.
• Alternatively, you can click Export and save the log as a .txt file on your Desktop or another location.
• Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 2)

• Open Malwarebytes Anti-Malware.
• Click the Scan Tab at the top.
• Click the View detailed log link on the right.
• Click Copy to Clipboard at the bottom…come back to this thread, click Add Reply, then right-click and choose Paste.
• Alternatively, you can click Export and save the log as a .txt file on your Desktop or another location.
• Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Logs are named by the date of scan in the following format: mbam-log-yyyy-mm-dd and automatically saved to the following locations:
– XP: C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-yyyy-mm-dd
– Vista, Windows 7/8: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-yyyy-mm-dd
 
~~~~~~~~~~
please post
fixlist.txt
AdwCleaner.txt
Malwarebytes Anti-Malware\Logs

Good deal

Now let's remove a couple of things

• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner.txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner.txt) will open. Copy the contents of the log and paste in your next reply.
  
  – File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
• 
  

Tell me how the computer is now?

Fire Fox now works as expected after setting up a new profile.  Thunderbird will open if ran as administrator, I am guessing that needs a new profile as well. As for IE it's still unresponsive and crashes when windows searches for a fix.

When you ran AdwCleaner did you allow it to clean what it found?

please download Windows Repair (all in one) from here

[external image: step-4-tab.jpg]
Install the program then go to step 4 and create a new system restore point and new registry backup.

Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:
[external image: p22001645.gif]



NEXT
On the the Start Repairs tab => Click the Start
[external image: start-repairs-tab.jpg]


Please ensure that ONLY items seen in the image below are ticked as indicated (they're all checked by default):
[external image: p22001647.gif]

Click on box next to the Restart System when Finished. Then click on Start.

Yes I did clean the 4 items that Adw did find. I also ran the windows repair program and everything seems to be up and running as it should. 

 

Thank you 

Ed

Good to hear


What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
Most reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.


[external image: GzlsbnV.png]ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.


Please run a free online scan with the ESET Online Scanner

US Link: http://www.eset.com/us/online-scanner/
EU Link: http://www.eset.eu/online-scanner/

Windows Vista/Windows 7/Windows 8 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.

• Turn off the real time scanner of any existing antivirus program while performing the online scan.
• Click the blue Run ESET Online Scanner button
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the program to install the "OnlineScanner.cab" activex control by clicking the Install button
• Once the activex control is installed, on the next screen click on Enable detection of potentially unwanted applications
• Click on Advanced Settings
• Make sure that the option Remove found threats is unticked.
• Ensure these options are ticked
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Under "Current Scan Targets" > click "change" and ensure all your drives are selected
• Click Start
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
• Save that text file on your desktop. Attach the log as a reply to your next reply..
• Close the ESET online scan, and let me know how things are now.

Here are the results for the eset scan:

 

 

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
 

start
CreateRestorePoint:
CloseProcesses:
C:\Users\Dads\AppData\Roaming\DIS
C:\Users\Dads\AppData\Roaming\LWBVSUPC
C:\Users\Dads\Documents\Mom's Stuff\beth\winzip180.exe
C:\Users\Dads\Downloads\ccsetup328.exe
C:\Users\Dads\Downloads\ccsetup414.exe
C:\Users\Dads\Downloads\ccsetup417 (1).exe
C:\Users\Dads\Downloads\ccsetup417.exe
C:\Users\Dads\Downloads\PDFCreator-1_7_1_setup.exe
C:\Users\Dads\Downloads\PlayFizzSetup.exe
C:\Users\Public\xp share\Tranfers\My Program Setup Files\ccsetup315.exe
C:\Users\Public\xp share\Tranfers\My Program Setup Files\winzip16-32.exe
EmptyTemp:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Please post this log and tell me how your computer is now.

I think your good to go!

[external image: AFZxnZc.jpg] DelFix

• Please download DelFix
  or from here http://www.bleepingcomputer.com/download/delfix/and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
• Click the Run button.

– This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

~~~~

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
  
  

The following programmes come highly recommended in the security community.

• [external image: xKsUqI5A.png.pagespeed.ic.vn1Hlvqi8h.jpg]AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
• [external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• [external image: x6YRrgUC.png.pagespeed.ic.HjgFxjvw2Z.jpg]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• [external image: xjv4nhMJ.png.pagespeed.ic.A5YbWn1eDO.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• [external image: DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png]Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• [external image: xj1OLIec.png.pagespeed.ic.k6hhwopU0q.jpg]SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• [external image: xJEP5iWI.png.pagespeed.ic.4tmM1lM7DQ.png]Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

Want to help others? Join the ClassRoom and learn how.

Thats good to hear. My machine seems to be doing very good.

 

Thank you, for all your help.

Ed

We're glad to help