Solved I.E and games conflict

[Vonda]

I hope I am in the correct topic section:
Last night I played Freecell and this morning when I clicked on the icon of freecell the window game up stating that I.E experienced a problem and would restart. I ran malwarebytes and eset online scan. There were some unwanted tool bars, but no viruses. Now I can't find any of the preloaded games such as freecell, hearts, solitaire and solitaire spider. How can I get these games back .
I did uncheck the games in 'turn windows features on and off', restarted the pc and reversed the procedure, to no avail.

 

[Vonda]

Clarification:
Even when not having I.E. open, when I click on Start>Games this window comes up "Internet explorer stopped working". Then the screen goes back to the desk top. I have tried restore the system in regular mode and in safe mode and both come back that windows restore did not make any changes. I also ran the sfc/scannow in regular mode and in safe mode, both came back stating there were no problems detected. At this point I am more worried about hidden malware that none of the programs detect than losing the pre installed games.

 

[ThrashZone]

Hi,
I really have no idea how the built in games work I turned them off long ago :/
I also have no idea if the game your referring to are downloaded or not ?
Review Jacee’s instructions to run Adwcleaner here post #7,
Ignore the title of the thread,
http://www.sevenforums.com/system-security/316404-instant-savings-app.html
Screen shot of the download button to use for Adwcleaner
You can use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
Uncheck the box to Activate the Free trial from the final install options,
Also use the Custom scan option not the Threat scan,
Select the drive to scan usually C,
If your really infected check the box to scan for Rootkits = this scan option will take several hours to complete,
Never use your machine while scans are running for best results,
Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to remove anything it finds
http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

 

[Vonda]

After running these scans again, should I move them to the malware section?

 

[ThrashZone]

No just post the text scan results Vonda

 

[Vonda]

OK, thanks. I am running the scans now. I'll be back right after they are all finished.

 

[Vonda]

# AdwCleaner v3.308 - Report created 24/08/2014 at 16:50:51
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Vonda - VONDA-HP
# Running from : C:\Users\Vonda\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6154S86\adwcleaner_3.308.exe
# Option : Clean
***** [ Services ] *****SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 08/25/2014 at 03:16 PM
Application Version : 6.0.1130
Database Version : 11451
Scan type : Complete Scan
Total Scan Time : 00:14:44
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 581
Memory threats detected : 0
Registry items scanned : 61176
Registry threats detected : 0
File items scanned : 24653
File threats detected : 58
Adware.Tracking Cookie
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\XLV7ZZ6L.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\XLV7ZZ6L.txt [ /doubleclick.net ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\2XI5QCJ1.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\2XI5QCJ1.txt [ /at.atwola.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\VYOVS6TH.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\VYOVS6TH.txt [ /adtechus.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\PRV2US0Q.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\PRV2US0Q.txt [ /casalemedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\MWVL0RG9.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\MWVL0RG9.txt [ /ads.yahoo.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\K7WZG7CV.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\K7WZG7CV.txt [ /advertising.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\QRLTP6WK.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\QRLTP6WK.txt [ /atdmt.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\EYVDDD0B.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\EYVDDD0B.txt [ /ads.adk2.com ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\2OJNXVH4.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\2OJNXVH4.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\9EENNGSX.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\9EENNGSX.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\TZQ8HI92.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\TZQ8HI92.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\X6DMFN14.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\X6DMFN14.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\84K4TFPZ.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\84K4TFPZ.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\ZA0UNGW0.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\ZA0UNGW0.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\L2HASO4Q.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\L2HASO4Q.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\2OJNXVH4.txtC:\USERS\VONDA\Cookies\2OJNXVH4.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\9EENNGSX.txtC:\USERS\VONDA\Cookies\9EENNGSX.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\TZQ8HI92.txtC:\USERS\VONDA\Cookies\TZQ8HI92.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\X6DMFN14.txtC:\USERS\VONDA\Cookies\X6DMFN14.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\84K4TFPZ.txtC:\USERS\VONDA\Cookies\84K4TFPZ.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\ZA0UNGW0.txtC:\USERS\VONDA\Cookies\ZA0UNGW0.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\L2HASO4Q.txtC:\USERS\VONDA\Cookies\L2HASO4Q.txt [ Cookie:[email protected]/ ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\VJ7H5WNB.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\VJ7H5WNB.txt [ /imrworldwide.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\AXVXXR9V.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\AXVXXR9V.txt [ /ru4.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S5UWR7Y1.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S5UWR7Y1.txt [ /realmedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\12YZXAYG.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\12YZXAYG.txt [ /doubleclick.net ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\17VY4TBV.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\17VY4TBV.txt [ /at.atwola.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZDC54LWL.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZDC54LWL.txt [ /adtechus.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUW66YKL.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUW66YKL.txt [ /casalemedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S9MYAAUU.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S9MYAAUU.txt [ /247realmedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\IING95KL.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\IING95KL.txt [ /ads.yahoo.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\NCS3X3HG.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\NCS3X3HG.txt [ /ad.mlnadvertising.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\MJX3YY7W.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\MJX3YY7W.txt [ /advertising.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\948WPDA6.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\948WPDA6.txt [ /ads.pubmatic.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\9A5SN582.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\9A5SN582.txt [ /smartadserver.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUWT7WOQ.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUWT7WOQ.txt [ /serving-sys.com ]
.doubleclick.net [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.imrworldwide.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.estat.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.xiti.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.xiti.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
tracking.servebom.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtechus.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.burstnet.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
in.getclicky.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.ru4.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
============
End of Log
============



***** [ Files / Folders ] *****
Folder Deleted : C:\Users\Public\Documents\iWin
***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F1963E76-845B-474C-8C7F-D69A96D8AA34}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17239

-\\ Google Chrome v36.0.1985.143
[ File : C:\Users\Vonda\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
*************************
AdwCleaner[R0].txt - [5347 octets] - [09/03/2014 15:43:00]
AdwCleaner[R1].txt - [976 octets] - [09/03/2014 15:49:23]
AdwCleaner[R2].txt - [1027 octets] - [09/03/2014 16:45:52]
AdwCleaner[R3].txt - [1152 octets] - [09/03/2014 22:27:08]
AdwCleaner[R4].txt - [1670 octets] - [18/04/2014 22:17:38]
AdwCleaner[R5].txt - [1388 octets] - [19/04/2014 08:52:59]
AdwCleaner[R6].txt - [1513 octets] - [19/04/2014 12:45:24]
AdwCleaner[R7].txt - [4159 octets] - [08/08/2014 09:11:08]
AdwCleaner[R8].txt - [3127 octets] - [24/08/2014 16:47:27]
AdwCleaner[S0].txt - [5171 octets] - [09/03/2014 15:44:24]
AdwCleaner[S1].txt - [1036 octets] - [09/03/2014 15:50:33]
AdwCleaner[S2].txt - [1089 octets] - [09/03/2014 16:47:10]
AdwCleaner[S3].txt - [1214 octets] - [09/03/2014 22:27:44]
AdwCleaner[S4].txt - [1739 octets] - [18/04/2014 22:18:56]
AdwCleaner[S5].txt - [1450 octets] - [19/04/2014 08:54:44]
AdwCleaner[S6].txt - [1574 octets] - [19/04/2014 12:46:02]
AdwCleaner[S7].txt - [3212 octets] - [08/08/2014 09:12:14]
AdwCleaner[S8].txt - [3074 octets] - [24/08/2014 16:50:51]
########## EOF - C:\AdwCleaner\AdwCleaner[S8].txt - [3134 octets] ##########
# AdwCleaner v3.308 - Report created 25/08/2014 at 11:13:37
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Vonda - VONDA-HP
# Running from : C:\Users\Vonda\Downloads\adwcleaner_3.308.exe
# Option : Clean
***** [ Services ] *****

***** [ Files / Folders ] *****
Folder Deleted : C:\Users\Public\Documents\iWin
***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F1963E76-845B-474C-8C7F-D69A96D8AA34}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17239

-\\ Google Chrome v36.0.1985.143
[ File : C:\Users\Vonda\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [5347 octets] - [09/03/2014 15:43:00]
AdwCleaner[R1].txt - [976 octets] - [09/03/2014 15:49:23]
AdwCleaner[R2].txt - [1027 octets] - [09/03/2014 16:45:52]
AdwCleaner[R3].txt - [1152 octets] - [09/03/2014 22:27:08]
AdwCleaner[R4].txt - [1670 octets] - [18/04/2014 22:17:38]
AdwCleaner[R5].txt - [1388 octets] - [19/04/2014 08:52:59]
AdwCleaner[R6].txt - [1513 octets] - [19/04/2014 12:45:24]
AdwCleaner[R7].txt - [4159 octets] - [08/08/2014 09:11:08]
AdwCleaner[R8].txt - [6180 octets] - [24/08/2014 16:47:27]
AdwCleaner[S0].txt - [5171 octets] - [09/03/2014 15:44:24]
AdwCleaner[S1].txt - [1036 octets] - [09/03/2014 15:50:33]
AdwCleaner[S2].txt - [1089 octets] - [09/03/2014 16:47:10]
AdwCleaner[S3].txt - [1214 octets] - [09/03/2014 22:27:44]
AdwCleaner[S4].txt - [1739 octets] - [18/04/2014 22:18:56]
AdwCleaner[S5].txt - [1450 octets] - [19/04/2014 08:54:44]
AdwCleaner[S6].txt - [1574 octets] - [19/04/2014 12:46:02]
AdwCleaner[S7].txt - [3212 octets] - [08/08/2014 09:12:14]
AdwCleaner[S8].txt - [6156 octets] - [24/08/2014 16:50:51]
########## EOF - C:\AdwCleaner\AdwCleaner[S8].txt - [6216 octets] ##########

 

[Vonda]

SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 08/25/2014 at 03:16 PM
Application Version : 6.0.1130
Database Version : 11451
Scan type : Complete Scan
Total Scan Time : 00:14:44
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 581
Memory threats detected : 0
Registry items scanned : 61176
Registry threats detected : 0
File items scanned : 24653
File threats detected : 58
Adware.Tracking Cookie
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\XLV7ZZ6L.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\XLV7ZZ6L.txt [ /doubleclick.net ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\2XI5QCJ1.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\2XI5QCJ1.txt [ /at.atwola.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\VYOVS6TH.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\VYOVS6TH.txt [ /adtechus.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\PRV2US0Q.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\PRV2US0Q.txt [ /casalemedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\MWVL0RG9.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\MWVL0RG9.txt [ /ads.yahoo.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\K7WZG7CV.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\K7WZG7CV.txt [ /advertising.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\QRLTP6WK.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\QRLTP6WK.txt [ /atdmt.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\EYVDDD0B.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\EYVDDD0B.txt [ /ads.adk2.com ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\2OJNXVH4.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\2OJNXVH4.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\9EENNGSX.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\9EENNGSX.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\TZQ8HI92.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\TZQ8HI92.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\X6DMFN14.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\X6DMFN14.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\84K4TFPZ.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\84K4TFPZ.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\ZA0UNGW0.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\ZA0UNGW0.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\L2HASO4Q.txtC:\USERS\VONDA\AppData\Roaming\Microsoft\Windows\Cookies\L2HASO4Q.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\2OJNXVH4.txtC:\USERS\VONDA\Cookies\2OJNXVH4.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\9EENNGSX.txtC:\USERS\VONDA\Cookies\9EENNGSX.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\TZQ8HI92.txtC:\USERS\VONDA\Cookies\TZQ8HI92.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\X6DMFN14.txtC:\USERS\VONDA\Cookies\X6DMFN14.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\84K4TFPZ.txtC:\USERS\VONDA\Cookies\84K4TFPZ.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\ZA0UNGW0.txtC:\USERS\VONDA\Cookies\ZA0UNGW0.txt [ Cookie:[email protected]/ ]
C:\USERS\VONDA\Cookies\L2HASO4Q.txtC:\USERS\VONDA\Cookies\L2HASO4Q.txt [ Cookie:[email protected]/ ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\VJ7H5WNB.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\VJ7H5WNB.txt [ /imrworldwide.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\AXVXXR9V.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\AXVXXR9V.txt [ /ru4.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S5UWR7Y1.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S5UWR7Y1.txt [ /realmedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\12YZXAYG.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\12YZXAYG.txt [ /doubleclick.net ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\17VY4TBV.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\17VY4TBV.txt [ /at.atwola.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZDC54LWL.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZDC54LWL.txt [ /adtechus.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUW66YKL.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUW66YKL.txt [ /casalemedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S9MYAAUU.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\S9MYAAUU.txt [ /247realmedia.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\IING95KL.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\IING95KL.txt [ /ads.yahoo.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\NCS3X3HG.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\NCS3X3HG.txt [ /ad.mlnadvertising.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\MJX3YY7W.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\MJX3YY7W.txt [ /advertising.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\948WPDA6.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\948WPDA6.txt [ /ads.pubmatic.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\9A5SN582.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\9A5SN582.txt [ /smartadserver.com ]
C:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUWT7WOQ.txtC:\Users\Vonda\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUWT7WOQ.txt [ /serving-sys.com ]
.doubleclick.net [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.imrworldwide.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.estat.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.xiti.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.xiti.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
tracking.servebom.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtechus.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.burstnet.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
in.getclicky.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.ru4.com [ C:\USERS\VONDA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
============
End of Log
============

 

[ThrashZone]

Hi yep that's the trouble with games they fill your machine up with a bunch of crap for your pleasure,
Missing the mbam scan was it clean ?

Temp files delete,
Run this as administrator and Start the scanner,
Shut your machine down after it finishes,
http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/
After the above reset ie,

Export Favorites to html file before resetting Internet explorer/ just to be safe.
http://www.sevenforums.com/tutorials/86795-internet-explorer-import-export-favorites.html​

Tutorial of Resetting Internet explorer,
http://www.sevenforums.com/tutorials/1222-internet-explorer-reset.html
Accessing Internet Options from the Start menu search,
Reset process first opening Internet explorer
Manage add-ons post any weird entries on the Show All Add-ons pages
http://windows.microsoft.com/en-us/internet-explorer/manage-add-ons#ie=ie-10-win-7
http://windows.microsoft.com/en-IN/windows7/How-to-manage-add-ons-in-Internet-Explorer-9
​

 

[Vonda]

I did not have a chance to see if there was a log file.

 

[Vonda]

Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 25/08/2014
Scan Time: 2:19:37 PM
Logfile: mbam.txt
Administrator: Yes
Version: 2.00.2.1012
Malware Database: v2014.08.25.05
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Vonda
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 321339
Time Elapsed: 10 min, 35 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)

(end)

 

[Vonda]

Thank you, I shall follow those steps.

 

[ThrashZone]

If your still having issues with ie,
Open ie,
Gear symbol on the top right and click on Manage add-ons,
Go to toolbars and extensions and show all add-ons and take screen shots of the listings,

 

[Vonda]

screen shot

 

[Vonda]

So far no luck, I.E still does not work and neither did the games come back.

 

[ThrashZone]

Interesting,
Let skip the games bit for a moment,
Open Chrome and go to the extensions section and post a screen shot of those listings,
Also change the advanced setting as well,

Afterwards close Chrome,
use this to open ie,
Add the Run box to the Start menu list you can also use Winkey+R to open the Run box,
http://www.sevenforums.com/tutorials/559-start-menu-add-run-button.html
http://www.sevenforums.com/tutorials/265-start-menu-customize.html
Open the Run command and Paste either of these strings into it and Okay,
"C:\Program Files\Internet Explorer\iexplore.exe" -extoff
iexplore.exe -extoff

 

[Vonda]

I deleted the IE 11 in de windows updates and I am back to I.E. 9 So far the browser works except when I click on the Wild Tangent games, then I get the Internet Explorer stopped working.

 

[Vonda]

There is a definite problem with the Wildtangent game folder. My son did make an image with Macrium to an external hard drive, but I don't know how to restore the game folder. I looked in the tutorials, but it is like a foreign language to me.

 

[Vonda]

I had I.E. 9 working, but it went wonkers again. I'll be back tomorrow 7 AM MST

 

[ThrashZone]

I asked Wolfgang = whs our Macrium expert to take a look here and see if he can help with the image restore,
He's off line now hopefully tomorrow he can give a suggestion,
Cheers.