Your Ad ExchangeTypiclayy

Usually the first click on a new page launches the redirect. I have norton and recently spent $12 for spy hunter 4 because I thought I had removed Tikotin and Trovi and Search Protect by Conduit but I dont know.

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-03-29 17:53:38
—————————–
17:53:38.252    OS Version: Windows x64 6.2.9200 
17:53:38.252    Number of processors: 4 586 0x3A09
17:53:38.253    ComputerName: LATTAVOSLAPTOP  UserName: matt
17:53:40.016    Initialize success
17:53:41.026    VM: initialized successfully
17:53:41.027    VM: Intel CPU BiosDisabled 
18:03:30.296    AVAST engine defs: 15032901
18:05:56.060    The log file has been saved successfully to "C:\Users\matt\Documents\YOURADEXCHANGE BS\aswMBR.txt"
18:07:53.747    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002d
18:07:53.749    Disk 0 Vendor: ST750LM022_HN-M750MBB 2AR20002 Size: 715404MB BusType: 11
18:07:53.913    Disk 0 MBR read successfully
18:07:53.916    Disk 0 MBR scan
18:07:53.920    Disk 0 unknown MBR code
18:07:53.924    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
18:07:53.946    Disk 0 scanning C:\WINDOWS\system32\drivers
18:08:07.179    Service scanning
18:08:09.650    Service BHDrvx64 C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\BASHDefs\20150321.001\BHDrvx64.sys **LOCKED** 5
18:08:12.980    Service eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys **LOCKED** 5
18:08:13.157    Service EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys **LOCKED** 5
18:08:16.667    Service IDSVia64 C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\IPSDefs\20150327.001\IDSvia64.sys **LOCKED** 5
18:08:20.397    Service NAVENG C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\VirusDefs\20150328.002\ENG64.SYS **LOCKED** 5
18:08:20.547    Service NAVEX15 C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\VirusDefs\20150328.002\EX64.SYS **LOCKED** 5
18:08:35.872    Modules scanning
18:08:35.879    Disk 0 trace - called modules:
18:08:35.949    ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys storport.sys hal.dll iaStorA.sys 
18:08:35.954    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000a2835060]
18:08:35.958    3 CLASSPNP.SYS[fffff8003a739170] -> nt!IofCallDriver -> [0xffffe000a2836960]
18:08:35.962    5 hpdskflt.sys[fffff8003b57e339] -> nt!IofCallDriver -> \Device\0000002d[0xffffe000a0fdc7f0]
18:08:37.185    AVAST engine scan C:\WINDOWS
18:08:40.435    AVAST engine scan C:\WINDOWS\system32
18:12:53.905    AVAST engine scan C:\WINDOWS\system32\drivers
18:13:10.491    AVAST engine scan C:\Users\matt
18:47:25.390    File: C:\Users\matt\AppData\Local\Temp\nsdD7B5.tmp  **INFECTED** Win32:Dropper-gen [Drp]
18:47:25.558    File: C:\Users\matt\AppData\Local\Temp\nsfDD81.tmp  **INFECTED** Win32:Dropper-gen [Drp]
19:02:32.644    AVAST engine scan C:\ProgramData
19:10:05.071    Disk 0 statistics 4843681/0/0 @ 0.84 MB/s
19:10:05.077    Scan finished successfully
22:49:36.567    Disk 0 MBR has been saved successfully to "C:\Users\matt\Documents\YOURADEXCHANGE BS\MBR.dat"
22:49:36.572    The log file has been saved successfully to "C:\Users\matt\Documents\YOURADEXCHANGE BS\aswMBR2.txt"

I hope this is all you needed from me for now and thank you for helping me. Please let me know what is needed from me.

OK. This should be everything you need now.

• Risks of File-Sharing Technology
• P2P Software User Advisories
• More malware is traveling on P2P networks these days

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the aforementioned programme(s), right-click and click Uninstall.

start
CreateRestorePoint:
CloseProcesses:
CustomCLSID: HKU\S-1-5-21-145684943-4197250818-2869285112-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\matt\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-145684943-4197250818-2869285112-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\matt\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
Task: {3E3AE978-E740-409E-B4F8-8AE8C8A8D12B} - System32\Tasks\VQEXDJD => C:\Users\matt\AppData\Roaming\VQEXDJD.exe <==== ATTENTION
C:\Users\matt\AppData\Roaming\VQEXDJD.exe
Task: {4F6A34DD-10AF-4465-9579-763FB5E9A274} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {52D0F590-D689-46FB-9849-BB0675CB0CC3} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {786CC5D3-69EF-4672-8058-8F6640865A02} - \ProPCCleaner_Popup No Task File <==== ATTENTION
Task: {79BF678E-3849-4F3B-819A-F834B03A0F71} - System32\Tasks\CGVW => C:\Users\matt\AppData\Roaming\CGVW.exe <==== ATTENTION
C:\Users\matt\AppData\Roaming\CGVW.exe
Task: {DFFB4D95-5ACD-4B19-9558-9679C010E04C} - \ProPCCleaner_Start No Task File <==== ATTENTION
Task: {F77EFE43-D624-47AE-A105-59B2FEA444D7} - \WindApp Update No Task File <==== ATTENTION
Task: {FAC9A473-2A07-4D2B-B420-115414ADFFAE} - System32\Tasks\PNLISMX => C:\Users\matt\AppData\Roaming\PNLISMX.exe <==== ATTENTION
C:\Users\matt\AppData\Roaming\PNLISMX.exe
Task: C:\WINDOWS\Tasks\CGVW.job => C:\Users\matt\AppData\Roaming\CGVW.exe <==== ATTENTION
C:\Users\matt\AppData\Roaming\CGVW.exe
Task: C:\WINDOWS\Tasks\PNLISMX.job => C:\Users\matt\AppData\Roaming\PNLISMX.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\VQEXDJD.job => C:\Users\matt\AppData\Roaming\VQEXDJD.exe <==== ATTENTION
C:\Users\matt\AppData\Roaming\VQEXDJD.exe
AlternateDataStreams: C:\Users\matt\OneDrive:ms-properties
AlternateDataStreams: C:\Users\matt\OneDrive.old:ms-properties
AlternateDataStreams: C:\Users\matt\SkyDrive:ms-properties
C:\Users\matt\AppData\Local\Temp\nsdD7B5.tmp
C:\Users\matt\AppData\Local\Temp\nsfDD81.tmp
HKU\S-1-5-21-145684943-4197250818-2869285112-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://tikotin.com
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co…&l=dis&o=HPNTDF
SearchScopes: HKLM -> {8621D76B-511F-4041-8473-223542C58346} URL = http://www.amazon.co…s={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo….psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co…&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {8621D76B-511F-4041-8473-223542C58346} URL = http://www.amazon.co…s={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo….psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co…54371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-145684943-4197250818-2869285112-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co…&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-145684943-4197250818-2869285112-1001 -> {8621D76B-511F-4041-8473-223542C58346} URL = http://www.amazon.co…s={searchTerms}
SearchScopes: HKU\S-1-5-21-145684943-4197250818-2869285112-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo….psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-145684943-4197250818-2869285112-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co…54371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
CHR HKLM-x32\…\Chrome\Extension: [ihenkjeihefokohmemphikjnjbmegdik] - "C:\Program Files (x86)\Sony\Media Go\MediaGoDetector.crx" [Not Found]
S1 cherimoya; system32\drivers\cherimoya.sys [X]
2015-03-08 22:23 - 2015-03-29 22:23 - 00001360 _____ () C:\WINDOWS\Tasks\CGVW.job
2015-03-08 22:23 - 2015-03-08 22:23 - 00004378 _____ () C:\WINDOWS\System32\Tasks\CGVW
2015-03-08 21:28 - 2015-03-08 21:29 - 00004726 _____ () C:\WINDOWS\System32\Tasks\PNLISMX
2015-03-08 21:28 - 2015-03-08 21:28 - 00003566 _____ () C:\WINDOWS\System32\Tasks\KAXQH
2015-03-08 21:27 - 2015-03-29 21:28 - 00001710 _____ () C:\WINDOWS\Tasks\PNLISMX.job
2015-03-08 21:27 - 2015-03-29 21:27 - 00001710 _____ () C:\WINDOWS\Tasks\VQEXDJD.job
2015-03-08 21:27 - 2015-03-08 21:28 - 00004726 _____ () C:\WINDOWS\System32\Tasks\VQEXDJD
C:\Users\matt\AppData\Local\Temp\EsgInstallerx64Stub.exe
C:\Users\matt\AppData\Local\Temp\Extract.exe
C:\Users\matt\AppData\Local\Temp\SP59927.exe
EmptyTemp:
Hosts:
End

• Double-click on the setup file (mbam-setup.exe), then click on Run to install.
• Malwarebytes will automatically open to it's Dashboard. If you have never run this version, you should see a red note at the top indicating "A scan has never been run on your system"
• Click on Update Now to download the current database definitions, then click the Scan Now >> button.
• If you have run this version before, you should see a green note at the top indicating "Your system is fully protected".
• You will be prompted to update Malwarebytes…click on the Update Now button.
• The THREAT SCAN will automatically begin.
• When the scan has completed, the results will be displayed. Click on Quarantine All, then click on Apply Actions.
• To complete any actions taken you will be prompted to restart your computer…click on Yes. Failure to reboot normally will prevent Malwarebytes from removing all the malware.
• After rebooting the computer, copy and paste the mbam.log in your next reply.
• To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 1)
  • Open Malwarebytes Anti-Malware.
  • Click the History Tab at the top and select Application Logs.
  • Select (check) the box next to Scan Log. Choose the most current scan.
  • Click the View button.
  • Click Copy to Clipboard at the bottom…come back to this thread, click Add Reply, then right-click and choose Paste.
  • Alternatively, you can click Export and save the log as a .txt file on your Desktop or another location.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 2)
  • Open Malwarebytes Anti-Malware.
  • Click the Scan Tab at the top.
  • Click the View detailed log link on the right.
  • Click Copy to Clipboard at the bottom…come back to this thread, click Add Reply, then right-click and choose Paste.
  • Alternatively, you can click Export and save the log as a .txt file on your Desktop or another location.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  Logs are named by the date of scan in the following format: mbam-log-yyyy-mm-dd and automatically saved to the following locations:
  – XP: C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-yyyy-mm-dd
  – Vista, Windows 7/8: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-yyyy-mm-dd
  
  Please post
  file requested scanned
  Fixlog.txt
  Malwarebytes Anti-Malware