Windows Explorer

[VistaKing]

Open notepad. Inside notepad Paste the text below


start
HKCU\...\Run: [ConduitFloatingPlugin_kdohfoobcodjjkpmogkjifipaocmihom] - C:\Program Files (x86)\Conduit\CT3298584\plugins\TBVerifier.dll [287008 1623-04-06] (Conduit Ltd.)
HKCU\...\Run: [ConduitFloatingPlugin_gpaiibklhaneknloaoccoidbaffjjlnb] - C:\Program Files (x86)\Conduit\CT3286042\plugins\TBVerifier.dll [287008 1623-04-06] (Conduit Ltd.)
BHO-x32: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll No File
BHO-x32: Define - {B78F92C8-DEB3-11E2-9A0A-FB64281D6ADE} - C:\Users\Mike\AppData\Local\DefineExt\temp.dat No File
S2 WajamUpdater; "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [x]
2013-08-15 20:48 - 2013-08-15 20:48 - 00000000 ____D C:\Users\Mike\AppData\Local\{FC9C10B8-5985-439B-A6F8-E8D3BFA86A0C}
2013-08-15 19:59 - 2013-08-15 21:34 - 00000000 ____D C:\Program Files (x86)\OtShot
2013-08-15 19:51 - 2013-08-15 20:11 - 00000000 ____D C:\Users\Mike\AppData\Local\Conduit
2013-08-15 19:51 - 2013-08-15 20:11 - 00000000 ____D C:\Users\Mike\AppData\Local\Conduit
2013-08-15 19:50 - 2013-08-15 19:59 - 00000000 ____D C:\Users\Mike\AppData\Local\CRE
2013-08-15 19:50 - 2013-08-15 19:59 - 00000000 ____D C:\Program Files (x86)\Conduit
2013-08-15 19:50 - 2013-08-15 19:50 - 00000000 ____D C:\Users\Mike\AppData\Roaming\SearchProtect
2013-08-15 19:38 - 2013-08-15 22:38 - 00000294 _____ C:\Windows\Tasks\Dealply.job
2013-08-15 19:38 - 2013-08-15 20:43 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-15 19:38 - 2013-08-15 20:10 - 00000866 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-15 19:38 - 2013-08-15 19:38 - 00003230 _____ C:\Windows\System32\Tasks\Dealply
2013-08-15 19:38 - 2013-08-15 19:38 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Dealply
2013-08-15 19:38 - 2013-08-15 19:38 - 00000000 ____D C:\Users\Mike\AppData\Local\DealPlyLive
2013-08-15 19:38 - 2013-08-15 19:38 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-15 19:37 - 2013-08-15 20:07 - 00000000 ____D C:\Users\Mike\AppData\Local\WebPlayer
2013-08-15 19:36 - 2013-08-15 20:00 - 00000009 _____ C:\END
2013-08-14 16:29 - 2013-08-14 19:16 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-08-14 16:29 - 2013-08-14 16:59 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-08-14 16:12 - 2013-08-14 16:12 - 00000000 ____D C:\Users\Mike\Documents\rmi
2013-08-11 19:11 - 2013-08-11 18:44 - 00001059 _____ C:\Users\Mike\Documents\win.lnk
2013-08-07 21:52 - 2013-08-15 20:37 - 00000000 ____D C:\Users\Mike\AppData\Local\Unity
2013-08-15 21:18 - 2013-08-15 07:19 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-14 22:51 - 2012-01-18 12:27 - 00000000 ____D C:\Program Files (x86)\PCPitstop
end


Click on File > Save As

File Name : Fixlist.txt
Location: Desktop
Save as type : All Files

Click on the Save button. Close Notepad

Open FRST64.exe click on the FIX button . Upload the Fixlog.txt file


Then run these

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt

Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

Upload these log files

• Fixlog.txt
• AdwCleaner[n].txt
• JRT.txt

 

[VistaKing]

Might want to take a look at these links below

Remove OtShot virus (Uninstall Guide)

Conduit Search - Virus Removal Guide

Remove Conduit Search (Removal Instructions)

Remove DealPly adware (Uninstall Guide)

 

[Mike1957]

View attachment AdwCleaner[S4].txt

View attachment JRT.txt

 

[VistaKing]

Restart the PC . Then take a look at the links on Post 202 .

Do every step .

 

[VistaKing]

I noticed you used AdwCleaner v2.306 there is a newer version 3.0.0.0 . Delete the old version and Redownload a new one below

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt

 

[Mike1957]

It's still the old version

 

[VistaKing]

Lets try this link

:ar: http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner

 

[Mike1957]

2.306

 

[VistaKing]

Ok . Looks like the Creator removed the new version to do some touch ups .

Lets do this

Open Notepad . Inside Notepad paste the highlighted text inside notepad

start
() C:\Program Files (x86)\OtShot\otshot.exe
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Search
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM-x32 - DefaultScope {7796E015-9511-4240-885C-9F70709C72A3} URL =
SearchScopes: HKCU - DefaultScope {7796E015-9511-4240-885C-9F70709C72A3} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3286042&CUI=UN41331156982065019&UM=2
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {7796E015-9511-4240-885C-9F70709C72A3} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3286042&CUI=UN41331156982065019&UM=2

BHO-x32: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll No File
FF Extension: No Name - C:\Users\Mike\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\profiles\extensions\defaults
FF Extension: No Name - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\profiles\extensions\extensions
FF Extension: No Name - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\profiles\extensions\extensions.sqlite
FF Extension: No Name - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\profiles\extensions\user.js
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] C:\Users\Mike\AppData\Roaming\Mozilla\Extensions\[email protected]
CHR Plugin: (Unity Player) - C:\Users\Mike\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
2013-08-15 20:00 - 2013-08-15 20:09 - 00000000 ____D C:\Users\Mike\AppData\Local\DefineExt
2013-08-15 19:59 - 2013-08-15 21:34 - 00000000 ____D C:\Program Files (x86)\OtShot
2013-08-15 19:51 - 2013-08-15 20:11 - 00000000 ____D C:\Users\Mike\AppData\Local\Conduit
2013-08-15 19:50 - 2013-08-15 19:59 - 00000000 ____D C:\Users\Mike\AppData\Local\CRE
2013-08-15 19:50 - 2013-08-15 19:59 - 00000000 ____D C:\Program Files (x86)\Conduit
2013-08-15 19:50 - 2013-08-15 19:50 - 00000000 ____D C:\Users\Mike\AppData\Roaming\SearchProtect
2013-08-15 19:38 - 2013-08-15 22:38 - 00000294 _____ C:\Windows\Tasks\Dealply.job
2013-08-15 19:38 - 2013-08-15 20:43 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-15 19:38 - 2013-08-15 20:10 - 00000866 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-15 19:38 - 2013-08-15 19:38 - 00003230 _____ C:\Windows\System32\Tasks\Dealply
2013-08-15 19:38 - 2013-08-15 19:38 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Dealply
2013-08-15 19:38 - 2013-08-15 19:38 - 00000000 ____D C:\Users\Mike\AppData\Local\DealPlyLive
2013-08-15 19:38 - 2013-08-15 19:38 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-15 19:37 - 2013-08-15 20:07 - 00000000 ____D C:\Users\Mike\AppData\Local\WebPlayer
2013-08-14 16:29 - 2013-08-14 19:16 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-08-14 16:29 - 2013-08-14 16:59 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-08-07 21:52 - 2013-08-15 20:37 - 00000000 ____D C:\Users\Mike\AppData\Local\Unity
end


Click on File ====> Save As

File Name : Fixlist.txt

Save as type : All Files

Location : Desktop

Click on the [Save] button .

Open FRST tool again from the Desktop and click on the [Fix] button . Once complete it will create a new log called Fixlog.txt . Upload the new log created in your reply . It should be on the desktop .

 

[Mike1957]

View attachment Fixlog.txt

 

[VistaKing]

Looks good . Any more of that window popping up ?

 

[Mike1957]

yes indeed

 

[VistaKing]

Did you do the fix from Post #201 ?

 

[Mike1957]

i think i got them

 

[VistaKing]

The Fixlog wasn't uploaded . You did upload AdwCleaner and JRT .txt files . Can you go to My Documents and see if you see a file called Win.lnk ?

 

[Mike1957]

View attachment JRT.txt

 

[Mike1957]

yes, last item say's win

 

[Mike1957]

when i clicked on it, it went to the music popup

 

[VistaKing]

LOL . shoot shouldnt have double clicked on it . By the looks of it you didn't run the fixlist on Post 201 . Run that fix .

 

[Mike1957]

View attachment Fixlog.txt

View attachment FRST.txt

View attachment JRT.txt