catz
New Helpee
Posts: 22
|
Post by catz on Apr 19, 2015 13:56:18 GMT -8
Hi there, thank you for the clarification. I had read your directions: ************** a) Click the Scan Button and wait for the scan to finish,. (already done if Adwcleaner is left pending) b) Make sure all of the items under each TAB are to be ticked. c) Click the Clean Button and Adwcleaner will process all the items ticked / checked and then may ask for the system to be restarted. [/span] d) It should create a new log afterwards (with S0 in the name).[/p] ************************************
Line a) had stated to click the Scan Button, and I was unclear if that meant I would be clicking the "Scan" Button for a second time, or if it was referencing the first time I clicked the "Scan" Button to generate the AdwCleaner[R0].txt file that I pasted previously. I never closed the AdwCleaner after that step, and it remained open with the information I had provided. I still have the message "Waiting for action. Please uncheck elements you want to keep." above the status indicator bar, and I do NOT have "Adwcleaner is left pending" as shown in your screenshot. I have included a screenshot of my AdwCleaner as it currently appears on my pc. My understanding is that I am to only choose the "Scan" Button once, and that was when you directed me to make the selection to create the AdwCleaner[R0].txt file. I DO NOT close the AdwCleaner program, but I should immediately select the "Cleaning" Button - which would mean I would skip step a) and NOT choose the "Scan" Button again. Moving to step b) directs me to Make sure all of the items under each TAB are to be ticked. Does that mean that I need to click each tab under the "Results" section - "Services", "Folders", "Files", "Shortcuts", "Scheduled tasks", etc....... to the list provided under each of those tabs have a checkmark? After choosing the "Cleaning" Button and system reboot, I will paste the results of the new log (with S0 in the name). Is that correct? I apologize for causing any confusion. I do want to make sure I understand and follow your directions correctly. Thank you so much!
I am having problems pasting my screenshot. Sorry!
|
|
catz
New Helpee
Posts: 22
|
Post by catz on Apr 19, 2015 14:01:38 GMT -8
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Apr 19, 2015 14:22:04 GMT -8
But I already stated in the instructions " (already done if Adwcleaner is left pending)"
|
|
catz
New Helpee
Posts: 22
|
Post by catz on Apr 19, 2015 15:50:15 GMT -8
Okay. I will proceed with the "Cleaning" Button. I don't have the "pending" status as mine states "Waiting for action." which was causing my confusion. I will proceed now and paste the contents of the new log. Many thanks!
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Apr 20, 2015 10:10:15 GMT -8
Has that been done??
Quads
|
|
catz
New Helpee
Posts: 22
|
Post by catz on Apr 20, 2015 10:12:35 GMT -8
I chose the "Cleaning" Button. At the end of the progress, I received 2 pop-up windows:
Popup Title: SmcGui.exe - Application Error The instruction at 0xe690d85e referenced memory at 0x00000024. The memory could not be written. Click on OK to terminate the program.
AND
Popup Title: - AdwCleaner - Informations - If you have been brought to use AdwCleaner, it's probably because your PC contained potentially unwanted programs or adware
Potentially unwanted programs are often proposed during the installation Of software. They may be present in form of toolbars that sometimes change the home page of the browser and slow internet browsing
To avoid the installation of these programs polluting the computer, it is essential to follow these tips:
- Always download a program from the official link, or a trusted site - When installing a program. do not click too fast (Next) without paying attention to Terms of Use and third-party programs available - If third-party programs are available (toolbar; etc. ..), uncheck all checkboxes about him. - Enable detection of PUPS in your antivirus.
After clicking "OK" on the popup window - AdwCleaner - Informations - I then received another popup window: Popup Title: - AdwCleaner - Reboot - AdwCleaner must restart the computer to complete the removal process. The report will be opened on the next reboot.
I chose the "OK" Button of the popup window - AdwCleaner - Reboot -
I DID NOT choose the "OK" Button of the popup window SmcGui.exe - Application Error I also DID NOT choose the "X" on the popup window SmcGui.exe - Application Error to close the popup window either. I left the window open and exactly how it appeared when it opened.
My PC rebooted and when my desktop was back up, the AdwCleaner[S0].txt file opened.
The contents of the AdwCleaner[S0].txt file is pasted below:
# AdwCleaner v4.201 - Logfile created 20/04/2015 at 09:57:21 # Updated 08/04/2015 by Xplode # Database : 2015-04-15.1 [Server] # Operating system : Windows 8.1 (x64) # Username : Cathy - ANONMON # Running from : C:\Users\Cathy\Desktop\adwcleaner_4.201.exe # Option : Cleaning
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdjmbiefanbdgnkcikhllpmjnnllbbc File Deleted : C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kpdjmbiefanbdgnkcikhllpmjnnllbbc_0.localstorage File Deleted : C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kpdjmbiefanbdgnkcikhllpmjnnllbbc_0.localstorage-journal
***** [ Scheduled tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKCU\Software\Google\Chrome\Extensions\elggllhppljlljkgfeokjpehmdamkejk Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\elggllhppljlljkgfeokjpehmdamkejk Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\elggllhppljlljkgfeokjpehmdamkejk Key Deleted : HKLM\SOFTWARE\cb3df5a3-aa54-24e6-29ac-5b1f0570b894 Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{18cc2389} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE} Key Deleted : HKCU\Software\Binkiland Browser Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\binkiland.com Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\websearch.about.com Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.ask.com Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\yourtango.com Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
***** [ Web browsers ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Google Chrome v42.0.2311.90
[C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms} [C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms} [C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : elggllhppljlljkgfeokjpehmdamkejk [C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : kpdjmbiefanbdgnkcikhllpmjnnllbbc [C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Homepage] : hxxp://binkiland.com/?f=1&a=bnk_ir_15_12&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0B0ByB0A0DyCyEyE0Dzy0BtN0D0Tzu0StCtCyByDtN1L2XzutAtFzztFtAtFtCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StC0FtB0DyEtAyD0CtG0E0BtD0BtGyBtAyE0EtGtA0BtCtBtGyE0BzzzztAtByD0AtA0C0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByBtD0CyC0BtDyBtGyByDyBzztGyEyBtD0DtG0B0CtBzytGtA0CyCtC0ByByE0D0F0B0Dzz2Q&cr=1665781238&ir= [C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Default_Search_Provider_Data] :
*************************
AdwCleaner[R0].txt - [34581 bytes] - [17/04/2015 09:37:59] AdwCleaner[S0].txt - [4509 bytes] - [20/04/2015 09:57:21]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4568 bytes] ##########
|
|
catz
New Helpee
Posts: 22
|
Post by catz on Apr 20, 2015 10:17:46 GMT -8
My screenshots of the 3 popup windows I received and explained in my previous update:
Popup Title: SmcGui.exe - Application Error
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Apr 20, 2015 10:18:29 GMT -8
Has the Norton Plugin Alert stopped, except for some users when using or starting Chrome, Chrome is different
Quads
|
|
catz
New Helpee
Posts: 22
|
Post by catz on Apr 20, 2015 10:52:46 GMT -8
Hi there, it does appear that I can now open Internet Explorer and NOT receive the Symantec Notifications of the Fake Plugin Activity 2. I have not opened Chrome or tried to open it until I got further direction from you. Should I try to open Chrome or perform additional testing? I am extremely thankful for all your help!
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Apr 20, 2015 10:54:24 GMT -8
Yes, although you do have a problem with your Chrome version to be dealt with right near the end
Quads
|
|