Wondershare Helper Compact popup [Solved]

Thank you SuperHelper!

 

Here is the FRST output first. Addition.txt is below it.

 

Really appreciate your help!

 

 

 

The below needs to be removed from add/remove programs list
Ask Shopping Toolbar (HKLM-x32\…\{4F524A00-6A76-A76A-76A7-A758B70C2D01}) (Version: 12.45.1.45 - APN, LLC) <==== ATTENTION

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


[external image: FRSTfix.JPG]

 

start
CreateRestorePoint:
CloseProcesses:
C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
HKLM-x32\…\Run: [ApnTBMon] => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
HKLM-x32\…\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1980416 2013-12-18] (Wondershare)
HKLM-x32\…\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\AllMyTube\DelayPluginI.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
URLSearchHook: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
URLSearchHook: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020303877 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
URLSearchHook: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020309769 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000 -> {D435A69C-0015-4946-B1AF-375153AB8146} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^TV&apn_dtid=^OSJ000^YY^US&apn_uid=70FC8DC9-06E6-42DF-8D58-88640BE0DC0B&apn_sauid=28DC5587-C78D-4AE7-9F7C-4EE57A7CDD6D
SearchScopes: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020303877 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020303877 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&o=APN11913&l=dis&prt=NSBU&chn=1000&geo=US&ver=22&locale=en_US&gct=kwd&qsrc=2869
SearchScopes: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020303877 -> {D435A69C-0015-4946-B1AF-375153AB8146} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^TV&apn_dtid=^OSJ000^YY^US&apn_uid=70FC8DC9-06E6-42DF-8D58-88640BE0DC0B&apn_sauid=28DC5587-C78D-4AE7-9F7C-4EE57A7CDD6D
earchScopes: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020309769 -> {D435A69C-0015-4946-B1AF-375153AB8146} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^TV&apn_dtid=^OSJ000^YY^US&apn_uid=70FC8DC9-06E6-42DF-8D58-88640BE0DC0B&apn_sauid=28DC5587-C78D-4AE7-9F7C-4EE57A7CDD6D
BHO: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll [2016-11-09] (APN LLC.)
BHO-x32: Wondershare AllMyTube 4.9.0 -> {067DF9EC-26B7-40DC-8DB8-CD8BE85AE367} -> C:\ProgramData\Wondershare\AllMyTube\WSBrowserAppMgr.dll => No File
BHO-x32: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll [2016-11-09] (APN LLC.)Toolbar: HKLM - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll [2016-11-09] (APN LLC.)
Toolbar: HKLM-x32 - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll [2016-11-09] (APN LLC.)
Toolbar: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000 -> Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll [2016-11-09] (APN LLC.)
Toolbar: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020303877 -> Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll [2016-11-09] (APN LLC.)
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\rmdpms5t.default -> Ask.com
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\rmdpms5t.default -> Ask.com
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\ProgramData\Wondershare\AllMyTube\AllMyTube@Wondershare.com_xpi => not found
CustomCLSID: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020303877_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Mr. Sneezy\AppData\Local\Citrix\GoToMeeting\4190\G2MOutlookAddin64.dll => No File
CustomCLSID: HKU\S-1-5-21-1976175552-1545808057-1820624764-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01262017020309769_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Mr. Sneezy\AppData\Local\Citrix\GoToMeeting\4190\G2MOutlookAddin64.dll => No File
ShortcutWithArgument: C:\Users\Mr. Sneezy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Chromebook Recovery Utility.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1" –app-id=jndclpdbaamdhonoechobihbbiimdgai
ShortcutWithArgument: C:\Users\Mr. Sneezy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory="Profile 1"
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
AlternateDataStreams: C:\Users\Mr. Sneezy\.DS_Store:AFP_AfpInfo [122]
AlternateDataStreams: C:\Users\Mr. Sneezy\Documents\.DS_Store:AFP_AfpInfo [122]
EmptyTemp:
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~

[external image: BY4dvz9.png]AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
  In order to use AdwCleaner, you have to agree the Eula:
• Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click [external image: A49sxPr.png]Scan.
• Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
• Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
• Click [external image: MqHawIb.png]Clean.
• Follow the prompts and allow your computer to reboot.
• After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

Hi Juliet,

 

Today, before running AdwCleaner and Junkware, I tried to uninstall the Ask Shopping program, but the computer just kind of hung and couldn't do it. Bummer that I didn't do this at the beginning as you suggested. It's still there after running AdwCleaner and Junkware, but it looks like a lot of the guts of it were removed. Should I try to uninstall it again through the control panel?

 

What were these things that were on my computer and was the info on my computer compromised in some way? Uggh.

 

Thanks Juliet, you have been so helpful. The logs requested are below.

 

Which software/antivirus programs do you recommend using on the computer? I have both Norton 360 and MalwareBytes installed, but temporarily turned off. Any recos there would be great so I don't have to go through this again.

 

Thank you, thank you, thank you.

 

Scott