Ännu en Awesomehp

11 februari, 2014

Märkte igår att min webbläsare har ändrats till awesomehp, när eller hur vet jag inte riktigt. Jag använder både internet explorer och google chorme. Körde Spyhunter efter rekommendation från olika sidor på google men de vill ju ha betalt (och hittade dessutom 1000 andra virus i datorn? till exempel thorntv).

Har försökt få bort awesomehp men ingenting hjälper, har kört Norton Power eraser men inte heller det hjälper.

Väldigt tacksam för hjälp.

Anna

11 februari, 2014

Hej Anna!

SpyHunter kan man inte lita på så avinstallera det programmet.

Det verkar vara en riktig epidemi av Awesomehp nu

Nedanstående lista kan se ut som mycket men ta det bara stegvis så går det bra och fråga om det är något som är oklart.

1. Ladda ner Malwarebytes Anti-Malware Free (MBAM) från http://www.malwarebytes.org/

Dubbelklicka på mbam-setup för att installera programmet.

Se till i slutet av installationen att det är bockar för:

Uppdatera Malwarebytes' Anti-Malware

Starta Malwarebytes' Anti-Malware

Klicka på Slutför

Om det finns någon uppdatering så kommer den att laddas ner och installeras.

När programmet startar så välj Utför fullständig skanning och klicka på Skanna.

Skanningen tar ett tag.

När den är klar så klicka på OK och sedan Visa resultat.

Bocka för allt och tryck sedan Ta bort markerade.

När borttagningen är klar så öppnar Anteckningar med en logg.

Eventuellt så kommer det upp en begäran om att starta om datorn (Restart). I så fall gör det.

Om det blir ett felmeddelande Error loading... efter omstarten så starta om datorn än en gång.

Om programmet inte kommer igång efter omstarten så starta det.

Om loggen inte kommer upp själv i Anteckningar så hittar du loggen på fliken Loggar i MBAM.

Kopiera loggen och klistra in den i ditt svar.

2. Spara ShortcutCleaner på skrivbordet: http://www.bleepingcomputer.com/download/shortcut-cleaner/dl/172/

Starta den nedladdade filen ss-cleaner.exe.

Vänta tills den är klar.

En rapport kommer upp, bifoga den till ditt svar.

3. Spara AdwCleaner av Xplode på Skrivbordet: http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner

Stäng alla program, inklusive webbläsare.

Dubbelklicka på AdwCleaner för att starta programmet.

Klicka på Scan-knappen.

Vänta tills sökningen är klar.

Klicka på Report-knappen.

En rapport kommer upp, kopiera innehållet och klistra in i ditt svar.

Om rapporten inte kommer upp, så finns den även som C:\AdwCleaner[R0].txt

4. Ladda ner Farbar Recovery Scan Tool (FRST) och spara på skrivbordet.

För 64-bitars Windows: http://download.bleepingcomputer.com/farbar/FRST64.exe

För 32-bitars Windows: http://download.bleepingcomputer.com/farbar/FRST.exe

Starta FRST.

Läs villkoren för programmet.

Klicka på Yes för att acceptera.

Klicka på Scan-knappen.

När det är klart kommer det att ha skapats två loggar FRST.txt och Addition.txt på skrivbordet.

Om du använder en annan webbläsare än Internet Explorer 11, klistra in innehållet i FRST.txt direkt i ditt svar och bifoga Addition.txt.

Om du använder Internet Explorer 11, får du bifoga båda loggarna till ditt svar.

Klicka på Använd fullständig editor för att se hur du bifogar filer.

11 februari, 2014

Tack så hemskt mycket för svar! Ska sätta igång när jag kommer hem. Spelar det någon roll att jag använder två webbläsare? Det tar bort problemet i hela datorn...antar jag?

11 februari, 2014

Ingen orsak

Det är meningen att Awesomehp ska försvinna från åtminstone Internet Explorer, Firefox och Chrome.

11 februari, 2014

här kommer från MBAM, det blev två och den första för lång att klistra in, hoppas det fungerar såhär:

file:///C:/Users/Anna/Desktop/mbam-log-2014-02-11%20(18-36-29).txt

nummer två:

2014/02/11 18:33:47 +0100 ANNAERIKSSON Anna MESSAGE Executing scheduled update: Daily

2014/02/11 18:34:11 +0100 ANNAERIKSSON Anna MESSAGE Starting protection

2014/02/11 18:34:11 +0100 ANNAERIKSSON Anna MESSAGE Protection started successfully

2014/02/11 18:34:11 +0100 ANNAERIKSSON Anna MESSAGE Starting IP protection

2014/02/11 18:34:50 +0100 ANNAERIKSSON Anna MESSAGE IP Protection started successfully

2014/02/11 18:35:13 +0100 ANNAERIKSSON Anna MESSAGE Starting database refresh

2014/02/11 18:35:13 +0100 ANNAERIKSSON Anna MESSAGE Scheduled update executed successfully: database updated from version v2013.04.04.07 to version v2014.02.11.08

2014/02/11 18:35:13 +0100 ANNAERIKSSON Anna MESSAGE Stopping IP protection

2014/02/11 18:35:24 +0100 ANNAERIKSSON Anna MESSAGE IP Protection stopped successfully

2014/02/11 18:35:34 +0100 ANNAERIKSSON Anna MESSAGE Database refreshed successfully

2014/02/11 18:35:34 +0100 ANNAERIKSSON Anna MESSAGE Starting IP protection

2014/02/11 18:35:43 +0100 ANNAERIKSSON Anna MESSAGE IP Protection started successfully

2014/02/11 19:24:53 +0100 ANNAERIKSSON Anna IP-BLOCK 93.174.93.67 (Type: incoming, Port: 21320, Process: svchost.exe)

2014/02/11 20:00:03 +0100 ANNAERIKSSON Anna IP-BLOCK 93.174.93.67 (Type: incoming, Port: 21320, Process: svchost.exe)

2014/02/11 20:35:57 +0100 ANNAERIKSSON (null) MESSAGE Starting protection

2014/02/11 20:35:57 +0100 ANNAERIKSSON (null) MESSAGE Protection started successfully

2014/02/11 20:35:57 +0100 ANNAERIKSSON (null) MESSAGE Starting IP protection

2014/02/11 20:36:05 +0100 ANNAERIKSSON (null) MESSAGE IP Protection started successfully

11 februari, 2014

från shortcut cleaner:

Shortcut Cleaner 1.2.8 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Shortcut Cleaner can be found at this link:

http://www.bleepingcomputer.com/download/shortcut-cleaner/

Windows Version: Windows 7 Home Premium Service Pack 1

Program started at: 02/11/2014 08:53:09 PM.

Scanning for registry hijacks:

* No issues found in the Registry.

Searching for Hijacked Shortcuts:

Searching C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

Searching C:\ProgramData\Microsoft\Windows\Start Menu\

* Shortcut Cleaned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

Searching C:\Users\Anna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk => C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

* Shortcut Cleaned: C:\Users\Anna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk => C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

Searching C:\Users\Public\Desktop\

Searching C:\Users\Anna\Desktop

8 bad shortcuts found.

Program finished at: 02/11/2014 08:53:17 PM

Execution time: 0 hours(s), 0 minute(s), and 8 seconds(s)

11 februari, 2014

ADWcleaner:

# AdwCleaner v3.018 - Report created 11/02/2014 at 20:58:27

# Updated 28/01/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Anna - ANNAERIKSSON

# Running from : C:\Users\Anna\Downloads\adwcleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser

File Found : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

Folder Found C:\Program Files (x86)\Ask.com

Folder Found C:\Program Files (x86)\Common Files\337

Folder Found C:\Program Files (x86)\Conduit

Folder Found C:\Program Files (x86)\Movies Toolbar

Folder Found C:\Program Files (x86)\registry mechanic

Folder Found C:\ProgramData\Ask

Folder Found C:\ProgramData\BitGuard

Folder Found C:\ProgramData\Browser Manager

Folder Found C:\ProgramData\BrowserProtect

Folder Found C:\ProgramData\Partner

Folder Found C:\Users\Anna\AppData\Local\apn

Folder Found C:\Users\Anna\AppData\Local\Conduit

Folder Found C:\Users\Anna\AppData\Local\Ilivid

Folder Found C:\Users\Anna\AppData\Local\ilividmoviestoolbardla

Folder Found C:\Users\Anna\AppData\LocalLow\AskToolbar

Folder Found C:\Users\Anna\AppData\LocalLow\Conduit

Folder Found C:\Users\Anna\AppData\LocalLow\ConduitEngine

Folder Found C:\Users\Anna\AppData\LocalLow\ilividmoviestoolbardla

Folder Found C:\Users\Anna\AppData\LocalLow\PriceGong

Folder Found C:\Users\Anna\AppData\LocalLow\searchresultstb

Folder Found C:\Users\Anna\AppData\Roaming\registry mechanic

Folder Found C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Found : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~2\movies~1\datamngr\x64\mgrldr.dll

Data Found : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~3\Wincert\WIN64C~1.DLL

Key Found : HKCU\Software\APN

Key Found : HKCU\Software\APN DTX

Key Found : HKCU\Software\AppDataLow\Software\AskToolbar

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\ilividmoviestoolbardla

Key Found : HKCU\Software\AppDataLow\Software\PriceGong

Key Found : HKCU\Software\AppDataLow\Software\smartbar

Key Found : HKCU\Software\Ask.com

Key Found : HKCU\Software\installedbrowserextensions

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Found : HKCU\Software\Softonic

Key Found : [x64] HKCU\Software\APN

Key Found : [x64] HKCU\Software\APN DTX

Key Found : [x64] HKCU\Software\Ask.com

Key Found : [x64] HKCU\Software\installedbrowserextensions

Key Found : [x64] HKCU\Software\Softonic

Key Found : HKLM\Software\APN

Key Found : HKLM\Software\AskToolbar

Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\Desksvc

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EC2BAE47-25AF-4CE9-9E78-10627A49C9EA}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Found : HKLM\Software\V9

Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EC2BAE47-25AF-4CE9-9E78-10627A49C9EA}]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Value Found : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]

Value Found : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]

Value Found : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]

Value Found : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]

Value Found : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls [x64]

Value Found : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls [x86]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [7431 octets] - [11/02/2014 20:58:27]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [7491 octets] ##########

11 februari, 2014

och så från FRST

Addition.txt

FRST.txt

11 februari, 2014

Åh, nu kommer inte awesomehp upp längre när jag startar webläsaren

Men jag kanske ska göra något ytterligare (tänker på alla bifogningar?)

Skönt att det finns hjälp som du, Cecilia. Det här är raketforskning för mig. Tack för din hjälp!

11 februari, 2014

här kommer från MBAM, det blev två och den första för lång att klistra in, hoppas det fungerar såhär:

file:///C:/Users/Anna/Desktop/mbam-log-2014-02-11%20(18-36-29).txt

nummer två:

2014/02/11 18:33:47 +0100 ANNAERIKSSON Anna MESSAGE Executing scheduled update: Daily

2014/02/11 18:34:11 +0100 ANNAERIKSSON Anna MESSAGE Starting protection

2014/02/11 18:34:11 +0100 ANNAERIKSSON Anna MESSAGE Protection started successfully

2014/02/11 18:34:11 +0100 ANNAERIKSSON Anna MESSAGE Starting IP protection

2014/02/11 18:34:50 +0100 ANNAERIKSSON Anna MESSAGE IP Protection started successfully

2014/02/11 18:35:13 +0100 ANNAERIKSSON Anna MESSAGE Starting database refresh

2014/02/11 18:35:13 +0100 ANNAERIKSSON Anna MESSAGE Scheduled update executed successfully: database updated from version v2013.04.04.07 to version v2014.02.11.08

2014/02/11 18:35:13 +0100 ANNAERIKSSON Anna MESSAGE Stopping IP protection

2014/02/11 18:35:24 +0100 ANNAERIKSSON Anna MESSAGE IP Protection stopped successfully

2014/02/11 18:35:34 +0100 ANNAERIKSSON Anna MESSAGE Database refreshed successfully

2014/02/11 18:35:34 +0100 ANNAERIKSSON Anna MESSAGE Starting IP protection

2014/02/11 18:35:43 +0100 ANNAERIKSSON Anna MESSAGE IP Protection started successfully

2014/02/11 19:24:53 +0100 ANNAERIKSSON Anna IP-BLOCK 93.174.93.67 (Type: incoming, Port: 21320, Process: svchost.exe)

2014/02/11 20:00:03 +0100 ANNAERIKSSON Anna IP-BLOCK 93.174.93.67 (Type: incoming, Port: 21320, Process: svchost.exe)

2014/02/11 20:35:57 +0100 ANNAERIKSSON (null) MESSAGE Starting protection

2014/02/11 20:35:57 +0100 ANNAERIKSSON (null) MESSAGE Protection started successfully

2014/02/11 20:35:57 +0100 ANNAERIKSSON (null) MESSAGE Starting IP protection

2014/02/11 20:36:05 +0100 ANNAERIKSSON (null) MESSAGE IP Protection started successfully

Du kan inte skriva in (länka) till en fil som ligger i din dator. Det är ingen som kan se innehållet i filer som ligger i din dator.

Det andra ser ut att vara någon annan sorts logg.

Öppna MBAM, ta fram fliken Loggar och där hittar du loggen där MBAM hittade något. Öppna den loggen, kopiera innehållet i den och klistra in i ditt svar.

11 februari, 2014

Det finns en hel del kvar i datorn som behöver tas bort.

1. Avinstallera:

Ask Toolbar

Ask Toolbar Updater

Orsak: http://www.systemlookup.com/CLSID/56968-GenericAskToolbar_dll_GENERI_1_DLL.html

2. Stäng alla program, inklusive webbläsare.

Dubbelklicka på AdwCleaner för att starta programmet.

Klicka på Scan-knappen.

Vänta tills sökningen är klar.

Klicka på Clean-knappen.

Tryck på OK.

Tryck på OK fler gånger om det kommer upp meddelanden.

Datorn kommer att startas om.

En rapport kommer upp, kopiera innehållet och klistra in i ditt svar.

Om rapporten inte kommer upp, så finns den även som C:\AdwCleaner[s0].txt

3. Flytta FRST från mappen "Hämtade filer" till skrivbordet.

Starta Anteckningar.

Kopiera alla rader i rutan:

HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573576 2012-12-10] (Ask)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: G - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {0f7eaf8f-61e2-11e2-97a9-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {20f64693-574b-11e1-ac71-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {2c912684-955e-11e1-aaa6-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3a495118-1df2-11e1-a83d-001e101f7fb6} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3a495125-1df2-11e1-a83d-001e101f7fb6} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3c779586-0d9e-11e2-8746-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3c779594-0d9e-11e2-8746-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3c7795bc-0d9e-11e2-8746-001e101f4e71} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {6e039e6c-1041-11e0-99b7-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {6e039e79-1041-11e0-99b7-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {6e039e83-1041-11e0-99b7-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {7657ef89-1f73-11e1-a1ee-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {7657efc4-1f73-11e1-a1ee-001e101f1ed9} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {7e3d5586-1df4-11e1-bfe3-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {8097dd99-543d-11e1-b396-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {8ec2459f-5659-11e1-b3df-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {8ec245ac-5659-11e1-b3df-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {910b5c04-28c3-11e1-a994-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {910b5c19-28c3-11e1-a994-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {910b5c3a-28c3-11e1-a994-001e101f7f74} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {97afd708-2988-11e1-ad82-485b39ea3bad} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {a99a5e10-1020-11e2-a415-001e101f82a0} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {a99a5e5f-1020-11e2-a415-001e101f82a0} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {cedd90af-71e2-11e1-91a7-001e101f7fb6} - G:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {d9b9d3cd-142e-11e0-9cd1-001e101f1f81} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {ed1eac84-1dfc-11e1-a021-485b39ea3bad} - F:\AutoRun.exe
HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {ed1eac91-1dfc-11e1-a021-485b39ea3bad} - F:\AutoRun.exe
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL => File Not Found
AppInit_DLLs: c:\progra~2\movies~1\datamngr\x64\mgrldr.dll => File Not Found
AppInit_DLLs-x32: c:\progra~2\movies~1\datamngr\mgrldr.dll => File Not Found
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll <===== ATTENTION
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll <===== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.awesomehp.com/?type=hp&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=341&systemid=406&v=a10741-118&apn_uid=5311134013434923&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=341&systemid=406&v=a10741-118&apn_uid=5311134013434923&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - No Name - {ec2bae47-25af-4ce9-9e78-10627a49c9ea} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} -  No File
Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File
Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
S2 DatamngrCoordinator2; C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe [X]
U3 tmlwf; 
U3 tmwfp; 
2014-02-10 23:32 - 2014-02-10 23:33 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Anna\Downloads\SpyHunter-Installer (1).exe
2014-02-10 23:29 - 2014-02-10 23:30 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Anna\Downloads\SpyHunter-Installer.exe
2014-02-06 21:59 - 2014-02-11 20:30 - 00000000 ____D () C:\Users\Anna\AppData\Local\genienext
2014-02-06 21:59 - 2014-02-10 19:40 - 00000000 ____D () C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2014-02-06 21:59 - 2014-02-10 19:40 - 00000000 ____D () C:\Users\Anna\AppData\Local\Mobogenie
2014-02-06 21:59 - 2014-02-06 21:59 - 00000000 ____D () C:\Users\Anna\Documents\Mobogenie
2014-02-06 21:59 - 2014-02-06 21:59 - 00000000 _____ () C:\Users\Anna\daemonprocess.txt
2014-02-06 21:56 - 2014-02-10 19:39 - 00000000 ____D () C:\ProgramData\WPM
Task: {8C3B3668-58A0-4382-A415-F6C874FB8359} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-12-10] ()
Task: {8D4D6E48-C398-423C-9D23-26032FD8DBC5} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:A724744F
AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
CHR HKLM-x32\...\Chrome\Extension: [aaaaabcbmongicmdegkmmfgdickgnnob] - C:\Users\Anna\AppData\Local\ilividmoviestoolbardla\GC\toolbar.crx [2013-06-12]

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.

Spara filen på skrivbordet med namnet fixlist.txt.

Starta FRST som finns på skrivbordet.

Klicka på knappen Fix.

Vänta tills programmet är klart.

Programmet skapar en logg Fixlog.txt på skrivbordet.

Klistra in innehållet i den i ditt svar.

4. Gällande Torntv se http://www.systemlookup.com/FF_Extensions/2848-torntv2_torntv_com_xpi.html

Movies Toolbar är något liknande.

Jag rekommenderar att du avinstallerar de två tilläggen i Google Chrome: https://support.google.com/chrome/answer/113907?hl=sv

5. Skanna datorn online på http://www.eset.com/onlinescan/

För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Avbocka alternativet Remove found threats

Bocka för Scan Archives

Klicka på Advanced Settings

Bocka för:

Scan for potentially unwanted applications

Scan for potentially unsafe applications

Enable Anti-Stealth Technology

Klicka på Scan

När skanningen är klar klicka på List of threats found, följt av Export to a text file. Spara till en fil på skrivbordet, öppna filen, kopiera resultatet och klistra sedan in det i ditt svar.

12 februari, 2014

raketforskning, som sagt

jag får bifoga den för får bara upp att posten är för lång när jag klistrar in, hoppas det funkar lika bra. Resten måste jag ta efter jobb

mbam-log-2014-02-11 (18-36-29).txt

12 februari, 2014

Vad bra att MBAM fick bort så mycket. Då ser jag fram mot resten ikväll.

12 februari, 2014

rapport från adware cleaner:

# AdwCleaner v3.018 - Report created 12/02/2014 at 19:37:51

# Updated 28/01/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Anna - ANNAERIKSSON

# Running from : C:\Users\Anna\Downloads\adwcleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\ProgramData\BitGuard

Folder Deleted : C:\ProgramData\Browser Manager

Folder Deleted : C:\ProgramData\BrowserProtect

Folder Deleted : C:\ProgramData\Partner

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Program Files (x86)\Movies Toolbar

Folder Deleted : C:\Program Files (x86)\registry mechanic

Folder Deleted : C:\Program Files (x86)\Common Files\337

Folder Deleted : C:\Users\Anna\AppData\Local\Conduit

Folder Deleted : C:\Users\Anna\AppData\Local\Ilivid

Folder Deleted : C:\Users\Anna\AppData\Local\ilividmoviestoolbardla

Folder Deleted : C:\Users\Anna\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Anna\AppData\LocalLow\ConduitEngine

Folder Deleted : C:\Users\Anna\AppData\LocalLow\ilividmoviestoolbardla

Folder Deleted : C:\Users\Anna\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Anna\AppData\LocalLow\searchresultstb

Folder Deleted : C:\Users\Anna\AppData\Roaming\registry mechanic

File Deleted : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]

Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]

Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]

Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EC2BAE47-25AF-4CE9-9E78-10627A49C9EA}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EC2BAE47-25AF-4CE9-9E78-10627A49C9EA}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Deleted : HKCU\Software\APN DTX

Key Deleted : HKCU\Software\installedbrowserextensions

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\ilividmoviestoolbardla

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\smartbar

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Desksvc

Key Deleted : HKLM\Software\V9

Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~3\Wincert\WIN64C~1.DLL

Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~2\movies~1\datamngr\x64\mgrldr.dll

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [7631 octets] - [11/02/2014 20:58:27]

AdwCleaner[R1].txt - [5039 octets] - [12/02/2014 19:35:28]

AdwCleaner[s0].txt - [4759 octets] - [12/02/2014 19:37:51]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4819 octets] ##########

12 februari, 2014

fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-02-2014 01

Ran by Anna at 2014-02-12 19:51:46 Run:1

Running from C:\Users\Anna\Desktop

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573576 2012-12-10] (Ask)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: F - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: G - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {0f7eaf8f-61e2-11e2-97a9-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {20f64693-574b-11e1-ac71-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {2c912684-955e-11e1-aaa6-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3a495118-1df2-11e1-a83d-001e101f7fb6} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3a495125-1df2-11e1-a83d-001e101f7fb6} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3c779586-0d9e-11e2-8746-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3c779594-0d9e-11e2-8746-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {3c7795bc-0d9e-11e2-8746-001e101f4e71} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {6e039e6c-1041-11e0-99b7-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {6e039e79-1041-11e0-99b7-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {6e039e83-1041-11e0-99b7-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {7657ef89-1f73-11e1-a1ee-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {7657efc4-1f73-11e1-a1ee-001e101f1ed9} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {7e3d5586-1df4-11e1-bfe3-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {8097dd99-543d-11e1-b396-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {8ec2459f-5659-11e1-b3df-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {8ec245ac-5659-11e1-b3df-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {910b5c04-28c3-11e1-a994-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {910b5c19-28c3-11e1-a994-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {910b5c3a-28c3-11e1-a994-001e101f7f74} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {97afd708-2988-11e1-ad82-485b39ea3bad} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {a99a5e10-1020-11e2-a415-001e101f82a0} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {a99a5e5f-1020-11e2-a415-001e101f82a0} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {cedd90af-71e2-11e1-91a7-001e101f7fb6} - G:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {d9b9d3cd-142e-11e0-9cd1-001e101f1f81} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {ed1eac84-1dfc-11e1-a021-485b39ea3bad} - F:\AutoRun.exe

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\MountPoints2: {ed1eac91-1dfc-11e1-a021-485b39ea3bad} - F:\AutoRun.exe

AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL => File Not Found

AppInit_DLLs: c:\progra~2\movies~1\datamngr\x64\mgrldr.dll => File Not Found

AppInit_DLLs-x32: c:\progra~2\movies~1\datamngr\mgrldr.dll => File Not Found

HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll <===== ATTENTION

HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll <===== ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.awesomehp.com/?type=hp&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}

SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1391720076&from=ild&uid=ST9250315AS_5VCHPKQ0XXXX5VCHPKQ0&q={searchTerms}

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=341&systemid=406&v=a10741-118&apn_uid=5311134013434923&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=341&systemid=406&v=a10741-118&apn_uid=5311134013434923&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - No Name - {ec2bae47-25af-4ce9-9e78-10627a49c9ea} - No File

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

Toolbar: HKCU - No Name - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File

Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File

Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

S2 DatamngrCoordinator2; C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe [X]

U3 tmlwf;

U3 tmwfp;

2014-02-10 23:32 - 2014-02-10 23:33 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Anna\Downloads\SpyHunter-Installer (1).exe

2014-02-10 23:29 - 2014-02-10 23:30 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Anna\Downloads\SpyHunter-Installer.exe

2014-02-06 21:59 - 2014-02-11 20:30 - 00000000 ____D () C:\Users\Anna\AppData\Local\genienext

2014-02-06 21:59 - 2014-02-10 19:40 - 00000000 ____D () C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie

2014-02-06 21:59 - 2014-02-10 19:40 - 00000000 ____D () C:\Users\Anna\AppData\Local\Mobogenie

2014-02-06 21:59 - 2014-02-06 21:59 - 00000000 ____D () C:\Users\Anna\Documents\Mobogenie

2014-02-06 21:59 - 2014-02-06 21:59 - 00000000 _____ () C:\Users\Anna\daemonprocess.txt

2014-02-06 21:56 - 2014-02-10 19:39 - 00000000 ____D () C:\ProgramData\WPM

Task: {8C3B3668-58A0-4382-A415-F6C874FB8359} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-12-10] ()

Task: {8D4D6E48-C398-423C-9D23-26032FD8DBC5} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION

AlternateDataStreams: C:\ProgramData\Temp:A724744F

AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1

CHR HKLM-x32\...\Chrome\Extension: [aaaaabcbmongicmdegkmmfgdickgnnob] - C:\Users\Anna\AppData\Local\ilividmoviestoolbardla\GC\toolbar.crx [2013-06-12]

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater => Unable to delete value

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Value deleted successfully.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\S-1-5-21-1228158096-368230399-1422481915-1000 => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f7eaf8f-61e2-11e2-97a9-485b39ea3bad} => Key not found.

HKCR\CLSID\{0f7eaf8f-61e2-11e2-97a9-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20f64693-574b-11e1-ac71-485b39ea3bad} => Key not found.

HKCR\CLSID\{20f64693-574b-11e1-ac71-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c912684-955e-11e1-aaa6-485b39ea3bad} => Key not found.

HKCR\CLSID\{2c912684-955e-11e1-aaa6-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a495118-1df2-11e1-a83d-001e101f7fb6} => Key not found.

HKCR\CLSID\{3a495118-1df2-11e1-a83d-001e101f7fb6} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a495125-1df2-11e1-a83d-001e101f7fb6} => Key not found.

HKCR\CLSID\{3a495125-1df2-11e1-a83d-001e101f7fb6} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c779586-0d9e-11e2-8746-485b39ea3bad} => Key not found.

HKCR\CLSID\{3c779586-0d9e-11e2-8746-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c779594-0d9e-11e2-8746-485b39ea3bad} => Key not found.

HKCR\CLSID\{3c779594-0d9e-11e2-8746-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c7795bc-0d9e-11e2-8746-001e101f4e71} => Key not found.

HKCR\CLSID\{3c7795bc-0d9e-11e2-8746-001e101f4e71} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e039e6c-1041-11e0-99b7-485b39ea3bad} => Key not found.

HKCR\CLSID\{6e039e6c-1041-11e0-99b7-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e039e79-1041-11e0-99b7-485b39ea3bad} => Key not found.

HKCR\CLSID\{6e039e79-1041-11e0-99b7-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e039e83-1041-11e0-99b7-485b39ea3bad} => Key not found.

HKCR\CLSID\{6e039e83-1041-11e0-99b7-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7657ef89-1f73-11e1-a1ee-485b39ea3bad} => Key not found.

HKCR\CLSID\{7657ef89-1f73-11e1-a1ee-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7657efc4-1f73-11e1-a1ee-001e101f1ed9} => Key not found.

HKCR\CLSID\{7657efc4-1f73-11e1-a1ee-001e101f1ed9} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e3d5586-1df4-11e1-bfe3-485b39ea3bad} => Key not found.

HKCR\CLSID\{7e3d5586-1df4-11e1-bfe3-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8097dd99-543d-11e1-b396-485b39ea3bad} => Key not found.

HKCR\CLSID\{8097dd99-543d-11e1-b396-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ec2459f-5659-11e1-b3df-485b39ea3bad} => Key not found.

HKCR\CLSID\{8ec2459f-5659-11e1-b3df-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ec245ac-5659-11e1-b3df-485b39ea3bad} => Key not found.

HKCR\CLSID\{8ec245ac-5659-11e1-b3df-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910b5c04-28c3-11e1-a994-485b39ea3bad} => Key not found.

HKCR\CLSID\{910b5c04-28c3-11e1-a994-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910b5c19-28c3-11e1-a994-485b39ea3bad} => Key not found.

HKCR\CLSID\{910b5c19-28c3-11e1-a994-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910b5c3a-28c3-11e1-a994-001e101f7f74} => Key not found.

HKCR\CLSID\{910b5c3a-28c3-11e1-a994-001e101f7f74} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{97afd708-2988-11e1-ad82-485b39ea3bad} => Key not found.

HKCR\CLSID\{97afd708-2988-11e1-ad82-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a99a5e10-1020-11e2-a415-001e101f82a0} => Key not found.

HKCR\CLSID\{a99a5e10-1020-11e2-a415-001e101f82a0} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a99a5e5f-1020-11e2-a415-001e101f82a0} => Key not found.

HKCR\CLSID\{a99a5e5f-1020-11e2-a415-001e101f82a0} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cedd90af-71e2-11e1-91a7-001e101f7fb6} => Key not found.

HKCR\CLSID\{cedd90af-71e2-11e1-91a7-001e101f7fb6} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9b9d3cd-142e-11e0-9cd1-001e101f1f81} => Key not found.

HKCR\CLSID\{d9b9d3cd-142e-11e0-9cd1-001e101f1f81} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed1eac84-1dfc-11e1-a021-485b39ea3bad} => Key not found.

HKCR\CLSID\{ed1eac84-1dfc-11e1-a021-485b39ea3bad} => Key not found.

HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed1eac91-1dfc-11e1-a021-485b39ea3bad} => Key not found.

HKCR\CLSID\{ed1eac91-1dfc-11e1-a021-485b39ea3bad} => Key not found.

"C:\\PROGRA~3\\Wincert\\WIN64C~1.DLL" => Value Data not found.

"c:\\progra~2\\movies~1\\datamngr\\x64\\mgrldr.dll" => Value Data not found.

"c:\\progra~2\\movies~1\\datamngr\\mgrldr.dll" => Value Data removed successfully.

HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\\x86 => Unable to delete value

HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\\x64 => Unable to delete value

HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.

HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.

HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.

HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found.

HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.

HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.

HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.

HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found.

HKCR\Wow6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Unable to delete value

HKCR\Wow6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{ec2bae47-25af-4ce9-9e78-10627a49c9ea} => Unable to delete value

HKCR\Wow6432Node\CLSID\{ec2bae47-25af-4ce9-9e78-10627a49c9ea} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value deleted successfully.

HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} => Value deleted successfully.

HKCR\CLSID\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} => Unable to delete value

HKCR\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} => Value deleted successfully.

HKCR\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Unable to delete value

HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found.

DatamngrCoordinator2 => Service deleted successfully.

tmlwf => Service deleted successfully.

tmwfp => Service deleted successfully.

"C:\Users\Anna\Downloads\SpyHunter-Installer (1).exe" => File/Directory not found.

"C:\Users\Anna\Downloads\SpyHunter-Installer.exe" => File/Directory not found.

C:\Users\Anna\AppData\Local\genienext => Moved successfully.

C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie => Moved successfully.

C:\Users\Anna\AppData\Local\Mobogenie => Moved successfully.

C:\Users\Anna\Documents\Mobogenie => Moved successfully.

C:\Users\Anna\daemonprocess.txt => Moved successfully.

C:\ProgramData\WPM => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C3B3668-58A0-4382-A415-F6C874FB8359} => Key not found.

C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar => Key not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8D4D6E48-C398-423C-9D23-26032FD8DBC5} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D4D6E48-C398-423C-9D23-26032FD8DBC5} => Key deleted successfully.

C:\Windows\System32\Tasks\Desk 365 RunAsStdUser not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser => Key deleted successfully.

C:\ProgramData\Temp => ":A724744F" ADS removed successfully.

C:\ProgramData\Temp => ":D1B5B4F1" ADS removed successfully.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob => Key deleted successfully.

"C:\Users\Anna\AppData\Local\ilividmoviestoolbardla\GC\toolbar.crx" => File/Directory not found.

==== End of Fixlog ====

12 februari, 2014

Min uppkoppling är nog sådär, scannern är på 50% efter 2 timmar så antar att jag får återkomma i morgon

12 februari, 2014

från ESET:

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir Win32/Toolbar.Conduit.Y potentially unwanted application

C:\FRST\Quarantine\Mobogenie12-02-2014_19-51-46\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe a variant of Win32/Mobogenie.A potentially unwanted application

C:\FRST\Quarantine\Mobogenie12-02-2014_19-51-46\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe a variant of Win32/Mobogenie.A potentially unwanted application

C:\FRST\Quarantine\Mobogenie12-02-2014_19-51-46\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe a variant of Win32/Mobogenie.A potentially unwanted application

D:\Stuff\SoftonicDownloader_for_vlc-media-player.exe Win32/SoftonicDownloader.A potentially unwanted application

12 februari, 2014

Det mesta som Esets skanner hittade ligger i karantänmapparna för AdwCleaner och FRST så de är redan oskadliggjorda, men den sista är en installationsfil som kommer att vilja installera olämpliga tilllägg/program samtidigt som VLC installeras. Softonic är inte en bra webbplats att hämta sina program från eftersom de oftast lägger till egna grejer till den ordinarie installationen.

Du får själv avgöra om du vill ta bort filen D:\Stuff\SoftonicDownloader_for_vlc-media-player.

Kör FRST igen och klistra in den nya FRST.txt för en koll av att jag fick med allt som skulle bort.

13 februari, 2014

jag tog bort sofftonic. Den fanns ju inte att avinstallera så valde bara "ta bort", det kanske räcker då?

FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2014 01

Ran by Anna (administrator) on ANNAERIKSSON on 13-02-2014 08:16:53

Running from C:\Users\Anna\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: Swedish

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Advanced Micro Devices, Inc.) C:\Windows\system32\atibtmon.exe

(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

() C:\Program Files (x86)\AgentService\AgentService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\ProgramData\DatacardService\HWDeviceService64.exe

(Lexmark International, Inc.) C:\Windows\system32\spool\DRIVERS\x64\3\lxeaserv.exe

( ) C:\Windows\system32\lxeacoms.exe

(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamgui.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe

(ASUS) C:\Windows\AsScrPro.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe

() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe

() C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe

() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

(Spotify Ltd) C:\Users\Anna\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(Spotify Ltd) C:\Users\Anna\AppData\Roaming\Spotify\spotify.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe

(Technology Nexus AB) C:\Program Files (x86)\Personal\bin\Personal.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

() C:\Program Files (x86)\Mobile Partner\Mobile Partner.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe

() C:\Users\Anna\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

() C:\Users\Anna\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_12_0_0_44_ActiveX.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-06-10] (ELAN Microelectronic Corp.)

HKLM\...\Run: [ASUS WebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-16] ()

HKLM\...\Run: [lxeamon.exe] - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe [770728 2010-05-05] ()

HKLM\...\Run: [EzPrint] - C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe [148280 2010-05-05] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)

HKLM-x32\...\Run: [updateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)

HKLM-x32\...\Run: [updateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)

HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-03-31] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [7350912 2010-02-04] (ASUS)

HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-01-05] (ASUS)

HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-23] ()

HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [switchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)

HKLM-x32\...\Run: [bCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\Run: [spotify Web Helper] - C:\Users\Anna\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-18] (Spotify Ltd)

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\Run: [spotify] - C:\Users\Anna\AppData\Roaming\Spotify\Spotify.exe [6118400 2014-01-18] (Spotify Ltd)

HKU\S-1-5-21-1228158096-368230399-1422481915-1000\...\Run: [AppleIEDAV] - C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)