I have DNSunlocker problem

new

« Prev
1
Next »

arceo
New Helpee

Posts: 3

I have DNSunlocker problem Nov 8, 2015 15:14:29 GMT -8

Quote

Post by arceo on Nov 8, 2015 15:14:29 GMT -8

I have the same problem as the other fellow had with DNSunlocker. It happens with any browser. When I enter any site, there are random links appearing with DNSunlocker appearing. Even if I don't click on them, a new window opens and gives me alot of ads. Help is appreciated. I use Norton 360.

FIRST:
pastebin.com/wnYdqLHh

ADDITIONAL
pastebin.com/RvaHwUAX

Last Edit: Nov 8, 2015 16:43:29 GMT -8 by arceo

dbrisen
Malware Removalists

Posts: 3,688

I have DNSunlocker problem Nov 10, 2015 14:04:18 GMT -8

Quote

Post by dbrisen on Nov 10, 2015 14:04:18 GMT -8

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Torch

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Tcpip\..\Interfaces\{3329BF6E-9611-4B4E-8A47-B5C73D9B54F3}: [NameServer] 199.203.131.152,82.163.143.182
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421012093&from=ild&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421012093&from=ild&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV&q={searchTerms}
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=nb-NO&Src=WD8&Tid=000328B0&OHP=http%3A%2F%2Fwww.istartsurf.com%2F%3Ftype%3Dhppp&OSP=http%3A%2F%2Fwww.delta%2Dhomes.com%2Fweb%2F%3Futm%5Fsource%3Db%26utm%5Fmedium%3Dwpm03203%26utm%5Fcampaign%3Dinstall%5Fie%26utm%5Fcontent%3Dds%26from%3Dwpm03203%26uid%3DWDCXWD10EZEX%2D08M2NA0%5FWD%2DWMC3F0EA50KVA50KV%26ts%3D1426843864%26type%3Ddefault%26q%3D%7BsearchTerms%7D
SearchScopes: HKU\S-1-5-21-2174167287-1550173523-973482863-1001 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1432805772&from=zzgbkk123&uid=wdcxwd10ezex-08m2na0_wd-wmc3f0ea50kva50kv&z=e9ec06ccd298c5d0a88bd8egdz2c1o7b4e9w0m2q6w&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2174167287-1550173523-973482863-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-2174167287-1550173523-973482863-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1432805772&from=zzgbkk123&uid=wdcxwd10ezex-08m2na0_wd-wmc3f0ea50kva50kv&z=e9ec06ccd298c5d0a88bd8egdz2c1o7b4e9w0m2q6w&q={searchTerms}
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll => No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [No File]
C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll
FF Plugin-x32: TorchVLC -> C:\Users\are\AppData\Local\Torch\Plugins\Video\VLC\npvlc.dll [2013-07-30] (VideoLAN)
C:\Users\are\AppData\Local\Torch
FF user.js: detected! => C:\Users\are\AppData\Roaming\Mozilla\Firefox\Profiles\z4rira08.default\user.js [2015-09-30]
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=1419039556&from=wpc&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1419039556&from=wpc&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV","hxxp://isearch.omiga-plus.com/?type=hppp&ts=1421012093&from=ild&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV","hxxp://search.gboxapp.com/","hxxp://www.istartsurf.com/?type=hppp"
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2015-09-30]
CHR Extension: (Chrome Nettmarked-betalinger) - C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-24] [UpdateUrl: hxxps://mynamedomain.koko/00] <==== ATTENTION
S2 TorchCrashHandler; C:\Users\are\AppData\Local\Torch\Update\TorchCrashHandler.exe [1217032 2014-10-29] (TorchMedia Inc.) <==== ATTENTION
S3 EraserUtilDrv11511; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11511.sys [X]
S1 fjigpbhx; \??\C:\windows\system32\drivers\fjigpbhx.sys [X]
C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11511.sys
C:\windows\system32\drivers\fjigpbhx.sys
2015-10-30 23:35 - 2015-10-30 23:35 - 00000000 ____D C:\windows\%LOCALAPPDATA%
2015-11-01 23:36 - 2014-11-09 23:15 - 00000000 ____D C:\ProgramData\TorchCrashHandler
2015-10-29 17:27 - 2015-09-10 17:48 - 00000000 ____D C:\ProgramData\{5362d621-42e3-3d39-5362-2d62142e5885}
2015-10-29 17:27 - 2015-09-07 04:49 - 00000000 ____D C:\ProgramData\{287cf187-565f-e36c-287c-cf187565c61d}
2015-10-29 17:27 - 2015-09-02 13:24 - 00000000 ____D C:\ProgramData\{1ba5682e-c2aa-44f7-1ba5-5682ec2aa0bb}
2015-10-29 17:27 - 2015-09-02 05:24 - 00000000 ____D C:\ProgramData\{1c506afb-800c-f689-1c50-06afb800abee}
2015-10-29 17:27 - 2015-08-15 23:20 - 00000000 ____D C:\ProgramData\{389cb9f2-92b1-b54b-389c-cb9f292be7ca}
2015-10-29 17:27 - 2015-08-15 01:39 - 00000000 ____D C:\ProgramData\{b425c75e-c3a9-d5f3-b425-5c75ec3a1d7b}
2015-10-29 11:04 - 2015-01-06 03:05 - 00000000 ____D C:\ProgramData\TaaKETheCouppon
2015-10-29 05:23 - 2015-02-20 01:58 - 00000000 ____D C:\ProgramData\ShoppingDealFactory
2015-10-29 05:23 - 2015-02-05 17:51 - 00000000 ____D C:\ProgramData\Block The Ads
2015-10-29 05:23 - 2015-02-04 22:33 - 00000000 ____D C:\ProgramData\SaveItCoupons
2015-10-23 16:40 - 2014-11-09 23:14 - 00000000 ____D C:\Users\are\AppData\Local\Torch
2014-11-06 01:00 - 2014-11-06 01:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Task: {82C0E4F4-0D76-4EB4-A150-E0403D461686} - \DNSHUSHPUCKENA -> No File <==== ATTENTION
Task: {D81E2C54-FC00-4966-BA60-3AB76DA48B9D} - System32\Tasks\Uninstaller_SkipUac_are => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
C:\Program Files (x86)\IObit
Task: C:\windows\Tasks\Uninstaller_SkipUac_are.job => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
AlternateDataStreams: C:\ProgramData\TEMP:792D4CF1
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

LAST >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

[/b][/font] Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt
[/ul]

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Tell me how your system is running now. Thanks.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

arceo
New Helpee

Posts: 3

I have DNSunlocker problem Nov 10, 2015 16:20:48 GMT -8

Quote

Post by arceo on Nov 10, 2015 16:20:48 GMT -8

# AdwCleaner v5.019 - Logfile created 11/11/2015 at 01:12:34
# Updated 08/11/2015 by Xplode
# Database : 2015-11-09.1 [Server]
# Operating system : Windows 8.1 (x64)
# Username : are - ARCEO
# Running from : C:\Users\are\Desktop\AdwCleaner.exe
# Option : Cleaning
# Support : toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\WindowsMangerProtect
[-] Folder Deleted : C:\ProgramData\IHProtectUpDate
[-] Folder Deleted : C:\ProgramData\TakeTheCoupon
[-] Folder Deleted : C:\ProgramData\Ads Remover
[-] Folder Deleted : C:\ProgramData\dolelaarKeeper
[-] Folder Deleted : C:\ProgramData\JoniCoupouno
[-] Folder Deleted : C:\ProgramData\MinimumPrice
[!] Folder Not Deleted : C:\ProgramData\TakeTheCOupoN
[-] Folder Deleted : C:\ProgramData\tAKKeourleAve
[-] Folder Deleted : C:\ProgramData\214f11f2000049ea
[-] Folder Deleted : C:\ProgramData\24c7c39b000028f9
[-] Folder Deleted : C:\ProgramData\2cdd541a50bac8e0
[-] Folder Deleted : C:\ProgramData\3232832579522185440
[-] Folder Deleted : C:\ProgramData\472e4544000047aa
[-] Folder Deleted : C:\ProgramData\76ee276e00000b72
[-] Folder Deleted : C:\ProgramData\98af1bd800005442
[-] Folder Deleted : C:\ProgramData\a01b3f2800000ed1
[-] Folder Deleted : C:\ProgramData\a501d9910000406e
[-] Folder Deleted : C:\ProgramData\b279adbb00007d69
[-] Folder Deleted : C:\ProgramData\b72074400000757d
[-] Folder Deleted : C:\ProgramData\b8db27bc000024e0
[-] Folder Deleted : C:\ProgramData\ba456b5000006efe
[-] Folder Deleted : C:\ProgramData\dfee36cc00000306
[-] Folder Deleted : C:\ProgramData\e24d24b000002762
[-] Folder Deleted : C:\ProgramData\fikojgjekiiippmbolbingmnddiegfjd
[-] Folder Deleted : C:\ProgramData\ibcmefmkjhgjchgafnoieedlacidodjb
[-] Folder Deleted : C:\ProgramData\iekfeonkahogioocegfjmgckcgajigjc
[-] Folder Deleted : C:\ProgramData\kmkcemffckhkffjbpigbdfdbidmacmce
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
[-] Folder Deleted : C:\Users\are\SupTab
[-] Folder Deleted : C:\Users\are\AppData\Local\cool_mirage
[-] Folder Deleted : C:\Users\are\AppData\Local\globalUpdate
[-] Folder Deleted : C:\Users\are\AppData\Roaming\WinZipper

***** [ Files ] *****

[-] File Deleted : C:\Users\are\AppData\Roaming\regsvr32.exe_log.txt
[-] File Deleted : C:\windows\SysNative\log\iSafeKrnlCall.log

***** [ DLLs ] *****

***** [ Shortcuts ] *****

[-] Shortcut Disinfected : C:\Users\are\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Scheduled tasks ] *****

[-] Task Deleted : amiupdaterExd
[-] Task Deleted : amiupdaterExi

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\Applications\Torch.exe
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
[-] Key Deleted : HKLM\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZipper
[-] Key Deleted : HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinZipper
[-] Key Deleted : HKLM\SOFTWARE\Clients\StartMenuInternet\Torch
[-] Key Deleted : HKLM\SOFTWARE\CLASSES\dream.capture.1
[-] Key Deleted : HKLM\SOFTWARE\CLASSES\dream.capture
[-] Key Deleted : HKLM\SOFTWARE\d2184391-0f56-af51-73e2-8c263d193076
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.001
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.7z
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.arj
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.bz2
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.bzip2
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.cab
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.cpio
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.deb
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.dmg
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.fat
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.gz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.gzip
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.hfs
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.iso
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.lha
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.lzh
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.lzma
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.ntfs
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.rar
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.rpm
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.squashfs
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.swm
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.tar
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.taz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.tbz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.tbz2
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.tgz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.tpz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.txz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.vhd
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.wim
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.xar
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.xz
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.z
[-] Key Deleted : HKLM\SOFTWARE\Classes\WinZipper.zip
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{117270FA-48AC-45BB-9171-B63D1B42A910}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAC7DE5C-9520-435D-91AA-4A02E4773CEA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8B906AF1-C9E5-493C-9B36-8E1CBAE28522}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9A71EC22-9AAE-421E-98BC-59E12779D611}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9F8C77E7-C6B4-4529-AB13-CF6E6EFC6736}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B6E5186F-181F-48C2-A8C0-9191A1707AEA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B0660298-91AA-421F-BF0D-BFF6BB8BF3AE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D37BD00-E9FD-40D1-80E7-1795E510ECAA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AEF2BB85-DF75-41E2-8366-FB89A5F869F9}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAC7DE5C-9520-435D-91AA-4A02E4773CEA}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8B906AF1-C9E5-493C-9B36-8E1CBAE28522}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9A71EC22-9AAE-421E-98BC-59E12779D611}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9F8C77E7-C6B4-4529-AB13-CF6E6EFC6736}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B6E5186F-181F-48C2-A8C0-9191A1707AEA}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}
[-] Key Deleted : HKCU\Software\1ClickDownload
[-] Key Deleted : HKCU\Software\APN PIP
[-] Key Deleted : HKCU\Software\GlobalUpdate
[-] Key Deleted : HKCU\Software\HomeTab
[-] Key Deleted : HKCU\Software\powerpack
[-] Key Deleted : HKCU\Software\simplytech
[-] Key Deleted : HKCU\Software\SupHpUISoft
[-] Key Deleted : HKCU\Software\torch
[-] Key Deleted : HKCU\Software\V9
[-] Key Deleted : HKCU\Software\TNT2
[-] Key Deleted : HKCU\Software\WajIntEnhance
[-] Key Deleted : HKCU\Software\SearchProtectWS
[-] Key Deleted : HKCU\Software\Linkey
[-] Key Deleted : HKCU\Software\Kromtech
[-] Key Deleted : HKCU\Software\WEBAPP
[-] Key Deleted : HKCU\Software\Hola
[-] Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
[-] Key Deleted : HKLM\SOFTWARE\AppDataLow\SOFTWARE\Crossrider
[-] Key Deleted : HKLM\SOFTWARE\AskPartnerNetwork
[-] Key Deleted : HKLM\SOFTWARE\Conduit
[-] Key Deleted : HKLM\SOFTWARE\delta-homesSoftware
[-] Key Deleted : HKLM\SOFTWARE\GlobalUpdate
[-] Key Deleted : HKLM\SOFTWARE\hdcode
[-] Key Deleted : HKLM\SOFTWARE\Iminent
[-] Key Deleted : HKLM\SOFTWARE\omiga-plusSoftware
[-] Key Deleted : HKLM\SOFTWARE\SearchProtect
[-] Key Deleted : HKLM\SOFTWARE\SupTab
[-] Key Deleted : HKLM\SOFTWARE\supWindowsMangerProtect
[-] Key Deleted : HKLM\SOFTWARE\supWPM
[-] Key Deleted : HKLM\SOFTWARE\torch
[-] Key Deleted : HKLM\SOFTWARE\V9
[-] Key Deleted : HKLM\SOFTWARE\winzipersvc
[-] Key Deleted : HKLM\SOFTWARE\mystartsearchSoftware
[-] Key Deleted : HKLM\SOFTWARE\IHProtect
[-] Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
[-] Key Deleted : HKLM\SOFTWARE\WajIntEnhance
[-] Key Deleted : HKLM\SOFTWARE\SpeedBit
[-] Key Deleted : HKLM\SOFTWARE\AIM Toolbar
[-] Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D01A33E2-0A34-4659-82AA-8A90C51C0D21}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F488658-35A7-2AB8-A756-560BA8F103C3}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{779D1843-0043-65D2-D781-8614F17B6222}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E957849A-94AC-6F46-4623-C31474E3C170}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7540FDBD-7FDC-30AE-3778-815CB87DBE46}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F6423EE4-93D8-FA04-D09D-A8598F6EFDFD}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A3FC46A0-9B62-0EF3-B475-743B3A2762B1}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1C52B8B6-FFA2-12F6-0A5A-E8301F96A568}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B138259A-351E-33FA-2726-8D71704F1DA9}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BE360B8B-0F10-CA89-FC84-A5EAB71A6AF8}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{842C4394-47F7-60DE-480B-C09116B63559}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE9B04F2-E9E8-162C-829B-52C116B3EFCC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3119AFD3-545C-0955-573A-494F62E61990}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{35E0D123-1F22-9AE6-F973-B7ECA46E8BFE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7E7FAE3D-3358-D280-8DBF-E8E2D94326D1}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B10BC31B-DBC6-56FE-DD3D-DD4E49A3E6CE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53B21E29-3967-C332-57EB-C02631658584}
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Installer
[-] Key Deleted : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\isearch.omiga-plus.com
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\omiga-plus.com

***** [ Web browsers ] *****

[-] [C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : lljhfacjpknfplpagpnillgkiepplbjd
[-] [C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : ogminpmldncgcmokldnmmapddoccmhfl

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [13750 bytes] ##########

It seems like everything is running very good ATM! So thanks a bunch!! I'll let you know if I encounter any problems after posting this or in the future

Cheers!

dbrisen Malware Removalists Posts: 3,688	I have DNSunlocker problem Nov 10, 2015 20:40:54 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Nov 10, 2015 20:40:54 GMT -8 Glad that everything seems to work for you. If you get a chance, can you post the FRST Fixlog.txt please? Thanks.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

arceo
New Helpee

Posts: 3

I have DNSunlocker problem Nov 22, 2015 9:26:23 GMT -8

Quote

Post by arceo on Nov 22, 2015 9:26:23 GMT -8

Fix result of Farbar Recovery Scan Tool (x64) Version:07-11-2015
Ran by are (2015-11-11 01:02:41) Run:1
Running from C:\Users\are\Desktop
Loaded Profiles: are (Available Profiles: are)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Tcpip\..\Interfaces\{3329BF6E-9611-4B4E-8A47-B5C73D9B54F3}: [NameServer] 199.203.131.152,82.163.143.182
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421012093&from=ild&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421012093&from=ild&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV&q={searchTerms}
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=nb-NO&Src=WD8&Tid=000328B0&OHP=http%3A%2F%2Fwww.istartsurf.com%2F%3Ftype%3Dhppp&OSP=http%3A%2F%2Fwww.delta%2Dhomes.com%2Fweb%2F%3Futm%5Fsource%3Db%26utm%5Fmedium%3Dwpm03203%26utm%5Fcampaign%3Dinstall%5Fie%26utm%5Fcontent%3Dds%26from%3Dwpm03203%26uid%3DWDCXWD10EZEX%2D08M2NA0%5FWD%2DWMC3F0EA50KVA50KV%26ts%3D1426843864%26type%3Ddefault%26q%3D%7BsearchTerms%7D
SearchScopes: HKU\S-1-5-21-2174167287-1550173523-973482863-1001 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1432805772&from=zzgbkk123&uid=wdcxwd10ezex-08m2na0_wd-wmc3f0ea50kva50kv&z=e9ec06ccd298c5d0a88bd8egdz2c1o7b4e9w0m2q6w&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2174167287-1550173523-973482863-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF pc=MSE1
SearchScopes: HKU\S-1-5-21-2174167287-1550173523-973482863-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1432805772&from=zzgbkk123&uid=wdcxwd10ezex-08m2na0_wd-wmc3f0ea50kva50kv&z=e9ec06ccd298c5d0a88bd8egdz2c1o7b4e9w0m2q6w&q={searchTerms}
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C: Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll => No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [No File]
C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll
FF Plugin-x32: TorchVLC -> C:\Users\are\AppData\Local\Torch\Plugins\Video\VLC\npvlc.dll [2013-07-30] (VideoLAN)
C:\Users\are\AppData\Local\Torch
FF user.js: detected! => C:\Users\are\AppData\Roaming\Mozilla\Firefox\Profiles\z4rira08.default\user.js [2015-09-30]
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=1419039556&from=wpc&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1419039556&from=wpc&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV","hxxp://isearch.omiga-plus.com/?type=hppp&ts=1421012093&from=ild&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F0EA50KVA50KV","hxxp://search.gboxapp.com/","hxxp://www.istartsurf.com/?type=hppp"
CHR Extension: Advanced SystemCare Surfing Protection) - C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2015-09-30]
CHR Extension: (Chrome Nettmarked-betalinger) - C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-24] [UpdateUrl: hxxps://mynamedomain.koko/00] <==== ATTENTION
S2 TorchCrashHandler; C:\Users\are\AppData\Local\Torch\Update\TorchCrashHandler.exe [1217032 2014-10-29] (TorchMedia Inc.) <==== ATTENTION
S3 EraserUtilDrv11511; \??\C:\Program Files (x86)\Common Files Symantec Shared\EENGINE\EraserUtilDrv11511.sys [X]
S1 fjigpbhx; \??\C:\windows\system32 drivers\fjigpbhx.sys [X]
C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11511.sys
C:\windows\system32 drivers\fjigpbhx.sys
2015-10-30 23:35 - 2015-10-30 23:35 - 00000000 ____D C:\windows\%LOCALAPPDATA%
2015-11-01 23:36 - 2014-11-09 23:15 - 00000000 ____D C:\ProgramData\TorchCrashHandler
2015-10-29 17:27 - 2015-09-10 17:48 - 00000000 ____D C:\ProgramData\{5362d621-42e3-3d39-5362-2d62142e5885}
2015-10-29 17:27 - 2015-09-07 04:49 - 00000000 ____D C:\ProgramData\{287cf187-565f-e36c-287c-cf187565c61d}
2015-10-29 17:27 - 2015-09-02 13:24 - 00000000 ____D C:\ProgramData\{1ba5682e-c2aa-44f7-1ba5-5682ec2aa0bb}
2015-10-29 17:27 - 2015-09-02 05:24 - 00000000 ____D C:\ProgramData\{1c506afb-800c-f689-1c50-06afb800abee}
2015-10-29 17:27 - 2015-08-15 23:20 - 00000000 ____D C:\ProgramData\{389cb9f2-92b1-b54b-389c-cb9f292be7ca}
2015-10-29 17:27 - 2015-08-15 01:39 - 00000000 ____D C:\ProgramData\{b425c75e-c3a9-d5f3-b425-5c75ec3a1d7b}
2015-10-29 11:04 - 2015-01-06 03:05 - 00000000 ____D C:\ProgramData\TaaKETheCouppon
2015-10-29 05:23 - 2015-02-20 01:58 - 00000000 ____D C:\ProgramData\ShoppingDealFactory
2015-10-29 05:23 - 2015-02-05 17:51 - 00000000 ____D C:\ProgramData\Block The Ads
2015-10-29 05:23 - 2015-02-04 22:33 - 00000000 ____D C:\ProgramData\SaveItCoupons
2015-10-23 16:40 - 2014-11-09 23:14 - 00000000 ____D C:\Users\are\AppData\Local\Torch
2014-11-06 01:00 - 2014-11-06 01:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Task: {82C0E4F4-0D76-4EB4-A150-E0403D461686} - \DNSHUSHPUCKENA -> No File <==== ATTENTION
Task: {D81E2C54-FC00-4966-BA60-3AB76DA48B9D} - System32\Tasks\Uninstaller_SkipUac_are => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
C:\Program Files (x86)\IObit
Task: C:\windows\Tasks\Uninstaller_SkipUac_are.job => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
AlternateDataStreams: C:\ProgramData\TEMP:792D4CF1
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

*****************

Restore point was successfully created.
Processes closed successfully.
C:\windows\system32\GroupPolicy\Machine => moved successfully
C:\windows\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
"HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Policies\Google" => key removed successfully
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3329BF6E-9611-4B4E-8A47-B5C73D9B54F3}\\NameServer => value removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\Software\Microsoft\Internet Explorer\Main\\First Home Page => value removed successfully
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}" => key removed successfully
HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => key not found.
"HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{425ED333-6083-428a-92C9-0CFC28B9D1BF}" => key removed successfully
HKCR\CLSID\{425ED333-6083-428a-92C9-0CFC28B9D1BF} => key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}" => key removed successfully
"HKCR\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9" => key removed successfully
"C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll" => not found.
HKLM\Software\Wow6432Node\MozillaPlugins\TorchVLC => key not found.
C:\Users\are\AppData\Local\Torch\Plugins\Video\VLC\npvlc.dll => not found.
C:\Users\are\AppData\Local\Torch => moved successfully
C:\Users\are\AppData\Roaming\Mozilla\Firefox\Profiles\z4rira08.default\user.js => moved successfully
Chrome HomePage => removed successfully
Chrome StartupUrls => removed successfully
C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd => moved successfully
C:\Users\are\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda <==== ATTENTION => not found
TorchCrashHandler => service not found.
EraserUtilDrv11511 => service could not remove
fjigpbhx => service removed successfully
"C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11511.sys" => not found.
"C:\windows\system32 drivers\fjigpbhx.sys" => not found.
C:\windows\%LOCALAPPDATA% => moved successfully
"C:\ProgramData\TorchCrashHandler" => not found.
C:\ProgramData\{5362d621-42e3-3d39-5362-2d62142e5885} => moved successfully
C:\ProgramData\{287cf187-565f-e36c-287c-cf187565c61d} => moved successfully
C:\ProgramData\{1ba5682e-c2aa-44f7-1ba5-5682ec2aa0bb} => moved successfully
C:\ProgramData\{1c506afb-800c-f689-1c50-06afb800abee} => moved successfully
C:\ProgramData\{389cb9f2-92b1-b54b-389c-cb9f292be7ca} => moved successfully
C:\ProgramData\{b425c75e-c3a9-d5f3-b425-5c75ec3a1d7b} => moved successfully
C:\ProgramData\TaaKETheCouppon => moved successfully
C:\ProgramData\ShoppingDealFactory => moved successfully
C:\ProgramData\Block The Ads => moved successfully
C:\ProgramData\SaveItCoupons => moved successfully
"C:\Users\are\AppData\Local\Torch" => not found.
C:\ProgramData\DP45977C.lfl => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{82C0E4F4-0D76-4EB4-A150-E0403D461686}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{82C0E4F4-0D76-4EB4-A150-E0403D461686}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DNSHUSHPUCKENA" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D81E2C54-FC00-4966-BA60-3AB76DA48B9D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D81E2C54-FC00-4966-BA60-3AB76DA48B9D}" => key removed successfully
C:\windows\System32\Tasks\Uninstaller_SkipUac_are => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Uninstaller_SkipUac_are" => key removed successfully
C:\Program Files (x86)\IObit => moved successfully
C:\windows\Tasks\Uninstaller_SkipUac_are.job => moved successfully
C:\ProgramData\TEMP => ":792D4CF1" ADS removed successfully.

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= netsh advfirewall reset =========

Ok.

========= End of CMD: =========

========= netsh advfirewall set allprofiles state on =========

Ok.

========= End of CMD: =========

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

Operasjonen er utf›rt.

========= End of Reg: =========

========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

Operasjonen er utf›rt.

========= End of Reg: =========

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.7.9600 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {A64015F8-6431-458F-9E23-4E140C7FED38}.
{C4659C50-4EF7-450A-9193-10CA59050CDF} canceled.
{46003B0A-7936-4286-9C83-88944530A6A2} canceled.
2 out of 3 jobs canceled.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2174167287-1550173523-973482863-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

========= End of RemoveProxy: =========

EmptyTemp: => 401.1 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 01:03:56 ====

Now I have encountered another problem. I have this addon called Jivaro and it suddenly disappeared from the desktop. Wanted to uninstall it and re-install it, but when I go to Add/remove programs and start to uninstall the program, it won't complete and says "An account already exists."
Any suggestions?

dbrisen Malware Removalists Posts: 3,688	I have DNSunlocker problem Nov 23, 2015 14:59:42 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Nov 23, 2015 14:59:42 GMT -8 Does an Change or Repair option appear on the Uninstall? Otherwise, booting into Safe Mode my help. windows.microsoft.com/en-ca/windows-8/windows-startup-settings-safe-mode
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

« Prev
1
Next »

I have DNSunlocker problem

Post by arceo on Nov 8, 2015 15:14:29 GMT -8

Post by dbrisen on Nov 10, 2015 14:04:18 GMT -8

Post by arceo on Nov 10, 2015 16:20:48 GMT -8

Post by dbrisen on Nov 10, 2015 20:40:54 GMT -8

Post by arceo on Nov 22, 2015 9:26:23 GMT -8

Post by dbrisen on Nov 23, 2015 14:59:42 GMT -8