New
#21
Yes, I have run Adwcleaner and TDSSkiller. TDSSkiller did not find anything.
Yes, I have run Adwcleaner and TDSSkiller. TDSSkiller did not find anything.
Delete the FRST64.exe on the Desktop. Then drag the one inside the Downloads folder to your Desktop
Open Notepad . Inside Notepad paste the highlighted text below
start
HKLM\...\Run: [] - [x]
HKCU\...\Run: [ConduitFloatingPlugin_nemfjadlboooiffmcelkafilagddogim] - "C:\windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3289663\plugins\TBVerifier.dll",RunConduitFloatingPlugin nemfjadlboooiffmcelkafilagddogim [x]
HKLM-x32\...\Run: [ROC_roc_ssl_v12] - "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 [x]
HKLM-x32\...\Run: [] - [x]
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {DB3DCD5F-F52E-400C-AD19-B3DB2E8379F7} URL =
BHO-x32: CouponMatcher - {E155F23C-9931-47c6-A619-20E6FCA86D75} - C:\Program Files (x86)\CouponMatcher\CouponMatcher.dll (CouponMatcher)
BHO-x32: Fast Free Converter 4.1 - {F5580E24-8416-4DFD-90B3-078D4EDF4FCB} - C:\PROGRA~2\FASTFR~1\FASTFR~1\FASTFR~1.DLL No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
CHR DefaultSearchURL: (Delta Search) - http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=286C207C8F2FADA5&affID=119351&tsp=4967
CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{googl e:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Coupon Matcher) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbeaeacnffjpnodemllopecegchjefhb\1.9_0
CHR Extension: (InfoBird Pro) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\icanoneicgaahjbilcgdmnhoocddknbl\3.0.0.0_0
CHR Extension: (Safe Saver) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mehnejgknjfgfdmijlaloodhdgnbgdgn\1.23.29_0
CHR Extension: (LyricsParty) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\odahgeaajkpopkhiakbpomdcehbmmkpg\1.125_0
CHR HKLM\...\Chrome\Extension: [icanoneicgaahjbilcgdmnhoocddknbl] - C:\Users\Tim\AppData\Local\InfoBirdPro.crx
CHR HKLM-x32\...\Chrome\Extension: [fbeaeacnffjpnodemllopecegchjefhb] - C:\Users\Tim\AppData\Roaming\Coupon Matcher\couponmatcher.crx
CHR HKLM-x32\...\Chrome\Extension: [icanoneicgaahjbilcgdmnhoocddknbl] - C:\Users\Tim\AppData\Local\InfoBirdPro.crx
CHR HKLM-x32\...\Chrome\Extension: [kldbiondcoemmofebkcgcnbigliglcnl] - C:\Users\Tim\AppData\Local\CRE\kldbiondcoemmofebkcgcnbigliglcnl.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [odahgeaajkpopkhiakbpomdcehbmmkpg] - C:\Program Files (x86)\LyricsParty\125.crx
S2 FastFreeConverterUpdt; C:\Program Files (x86)\Fast Free Converter\FastFreeConverterUpdt.exe [x]
2013-08-11 12:08 - 2013-08-11 12:08 - 00003436 _____ C:\windows\System32\Tasks\BrowserDefendert
2013-08-11 09:01 - 2013-08-11 09:01 - 00051157 _____ C:\Users\Tim\AppData\Local\InfoBirdPro.crx
2013-08-07 18:45 - 2013-08-11 09:01 - 00000005 _____ C:\Users\Tim\AppData\Roaming\WBPU-TTL.DAT
2013-08-07 07:46 - 2013-08-12 06:42 - 00001894 _____ C:\windows\Tasks\Safe Saver-chromeinstaller.job
2013-08-07 07:46 - 2013-08-12 06:42 - 00001188 _____ C:\windows\Tasks\Safe Saver-codedownloader.job
2013-08-07 07:46 - 2013-08-12 06:42 - 00001184 _____ C:\windows\Tasks\Safe Saver-updater.job
2013-08-07 07:46 - 2013-08-12 06:42 - 00001088 _____ C:\windows\Tasks\Safe Saver-enabler.job
2013-08-07 07:46 - 2013-08-07 07:46 - 00004218 _____ C:\windows\System32\Tasks\Safe Saver-codedownloader
2013-08-07 07:46 - 2013-08-07 07:46 - 00004214 _____ C:\windows\System32\Tasks\Safe Saver-updater
2013-08-07 07:46 - 2013-08-07 07:46 - 00004118 _____ C:\windows\System32\Tasks\Safe Saver-enabler
2013-08-12 06:41 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
C:\Users\Tim\GoToAssistDownloadHelper.exe
end
Click on File select Save As
Location : Desktop
File Name : Fixlist.txt
Save as type : All Files
Click on Save
Open FRST64.exe click on the [Fix] button . Once its complete it will create a log called Fixlog.txt . Upload the log with your reply
I saved the Fixlist file with the info above. So do I save this txt file on top of the exe file(FRST64.exe)? When I try to "fix" in the exe file, it can't find the fixlist file. When I try to run the FRST.exe it says it is out of date and I keep getting that message even though I supposedly donloaded from bleepingcomputer.
Save the file as Fixlist.txt save it to your desktop . Download a new version save the FRST.exe to your desktop . Then open the FRST.exe then click on FIX button it will look for the fixlist.txt on your desktop .
How can I download FRST.exe when it keeps saying your version of FRST64 is outdated. Click yes to download the latest version. Click No to continue without updating FRST64.
Delete all of your FRST64.exe files you have .
Click on the link below . Once its done downloading . Open your Downloads folder and drag the new one that you just Downloaded to your Desktop
64-Bit Version OS http://download.bleepingcomputer.com/farbar/FRST64.exe