Combofix

[foxygrandma]

 

when I tried combo fix, I got this message:    combofix is not meant to run in compatibility mode.  the program shall now exit

I did a search and found this:  Combofix only runs on:

*Windows Xp (32bit)
 *Windows Vista (32bit/64bit)
 *Windows 7 (32bit/64 bit)
NOT on windows 8 or Mac OS.

I am on Windows 8.1.    grrrrrrr!

[SuperDave]

Your profile shows that you're running Windows 7

*************************************************
Please download AdwCleaner by Xplode onto your Desktop.

Before starting AdwCleaner, close all open programs and internet browsers, then double-click on the AdwCleaner icon.



If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
When the AdwCleaner program will open, click on the Scan button as shown below.



AdwCleaner will now start to search for malicious files that may be installed on your computer.
To remove the files that were detected in the previous step, please click on the Clean button.



AdwCleaner will now prompt you to save any open files or data as the program will need to reboot the computer. Please do so and then click on the OK button. AdwCleaner will now delete all detected adware from your computer. When it is done it will display an alert that explains what PUPs (Potentially Unwanted Programs) and Adware are. Please read through this information and then press the OK button. You will now be presented with an alert that states AdwCleaner needs to reboot your computer.
Please click on the OK button to allow AdwCleaner reboot your computer.A log will be produced. Please copy and paste this log in your next reply.
**********************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
****************************************************
Please download Junkware Removal Tool to your desktop.

•Warning! Once the scan is complete JRT will shut down your browser with NO warning.

•Shut down your protection software now to avoid potential conflicts.

•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator

•The tool will open and start scanning your system.

•Please be patient as this can take a while to complete depending on your system's specifications.

•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

•Copy and Paste the JRT.txt log into your next message.

[foxygrandma]

Your profile shows that you're running Windows 7

sorry, was sure I had changed it to 8.1  Again, duh!

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by ownerpc on 04/12/14 at 23:24:00.15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia"
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\ownerpc\AppData\Roaming\software informer"
Successfully deleted: [Folder] "C:\Users\ownerpc\AppData\Roaming\systweak"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\ownerpc\AppData\Roaming\mozilla\firefox\profiles\rft7qypj.default\extensions\staged



~~~ Event Viewer Logs were cleared
***************************************
# AdwCleaner v3.023 - Report created 12/04/2014 at 20:33:26
# Updated 01/04/2014 by Xplode
# Operating System : Windows 8.1  (64 bits)
# Username : ownerpc - HOMECOMPUTER
# Running from : C:\Users\ownerpc\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : NewPlayerUpdaterService

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewPlayer
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Elite Max
Folder Deleted : C:\Program Files (x86)\NewPlayer
Folder Deleted : C:\Program Files (x86)\Optimizer Elite Max
Folder Deleted : C:\Program Files (x86)\orbitdownloader
Folder Deleted : C:\Program Files (x86)\Secure Speed Dial
Folder Deleted : C:\Users\ownerpc\AppData\Local\BrowserSafeguard
Folder Deleted : C:\Users\ownerpc\AppData\Local\CrashRpt
Folder Deleted : C:\Users\ownerpc\AppData\Local\iLivid
Folder Deleted : C:\Users\ownerpc\AppData\Local\NewPlayer
Folder Deleted : C:\Users\ownerpc\AppData\Local\Tuguu_SL
Folder Deleted : C:\Users\ownerpc\AppData\Local\visi_coupon
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\DigitalSites
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\Optimizer Elite Max
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\Systweak
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\rft7qypj.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\rft7qypj.default\Extensions\[email protected]
Folder Deleted : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\t47u0s3z.default\Extensions\[email protected]
File Deleted : C:\END
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\adawaretb.xml
File Deleted : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\rft7qypj.default\user.js
File Deleted : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\t47u0s3z.default\user.js
File Deleted : C:\WINDOWS\System32\Tasks\LaunchApp

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\iLivid.torrent
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7854F00C-DC77-477E-A10E-603F48442D3B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\WEDLMNGR
Key Deleted : HKLM\Software\AVG SafeGuard toolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Opener Packages

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17037


-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\rft7qypj.default\prefs.js ]

Line Deleted : user_pref("browser.search.selectedEngine", "Mysearchdial");
Line Deleted : user_pref("yahoo.ytff.toolbar.orignalhomepage", "hxxp://search.conduit.com/?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&ISID=M489386B8-AD3E-4D4E-8094-3D922376DF69&SearchSource=55&CUI=&UM=5&UP=SP6115F693[...]
Line Deleted : user_pref("CT1561552.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"false\"}");

[ File : C:\Users\ownerpc\AppData\Roaming\Mozilla\Firefox\Profiles\t47u0s3z.default\prefs.js ]

Line Deleted : user_pref("browser.search.selectedEngine", "Mysearchdial");

-\\ Google Chrome v

[ File : C:\Users\ownerpc\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : icon_url
Deleted : search_url
Deleted : keyword

*************************

AdwCleaner[R7].txt - [6187 octets] - [12/04/2014 20:32:21]
AdwCleaner[S6].txt - [5808 octets] - [12/04/2014 20:33:26]

########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [5868 octets] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by ownerpc on 04/12/14 at 23:24:00.15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia"
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\ownerpc\AppData\Roaming\software informer"
Successfully deleted: [Folder] "C:\Users\ownerpc\AppData\Roaming\systweak"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\ownerpc\AppData\Roaming\mozilla\firefox\profiles\rft7qypj.default\extensions\staged



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04/13/14 at  0:11:39.14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[SuperDave]

Malwarebytes' Anti-Rootkit

Please download Malwarebytes' Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page for performing a scan.
• Caution: This is a beta version so also read the disclaimer and back up all your data before using.
  
• When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
  
• Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
• Copy and paste the contents of these two log files in your next reply.

[foxygrandma]

Your profile shows that you're running Windows 7

sorry, was sure I had changed it to 8.1  Again, duh!

ok have not tried a beta before

[SuperDave]

Please hit the quote button when you reply. It makes the thread too long. Were you able to run the MBAM rootkit scan?

[foxygrandma]

Thought I was using Quote.  What have I be
en using?  Thought I had sent that  mbam scan.    Here it is:


<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/04/12 22:37:06 -0400</date>
<log>mbam-log-2014-04-12 (21-31-13).xml</log>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.1.1004</version>
<rules-database>v2014.04.12.07</rules-database>
<swissarmy-database>v2014.03.27.01</swissarmy-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 8.1</osversion>
<arch>x64</arch>
<username>ownerpc</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>290274</objects>
<time>3951</time>
<processes>0</processes>
<modules>0</modules>
<keys>10</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>3</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>enabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<shuriken>enabled</shuriken>
<pup>warn</pup>
<pum>warn</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3cf91e66-0d94-4857-b592-da1600c734cf}</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>13edbc4407f9ce32a57f53f73ac87f81</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{681988e8-68c5-449f-9334-3f64cc87d230}</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>13edbc4407f9ce32a57f53f73ac87f81</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{FA292998-EF9D-4F39-A13C-7E04BE76B082}</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>13edbc4407f9ce32a57f53f73ac87f81</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FA292998-EF9D-4F39-A13C-7E04BE76B082}</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>13edbc4407f9ce32a57f53f73ac87f81</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{681988e8-68c5-449f-9334-3f64cc87d230}</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>13edbc4407f9ce32a57f53f73ac87f81</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3CF91E66-0D94-4857-B592-DA1600C734CF}</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>13edbc4407f9ce32a57f53f73ac87f81</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\BrowseBurst</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>21df3fc120e0a55b00e54b2024de2dd3</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\InboxAce_1g</path><vendor>PUP.Optional.MindSpark.A</vendor><action>success</action><hash>26da87794db3d32d8b49c5e316ed6d93</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update BrowseBurst</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>success</action><hash>679945bb3bc5926e885eda9159a9b54b</hash></key>
<key><path>HKU\S-1-5-21-1795811005-3349474535-1654682835-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BrowseBurst</path><vendor>PUP.Optional.BrowseBurst.A</vendor><action>delete-on-reboot</action><hash>ad532ad6728e4fb1f3f18ddec939847c</hash></key>
<file><path>C:\Users\ownerpc\Desktop\PhotoScape_V3.6.5(1).exe</path><vendor>PUP.Optional.OpenCandy</vendor><action>success</action><hash>a55bb848be4225dbb66a84bf6f950000</hash></file>
<file><path>C:\Users\ownerpc\Downloads\windows 7 sp1 included setup.exe</path><vendor>PUP.Optional.Soft32.A</vendor><action>success</action><hash>cf3135cbac547987349a90a19a678779</hash></file>
<file><path>C:\Users\ownerpc\Downloads\setup_ic.exe</path><vendor>PUP.Optional.Bundlore</vendor><action>success</action><hash>ce3213eda15f5ca4d6979f765fa537c9</hash></file>
</items>
</mbam-log>








ok have not tried a beta before

[SuperDave]

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan

•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.

• Leave the check mark next to Remove found threats.
  

•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[foxygrandma]

Thought I was using Quote.  What have I be
en using?  do not understand the eset antivirus.  tried it twice and it showed threats.   I tried to copy them but could not.  After I pressed clean and rebooted there was not a log file to send

[SuperDave]

Ok, please give me an update about how your computer is now. Are you still hearing updates from your AV?

[foxygrandma]

yes, from Avast which is  now in my task bar where it had not been  since I did an original install some time ago, but I was able to disable it  Avira is In the task bar also and neither is installed

[SuperDave]

I'm not even sure that this will work on Win 8 but let's give it a try.
When you're ready to post the logs just click on Reply at the bottom of the thread and paste your logs. Which AV do you want to use?

Download DDS from HERE or HERE and save it to your desktop.

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs.
* Save both reports to your desktop.
* The instructions here ask you to attach the Attach.txt.



1) DDS.txt
2) Attach.txt
Instead of attaching, please copy/past both logs into your Thread

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.

•Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.
After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE .Then post your DDS logs. (DDS.txt and Attach.txt )

[foxygrandma]

not sure what you mean by disconnect from the internet.   I am on Bright House wireless.  Am I supposed  to call them and have them disconnect me?

[SuperDave]

not sure what you mean by disconnect from the internet.   I am on Bright House wireless.  Am I supposed  to call them and have them disconnect me?

No, just click on Start, Control Panel and click on NetWork Connections. You can disable your wireless connection there.
Please stop hitting the quote button when you respond. Just click on Reply at the bottom.

[foxygrandma]

first I am told to hit the quote button, now I am told to hit the reply button.    Sometimes there is not a reply button.