Inaccessible Windows Basic Functions

[soulcat]

Hello,
I first noticed my Windows 7 Home Premium has stopped working correctly a few days ago when I'd startup IE11 and no pages would load. It tried, but nothing happened. It was as if it was being blocked from loading. Firefox and Chrome both worked, so it wasn't a connection issue. Then I tried to access Windows System and Update from the control panel and neither would launch. Programs launch fine, but some Windows applications won't launch at all. I thought I might have a virus, so I performed full scans with McAfee and MalwareBytes in normal mode and safe mode. MalwareBytes found a few registry key issues, but eliminating them didn't solve my Windows issue.

Then tonight, I noticed the message "Windows 7 Build 7601 Windows Not Genuine" in the lower right hand corner of my desktop. I searched these forums and found this older thread.
http://www.sevenforums.com/windows-...e-getting-build-7601-windows-not-genuine.html

I followed the instructions and it did eliminate the message on my desktop, but still many control panel functions remain inaccessible.

I tried restoring my system to Dec 1, 2013 and that didn't solve the problem either, so I undid the restore back to Dec 21, 2013 in order to get the various updates to Windows back. I've been trying to force a Windows Update but have been unable to do so, since I can't launch Windows Update from the control panel, the start menu or anywhere.

I tried to delete a program, but got the error message that the Windows Installer wasn't installed correctly.

I'm finding that when I try to validate my Windows, my download is being blocked as well.

It seems my Windows OS is a mess right now and I have no idea why. I've been using it for almost 3 years now and have never re-installed or messed around with it.

I tried downloading the diagnostic tool, but it too had issues. I was finally able to get it to work. The results are below.

Do you have any advice on how I can correct these issues? Will I need to do a system re-install? My computer didn't come with a Windows disc, but I did make an install disc a 3 years ago when I got the new system.

Please advise and thanks in advance for your help.

-Matt

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
Windows Product ID: 00359-OEM-8992687-00095
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {682E0E5C-5253-4D4C-AC67-A9D91C0969EC}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800095-02-1033-7600.0000-0332011
Installation ID: 015711555481865891915804562213980384407121451402031926
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: RMV82
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 12/22/2013 5:39:04 AM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 12:22:2013 04:45
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: LgAAAAIAAgABAAEAAAABAAAAAQABAAEAonZcbNa/si8meoCW2MPOJsZpEKdcXQ==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL FX09
FACP DELL FX09
HPET DELL OEMHPET
MCFG DELL OEMMCFG
SLIC DELL FX09
OSFR DELL FX09
OEMB DELL FX09
ASF! LEGEND I865PASF
GSCI DELL GMCHSCI
SSDT DpgPmm CpuPm

 

[ICIT2LOL]

Hello and welcome soulcat mate might be worth a phone call to Microsoft to sort that out. I know there are members who know about this validation stuff but if you can it could be sorted on the phone.

PS Meant to add did you try a system restore to before the IE11 update?

 

[soulcat]

Hi ICit2lol,

Yeah, I restored back as far as I could go, which was only Dec. 1st for some reason. I shutdown all the time, so I thought I would have restore points going further back, but no luck. Once I found out that restoring back to Dec. 1st didn't help, I undid the restore and set the system back to Dec. 21st. Now, I have no restore points to go back to...ugh.

This issue is so weird as it's only affecting certain Windows functions. For example, I got to system restore by searching for it in the start bar as it would not launch from the control panel. I can't get into "System" through Control Panel either, so in order to get system info, I went to the command prompt.

I'm not even sure if my Windows OS is validated, as my "security" settings won't let me perform a validation test from the MS website. My security settings are set now and always have been set to "medium." Weird.

Any help would be most appreciated.

Thanks,
Matt

Hello and welcome soulcat mate might be worth a phone call to Microsoft to sort that out. I know there are members who know about this validation stuff but if you can it could be sorted on the phone.

PS Meant to add did you try a system restore to before the IE11 update?

 

[soulcat]

If I need to call MS, what number do I call?

 

[NoelDP]

There is no evident problem in your MGADiag report.
The system appears to be properly activated, and validated today.
Are you still seeing a non-genuine notification?

 

[soulcat]

Thanks for the response, NoelDP. I am not seeing any evidence that my Windows is not genuine today. IE11 is actually working again, which is great...but I can't download anything from the web without an error message saying that either I don't have rights or my security setting are blocking said download. My McAfee antivirus can't update. It keeps telling me that there's a web connection problem when there's clearly not. I can't get window to update and I can't launch other common control panel functions, like "system," "backup and restore," "windows update," "default programs," etc. Regular programs, like Adobe Audition, Filezilla, etc launch normally. I can open "add and remove programs," but can't actually delete anything as it says "Windows installer service could not be accessed." I also can't "personalize" anything as I can't get that to launch.

Any idea what might be crippling these basic Windows' functions?

Thanks so much for your help.

Matt

There is no evident problem in your MGADiag report.
The system appears to be properly activated, and validated today.
Are you still seeing a non-genuine notification?

 

[Golden]

Soulcat,

Some antivirus software are known to cause issues with genuine status. I would recommend completely uninstalling MaCafee -- its one of the poorest AV suites anyway -- and installing MSE, which will not clash with the genuine check that Windows performs.

Uninstallation of MaCafee: see item labelled 20a in this tutorial
http://www.sevenforums.com/tutorials/78961-av-uninstallers.html

MSE Download:
Microsoft Security Essentials - Microsoft Windows

Lets see if you still have issues then.

 

[soulcat]

OK Golden,
I'll try that. Thanks for the tip. But is it kind of weird that McAfee hasn't clashed over the past 3 years and is clashing now? Oh, maybe it has something to do with recent Windows updates or something? Also, is this common to have certain control panel functions become unavailable due to an AV suite clashing with Windows or is it just related to the "genuine" thing?

Thanks,
Matt

Soulcat,

Some antivirus software are known to cause issues with genuine status. I would recommend completely uninstalling MaCafee -- its one of the poorest AV suites anyway -- and installing MSE, which will not clash with the genuine check that Windows performs.

Uninstallation of MaCafee: see item labelled 20a in this tutorial
http://www.sevenforums.com/tutorials/78961-av-uninstallers.html

MSE Download:
Microsoft Security Essentials - Microsoft Windows

Lets see if you still have issues then.

 

[Golden]

I'm not entirely sure how the lack of access to Control Panel is related to this problem, but the first port of call should be get rid of this "race condition" that causes Windows to think its not genuine on occasions.

In your first post, you mentioned Malwarebytes found some registry keys - presumably malware. Do you recall what they were? Its possible that it has messed with your system to the point that it no longer functions as intended. Before you do anything further, can you just try something please:

1. Click Start

2. In the search box, type cmd
3. In the list that appears, right-click on cmd.exe and choose Run as administrator
4. In the command window that opens, type sfc /scannow and hit enter.

Report the output from the command window once it finishes.

More detail: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[soulcat]

OK, running a scan now.

According the MalwareBytes' logs, here is what it found:

Registry Keys Detected: 1
HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.

Registry Keys Detected: 1
HKCR\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1} (PUP.Optional.Conduit) -> Quarantined and deleted successfully.

I also wanted to mention that before I ran:
CD%windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

REN tokens.dat tokens.bar

net start sppsvc

slui.exe

I ran:
slmgr -rearm since I was getting the "build 7601 Windows Is Not Genuine" message.

Do you think that is why my copy of Windows is now coming up as genuine?

I'll report back once the sfc /scannow results are in.

Thanks again.

Matt

 

[soulcat]

OK, scan is complete...

Windows Resource Protection did not find any integrity violations.

 

[Golden]

Both PUP's are browser-hijackers (add-on toolbars etc.) that would have been downloaded with some software you might have downloaded - this probably explains your browser problem. Be sure to delete them using Malwarebytes.

Once you have done that, check for remnants of the software using AdwCleaner:
AdwCleaner Download

1. Downlaod to desktop
2. Right-click and run as administartor
3. Post the output or logfile once its complete.

 

[Golden]

OK, scan is complete...

Windows Resource Protection did not find any integrity violations.

Good - see my post above

 

[ICIT2LOL]

Another you can run mate is
http://www.superantispyware.com/

I don't know what the others think but perhaps a run of the TDSS Killer might help
Free Malware Removal Tools scroll down to it and run.

 

[Golden]

Another you can run mate is
http://www.superantispyware.com/

I don't know what the others think but perhaps a run of the TDSS Killer might help
Free Malware Removal Tools scroll down to it and run.

John, we shouldn't take this shotgun approach with posting several antimalware scanners...we should see whether the current PUPs can be sufficiently cleaned using Malwarebytes and AdwCleaner first.

 

[soulcat]

Ummm Golden...all I can say is HOLY CRAP! Here is the log file. Please decipher and tell me exactly what this program does? WOWZA! I have to split it up into 2 posts since it's soooo long.

# AdwCleaner v3.016 - Report created 22/12/2013 at 21:55:09
# Updated 23/12/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Matt The Cat - MATTTHECAT-PC
# Running from : C:\Users\Matt The Cat\Desktop\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
Service Deleted : Application Updater
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Program Files (x86)\Application Updater
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Vuze Remote toolbar
Folder Deleted : C:\Program Files (x86)\Common Files\Spigot
Folder Deleted : C:\Users\Matt The Cat\AppData\Local\Conduit
Folder Deleted : C:\Users\Matt The Cat\AppData\Local\Coupon Companion Plugin
Folder Deleted : C:\Users\Matt The Cat\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Matt The Cat\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Matt The Cat\AppData\LocalLow\Search Settings
Folder Deleted : C:\Users\Matt The Cat\AppData\Roaming\Mozilla\Firefox\Profiles\wy5zbb28.default\Conduit
Folder Deleted : C:\Users\Matt The Cat\AppData\Roaming\Mozilla\Firefox\Profiles\wy5zbb28.default\ConduitEngine
Folder Deleted : C:\Users\Matt The Cat\AppData\Roaming\Mozilla\Firefox\Profiles\wy5zbb28.default\Extensions\[email protected]
Folder Deleted : C:\Users\Matt The Cat\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam
File Deleted : C:\END
File Deleted : C:\Users\Matt The Cat\AppData\Roaming\Mozilla\Firefox\Profiles\wy5zbb28.default\searchplugins\Askcom.xml
File Deleted : C:\Users\Matt The Cat\AppData\Roaming\Mozilla\Firefox\Profiles\wy5zbb28.default\user.js
***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Deleted : HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\hbcennhacfaagdopikcegfcobcadeocj
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk
Key Deleted : HKCU\Software\Google\Chrome\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pfndaklgolladniicklehhancnlgocpp
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings]
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2786678
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3220468
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{05478A66-EDB6-4A22-A870-A5987F80A7DA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05478A66-EDB6-4A22-A870-A5987F80A7DA}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{05478A66-EDB6-4A22-A870-A5987F80A7DA}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{05478A66-EDB6-4A22-A870-A5987F80A7DA}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{05478A66-EDB6-4A22-A870-A5987F80A7DA}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{05478A66-EDB6-4A22-A870-A5987F80A7DA}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{05478A66-EDB6-4A22-A870-A5987F80A7DA}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{05478A66-EDB6-4A22-A870-A5987F80A7DA}]
Key Deleted : HKCU\Software\Alexa Internet
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\distromatic
Key Deleted : HKCU\Software\Search Settings
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\Application Updater
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Search Settings
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Bar
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

 

[soulcat]

PART 2:

***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.16428

-\\ Mozilla Firefox v26.0 (en-US)
[ File : C:\Users\Matt The Cat\AppData\Roaming\Mozilla\Firefox\Profiles\wy5zbb28.default\prefs.js ]
Line Deleted : user_pref("CT2786678..clientLogIsEnabled", true);
Line Deleted : user_pref("CT2786678..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Line Deleted : user_pref("CT2786678..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Line Deleted : user_pref("CT2786678.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Line Deleted : user_pref("CT2786678.CTID", "CT2786678");
Line Deleted : user_pref("CT2786678.CurrentServerDate", "14-2-2011");
Line Deleted : user_pref("CT2786678.DialogsAlignMode", "LTR");
Line Deleted : user_pref("CT2786678.DownloadReferralCookieData", "");
Line Deleted : user_pref("CT2786678.EMailNotifierPollDate", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedLastCount5690698542593514850", 163);
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375443753", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375443759", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444699", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444705", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444711", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444717", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444723", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444729", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444735", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444741", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedPollDate129301619375444747", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.FeedTTL129301619375444699", 10);
Line Deleted : user_pref("CT2786678.FeedTTL129301619375444723", 15);
Line Deleted : user_pref("CT2786678.FeedTTL129301619375444735", 5);
Line Deleted : user_pref("CT2786678.FeedTTL129301619375444747", 5);
Line Deleted : user_pref("CT2786678.FirstServerDate", "14-2-2011");
Line Deleted : user_pref("CT2786678.FirstTime", true);
Line Deleted : user_pref("CT2786678.FirstTimeFF3", true);
Line Deleted : user_pref("CT2786678.FixPageNotFoundErrors", false);
Line Deleted : user_pref("CT2786678.GroupingServerCheckInterval", 1440);
Line Deleted : user_pref("CT2786678.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Line Deleted : user_pref("CT2786678.HasUserGlobalKeys", true);
Line Deleted : user_pref("CT2786678.Initialize", true);
Line Deleted : user_pref("CT2786678.InitializeCommonPrefs", true);
Line Deleted : user_pref("CT2786678.InstallationAndCookieDataSentCount", 1);
Line Deleted : user_pref("CT2786678.InstallationType", "UnknownIntegration");
Line Deleted : user_pref("CT2786678.InstalledDate", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.IsGrouping", false);
Line Deleted : user_pref("CT2786678.IsMulticommunity", false);
Line Deleted : user_pref("CT2786678.IsOpenThankYouPage", true);
Line Deleted : user_pref("CT2786678.IsOpenUninstallPage", false);
Line Deleted : user_pref("CT2786678.LanguagePackLastCheckTime", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.LanguagePackReloadIntervalMM", 1440);
Line Deleted : user_pref("CT2786678.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
Line Deleted : user_pref("CT2786678.LastLogin_3.2.5.2", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.LatestVersion", "3.2.5.2");
Line Deleted : user_pref("CT2786678.Locale", "en");
Line Deleted : user_pref("CT2786678.MCDetectTooltipHeight", "83");
Line Deleted : user_pref("CT2786678.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Line Deleted : user_pref("CT2786678.MCDetectTooltipWidth", "295");
Line Deleted : user_pref("CT2786678.SearchFromAddressBarIsInit", true);
Line Deleted : user_pref("CT2786678.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=");
Line Deleted : user_pref("CT2786678.SearchInNewTabEnabled", true);
Line Deleted : user_pref("CT2786678.SearchInNewTabIntervalMM", 1440);
Line Deleted : user_pref("CT2786678.SearchInNewTabLastCheckTime", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
Line Deleted : user_pref("CT2786678.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
Line Deleted : user_pref("CT2786678.ServiceMapLastCheckTime", "Sun Feb 13 2011 20:04:32 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.SettingsLastCheckTime", "Sun Feb 13 2011 20:04:32 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.SettingsLastUpdate", "1297181872");
Line Deleted : user_pref("CT2786678.ThirdPartyComponentsInterval", 504);
Line Deleted : user_pref("CT2786678.ThirdPartyComponentsLastCheck", "Sun Feb 13 2011 20:04:32 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.ThirdPartyComponentsLastUpdate", "1246790578");
Line Deleted : user_pref("CT2786678.TrusteLinkUrl", "hxxp://trust.conduit.com/EB_ORIGINAL_CTID");
Line Deleted : user_pref("CT2786678.UserID", "UN37236387507564665");
Line Deleted : user_pref("CT2786678.WeatherNetwork", "");
Line Deleted : user_pref("CT2786678.WeatherPollDate", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.WeatherUnit", "F");
Line Deleted : user_pref("CT2786678.alertChannelId", "1178763");
Line Deleted : user_pref("CT2786678.myStuffEnabled", true);
Line Deleted : user_pref("CT2786678.myStuffPublihserMinWidth", 400);
Line Deleted : user_pref("CT2786678.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Line Deleted : user_pref("CT2786678.myStuffServiceIntervalMM", 1440);
Line Deleted : user_pref("CT2786678.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Line Deleted : user_pref("CT2786678.testingCtid", "");
Line Deleted : user_pref("CT2786678.toolbarAppMetaDataLastCheckTime", "Sun Feb 13 2011 20:04:33 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT2786678.toolbarContextMenuLastCheckTime", "Sun Feb 13 2011 20:04:37 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CT3220468_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1361801826360,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1178763/1174448/US", "\"0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/US", "\"0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2786678", "\"1285982114\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "wVmmvqqOMqrv5xct1cJIHg==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "0uSPYx+Kl2jpu8sJZMeHjw==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "Dclc8oo4TTv7+mAkSlUSWg==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "SuMy8xgBA7+FodOxmk9aiQ==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"01ffa8b1cc6cb1:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3.2", "\"0652eeacc6cb1:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"634325899280830000\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "634303635100000000");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=1/11/2011 5:25:10 PM", "634339976460000000");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2786678/CT2786678", "\"1297181872\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634322696881670000\"");
Line Deleted : user_pref("CommunityToolbar.EngineOwner", "CT2786678");
Line Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}");
Line Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "utorrentbar");
Line Deleted : user_pref("CommunityToolbar.IsEngineShown", false);
Line Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Line Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2786678");
Line Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}");
Line Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "utorrentbar");
Line Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2786678");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList2", "ConduitEngine,CT2786678");
Line Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Wed Mar 23 2011 09:25:48 GMT-0400 (Eastern Daylight Time)");
Line Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Line Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Mon Jul 04 2011 11:04:38 GMT-0400 (Eastern Daylight Time)");
Line Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Line Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Line Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Line Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Mon Jul 04 2011 11:04:30 GMT-0400 (Eastern Daylight Time)");
Line Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");
Line Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Line Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Line Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Line Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Line Deleted : user_pref("CommunityToolbar.alert.userId", "2b504e04-9f8a-4a04-8686-cd365e828867");
Line Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Feb 13 2011 20:04:34 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Line Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Line Deleted : user_pref("ConduitEngine.CTID", "ConduitEngine");
Line Deleted : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Wed Mar 23 2011 09:25:47 GMT-0400 (Eastern Daylight Time)");
Line Deleted : user_pref("ConduitEngine.FirstServerDate", "02/14/2011 04");
Line Deleted : user_pref("ConduitEngine.FirstTime", true);
Line Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);
Line Deleted : user_pref("ConduitEngine.FixPageNotFoundErrors", false);
Line Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Line Deleted : user_pref("ConduitEngine.Initialize", true);
Line Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Line Deleted : user_pref("ConduitEngine.InstallationType", "UnknownIntegration");
Line Deleted : user_pref("ConduitEngine.InstalledDate", "Sun Feb 13 2011 20:04:32 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("ConduitEngine.IsMulticommunity", false);
Line Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);
Line Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", false);
Line Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Thu Mar 10 2011 10:00:57 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("ConduitEngine.LastLogin_3.2.5.2", "Thu Mar 10 2011 10:00:57 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("ConduitEngine.PublisherContainerWidth", 0);
Line Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Line Deleted : user_pref("ConduitEngine.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CTXXXX&q=");
Line Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Thu Mar 10 2011 10:00:57 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("ConduitEngine.UserID", "UN68711233102668123");
Line Deleted : user_pref("ConduitEngine.engineLocale", "en-US");
Line Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Thu Mar 10 2011 10:00:57 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Wed Mar 23 2011 09:25:47 GMT-0400 (Eastern Daylight Time)");
Line Deleted : user_pref("ConduitEngine.initDone", true);
Line Deleted : user_pref("ConduitEngine.isAppTrackingManagerOn", true);
Line Deleted : user_pref("extensions.enabledItems", "{ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2,[email protected]:3.2.5.2,{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.[...]
Line Deleted : user_pref("smartbar.machineId", "NCEIGCOFBWKEXZORYR085Z+TZDC/2YGA7I2Y7GZHBHEBXNMAIBXTOFJTMYP5PCHVHWQH+RIJJTWRJHHSZFCJUA");
-\\ Google Chrome v31.0.1650.63
[ File : C:\Users\Matt The Cat\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [21607 octets] - [22/12/2013 21:54:19]
AdwCleaner[S0].txt - [21713 octets] - [22/12/2013 21:55:09]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21774 octets] ##########

 

[soulcat]

Man, that deleted a lot of crap off my machine. Thanks. But items on control panel are still not launching AND I just ran the Windows Genuine Check as an administrator and it said that it couldn't run the code due to technical difficulties OR because I might be running an unsupported operating system (dang!).

 

[Golden]

OK. Did you see all the Conduit PUP items? They should have all been cleaned....check with Malwarebytes again to be sure.

I'm still not convinced the race condition interfering with the Windows genuine check has been solved. Did you completely uninstall McAfee? Have you ever had any other anti-malware software installed on the system prior to MaCafee?

When you run the genuine check, be sure to use this link: http://go.microsoft.com/fwlink/?linkid=52012

 

[ICIT2LOL]

Another you can run mate is
http://www.superantispyware.com/

I don't know what the others think but perhaps a run of the TDSS Killer might help
Free Malware Removal Tools scroll down to it and run.

John, we shouldn't take this shotgun approach with posting several antimalware scanners...we should see whether the current PUPs can be sufficiently cleaned using Malwarebytes and AdwCleaner first.

Ok no probs and looks like something has turned up anyway.