Getting tradeexchange.com redirect in my browsers

Getting tradeexchange.com redirect in my browsers Jan 25, 2016 23:12:43 GMT -8

Quote

Post by dbrisen on Jan 25, 2016 23:12:43 GMT -8

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Free YouTube Downloader 4.0.361
Yahoo Search Set
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKU\S-1-5-19\...\RunOnce: [] => [X]
HKU\S-1-5-20\...\RunOnce: [] => [X]
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: H - H:\OnePlus_setup.exe /s
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {156904dc-2660-11e2-af8b-00271378ddad} - H:\Startme.exe
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {208334bb-f41d-11e4-9e0d-806e6f6e6963} - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {3c6efc48-bfbf-11e3-9738-00271378ddad} - H:\.\3G_Connect.exe
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {52216ba3-74fa-11e5-9f02-00271378ddad} - H:\OnePlus_setup.exe /s
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {7b263fa5-7ea3-11e0-bd5b-00271378ddad} - H:\Startme.exe
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {e876ce7e-aa25-11e5-8184-00271378ddad} - H:\Startme.exe
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\...\MountPoints2: {fa73af1f-edf1-11e1-9115-00271378ddad} - H:\unlock.exe autoplay=true
HKU\S-1-5-18\...\RunOnce: [] => [X]
HKU\S-1-5-18\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-18\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll No File
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f8.js [2013-05-07] ()
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49567;https=127.0.0.1:49567
AutoConfigURL: [.DEFAULT] => http=127.0.0.1:49567;https=127.0.0.1:49567
Tcpip\Parameters: [DhcpNameServer] 5.152.219.52 5.152.219.53
Tcpip\..\Interfaces\{AA81DFBB-266C-4FDE-BBFA-F589B96E5F9D}: [DhcpNameServer] 5.152.219.52 5.152.219.53
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://in.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000 -> {61BE8041-0F4A-451A-BA73-51150E09B885} URL = hxxps://in.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
Toolbar: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\Magic Video Converter\codec\real\browser\plugins\nppl3260.dll [No File]
FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\Magic Video Converter\codec\real\browser\plugins\nprpjplug.dll [No File]
FF Plugin HKU\S-1-5-21-2838180248-1747301453-3343412843-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\MOHAN KUMAR\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [No File]
FF Plugin HKU\S-1-5-21-2838180248-1747301453-3343412843-1000: @talk.google.com/O1DPlugin -> C:\Users\MOHAN KUMAR\AppData\Roaming\Mozilla\plugins\npo1d.dll [No File]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF => not found
CHR StartupUrls: Default -> "hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDzyyCtB0C0B0EyCzz0FtN0D0Tzu0CtAtDzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=385978837","hxxp://www.google.com"
CHR Extension: (Google Drive) - C:\Users\MOHAN KUMAR\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-28]
CHR Extension: (Google Search) - C:\Users\MOHAN KUMAR\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR HKLM\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - <no Path\update_url>
CHR HKLM\...\Chrome\Extension: [ehgldbbpchgpcfagfpfjgoomddhccfgh] - <no Path\update_url>
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\MOHAN KUMAR\AppData\Local\CRE\mhfdcmehmjcclgopdodkjdicohagipid.crx <not found>
CHR HKLM\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files\Norton Identity Safe\Engine\2013.2.0.18\Exts\Chrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [onklpkebbeeimgojkmaccmhmoafknihh] - C:\Program Files\BrowserCompanion\blabbers-ch.crx <not found>
CHR HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\MOHAN KUMAR\AppData\Local\CRE\mhfdcmehmjcclgopdodkjdicohagipid.crx <not found>
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera\Opera.exe hxxp://aartemis.com/?type=sc&ts=1384838532&from=cor&uid=HitachiXHTS725050A9A364_091222PCK400VLG8VVHJX
S2 avast! Antivirus; "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" [X]
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S3 Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [X]
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
S2 aswFsBlk; no ImagePath
S1 BAPIDRV; system32\DRIVERS\BAPIDRV.sys [X]
S3 cmnsusbser; system32\DRIVERS\cmnsusbser.sys [X]
S0 DsArk; no ImagePath
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
U4 secdrv; no ImagePath
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
C:\Windows\system32\DRIVERS\BAPIDRV.sys
C:\Windows\system32\DRIVERS\cmnsusbser.sys
C:\Windows\system32\drivers\ccdcmb.sys
C:\Windows\system32\drivers\ccdcmbo.sys
C:\Windows\system32\drivers\nmwcdnsu.sys
C:\Windows\system32\drivers\nmwcdnsuc.sys
C:\Windows\system32\DRIVERS\pccsmcfd.sys
C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys
2011-06-19 21:42 - 2011-06-19 21:42 - 0004806 _____ () C:\Users\MOHAN KUMAR\AppData\Local\Foco.history
2013-12-09 06:51 - 2013-12-09 06:51 - 0000000 _____ () C:\Users\MOHAN KUMAR\AppData\Local\{08119A0C-A677-4BF4-BA42-9FCB8CD32DA0}
2015-09-06 10:11 - 2015-09-06 10:11 - 0000000 _____ () C:\Users\MOHAN KUMAR\AppData\Local\{1345316F-74EF-4071-8B3B-B73F4B8C08A0}
2013-12-06 17:11 - 2013-12-06 17:11 - 0000000 _____ () C:\Users\MOHAN KUMAR\AppData\Local\{279521D9-F167-44FB-89A4-FA515A0078CE}
2013-12-23 17:18 - 2013-12-23 17:18 - 0000000 _____ () C:\Users\MOHAN KUMAR\AppData\Local\{9053FDE4-9128-4566-A393-870F31D3AE7E}
2010-01-09 15:18 - 2010-01-09 15:18 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2009-12-01 03:15 - 2009-12-01 03:15 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-01-09 15:18 - 2010-01-09 15:18 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2009-12-01 03:11 - 2009-12-01 03:12 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-01-09 15:17 - 2010-01-09 15:17 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2010-01-09 15:18 - 2010-01-09 15:18 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2009-12-01 03:10 - 2009-12-01 03:11 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2009-12-01 03:12 - 2009-12-01 03:15 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-01-09 15:19 - 2010-01-09 15:19 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.135\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.99\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.57\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.69\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.2.183.39\goopdate.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.79\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{321EB55A-EF5B-42B7-915D-ED4D2FFBFDD1}\InprocServer32 -> C:\Users\MOHANK~1\AppData\Local\ASKTOO~1\DOWNLO~1\NeroRom.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.23.9\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.145\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.124\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.153\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.149\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.22.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.165\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{B6BB720C-25CB-11E0-B4E5-23EBDED72085}\InprocServer32 -> C:\Users\MOHANK~1\AppData\Local\ASKTOO~1\DOWNLO~1\NEROOE~1.DLL => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.115\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{CACAF262-9370-4615-A13B-9F5539DA4C0A}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.65\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.22.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\MOHANK~1\AppData\Local\Temp\s2pk.exe => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.21.111\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-2838180248-1747301453-3343412843-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\MOHAN KUMAR\AppData\Local\Google\Update\1.3.24.7\psuser.dll => No File
Task: {0CA10139-F165-4434-9ACA-E1627AF7FD12} - System32\Tasks\{FD01898F-D8C0-402F-A84D-3560AC1D6926} => pcalua.exe -a "C:\SMK\sftwr&backup\avast\Avast_AntiVirus_2009_Pro__v4.8.1282_Plus_Serial___life_time\Avast_AntiVirus_2009_Pro__v4.8.1282_Plus_keygen\setup Avast AntiVirus 2009 Pro v4.8.1282 +.exe" -d C:\SMK\sftwr&backup\avast\Avast_AntiVirus_2009_Pro__v4.8.1282_Plus_Serial___life_time\Avast_AntiVirus_2009_Pro__v4.8.1282_Plus_keygen
Task: {0CB3AB89-F047-4A97-B984-E1BA3F5E1C5D} - System32\Tasks\{B0EF7963-3878-4A93-8E35-0050A9EA6058} => pcalua.exe -a C:\sftwr&backup\msgr8us.exe -d C:\sftwr&backup
Task: {0D58F299-9826-413D-85E1-33D8B27554B7} - System32\Tasks\{C2AEFA4F-1F7E-4BB2-8784-1B24ADD0819A} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Desktop\Adobe Photoshop 6_K\Setup.exe" -d "C:\Users\MOHAN KUMAR\Desktop\Adobe Photoshop 6_K"
Task: {16CF2AAA-A0D3-4391-B35D-DD9E17A4CFC9} - System32\Tasks\{CC0396AA-0985-4360-ADDE-2D88C031467C} => pcalua.exe -a "C:\Program Files\Xilisoft\YouTube HD Video Converter\Uninstall.exe"
Task: {24D9F488-E64B-4501-BF29-2AD320AB6467} - System32\Tasks\{D6B06A72-D27F-4EEB-A492-36392D6E01DE} => pcalua.exe -a "H:\CRICKET 07\Cricket07_uninst.exe" -d "H:\CRICKET 07"
Task: {3A5FF87B-66B8-443F-BED9-C02F1F9574B6} - System32\Tasks\{0975C9BA-716E-45FF-BAF4-D06FD3410329} => pcalua.exe -a F:\eauninstall.exe -d F:\
Task: {46ACF2A3-7657-4B0A-99C0-FFA282CAA914} - System32\Tasks\{15AB12F5-D21B-461D-AF87-49FA96067AEA} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Downloads\Warcraft 3 Reign of Chaos and Frozen Throne cracked\4. TFT_1.20d_No-CD_Setup.exe" -d "C:\Users\MOHAN KUMAR\Downloads\Warcraft 3 Reign of Chaos and Frozen Throne cracked"
Task: {4A3B4050-6010-4E7B-BB62-97E047E79713} - System32\Tasks\FreeFileViewerUpdateChecker => C:\Program Files\FreeFileViewer\FFVCheckForUpdates.exe <==== ATTENTION
Task: {63A757DF-A8AB-4C4A-81D3-60952F52400A} - System32\Tasks\{5745C764-3867-4DC2-8779-AA2C149E4798} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Desktop\sp49408.exe" -d "C:\Users\MOHAN KUMAR\Desktop"
Task: {658DBC01-81B4-4410-8F7E-81A044C761D2} - System32\Tasks\{3F4ECC7C-B64D-4A54-88D6-CA32575CA579} => pcalua.exe -a "C:\Program Files\iBall 3.5G Wireless Modem\uninst.exe"
Task: {69F6B245-91FE-4A2F-BB92-82B4DE3DBA90} - System32\Tasks\{BF4C3DE3-EA7D-468C-ADAA-F05D458A63C1} => pcalua.exe -a "C:\Program Files\Xilisoft\Download YouTube Video\Uninstall.exe"
Task: {719C57AC-7AC0-4866-A300-919BF9ED65CF} - System32\Tasks\{BAC18BED-E729-4470-9946-291E50C17B01} => pcalua.exe -a "C:\SMK\Yuva\Files\Need.For.Speed.Most.Wanted.[ENG]PC.DVD[.ISO].[.NFO].Keygen & Crack\eauninstall.exe" -d "C:\SMK\Yuva\Files\Need.For.Speed.Most.Wanted.[ENG]PC.DVD[.ISO].[.NFO].Keygen & Crack"
Task: {72FE4796-6F8C-49F1-8C01-BC37C95B126E} - System32\Tasks\{7E411456-47F0-4233-8D10-6969A00579AF} => pcalua.exe -a "C:\Users\MOHAN KUMAR\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSAD4C3S\installer_need_for_speed_carbon_demo_English[1].exe" -d "C:\Users\MOHAN KUMAR\Desktop"
Task: {7A87D76D-6647-453A-B6D0-6B918197A10A} - System32\Tasks\{53079BD2-C6E4-40CC-B3B8-4098877298BA} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Desktop\Moto GP1\setup.exe" -d "C:\Users\MOHAN KUMAR\Desktop\Moto GP1"
Task: {7DDAA7EB-53A7-4FB7-8E58-8C50ED31165C} - System32\Tasks\{B24694B8-5100-4E06-A008-DD44453C7695} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Downloads\Internet Download Manager IDM v6.15 build 14 Incl Crack\idman615.exe" -d "C:\Users\MOHAN KUMAR\Downloads\Internet Download Manager IDM v6.15 build 14 Incl Crack"
Task: {97722812-9454-4885-A2BD-84F2F65C39B7} - System32\Tasks\{B41902FF-BF7F-4160-BC98-7E2E4392BA25} => Firefox.exe hxxp://ui.skype.com/ui/0/4.1.0.179/en/abandoninstall?source=lightinstaller&page=tsProblems&LastError=12007&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2
Task: {9ED4ED26-4D89-4FE8-9DBC-9A15AE132475} - System32\Tasks\{69BB1534-B3E0-4A8B-A337-2F0D7584635E} => pcalua.exe -a C:\PROGRA~1\UNWISE.EXE -c /U C:\PROGRA~1\INSTALL.LOG
Task: {A1EFD742-8E2B-42E3-89C3-1462136C885D} - System32\Tasks\{62F3823B-0DE7-4CDF-A0B7-A5DB237B383D} => pcalua.exe -a "C:\Program Files\NCH Software\Prism\uninst.exe"
Task: {A6D5D418-011E-43D6-8AF1-06D10EA2CE6D} - System32\Tasks\{97071147-32AB-4422-BF0A-13A8684E49C7} => pcalua.exe -a "C:\Program Files\SAMSUNG\USB Drivers\Uninstall.exe"
Task: {ADB278D3-0966-4B39-962C-364BFBF525C6} - System32\Tasks\{B45306C8-818E-400E-9AAD-41639B2D41FC} => pcalua.exe -a C:\SMK\Yuva\Brothersoft.exe -d C:\SMK\Yuva
Task: {B82210D1-F77E-4803-BFD3-691C39BF3250} - System32\Tasks\{5019E3B3-BD26-4F62-8BFD-2FCE0C621876} => pcalua.exe -a "C:\Program Files\Common Files\Nero\Nero Web\SetupX.exe" -d "C:\Program Files\Common Files\Nero\Nero Web" -c -ScParameter=65 MODE="update"
Task: {CFB906BE-F8FC-4B73-ADDF-8E0CFD5EAEDD} - System32\Tasks\{8FF73E22-FC52-424B-A846-3ECB185D5473} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Downloads\Need.For.Speed.Most.Wanted.[ENG]PC.DVD[.ISO].[.NFO].Keygen & Crack\eauninstall.exe" -d "C:\Users\MOHAN KUMAR\Downloads\Need.For.Speed.Most.Wanted.[ENG]PC.DVD[.ISO].[.NFO].Keygen & Crack"
Task: {DBF3A2A2-8A03-4668-B075-D90E3E7E43B1} - System32\Tasks\{E0076A52-3AD0-4CB6-8B14-A575A6057F51} => pcalua.exe -a G:\installer_need_for_speed_carbon_demo_English.exe -d G:\
Task: {DC2DB6F1-3843-4E8A-809D-450D6CA005EE} - System32\Tasks\{025D21E8-D999-46FE-BEA9-94315A9CB0E9} => pcalua.exe -a "C:\Users\MOHAN KUMAR\AppData\Roaming\SanDisk\SanDiskSecureAccess_Manager.exe" -c --uninstall
Task: {E1A05DA6-6F52-4942-9499-C7230FEE688A} - System32\Tasks\{BE0EC866-952A-46C7-964E-9156015A7ABD} => pcalua.exe -a "G:\File\windows 7 themes\Silver-X-7\extra\Silver-X-7\Theme\Silver-X-7.exe" -d "G:\File\windows 7 themes\Silver-X-7\extra\Silver-X-7\Theme"
Task: {EF530572-B37C-43CB-ABBD-0219A6B5A509} - System32\Tasks\{CFA2277F-0E45-4E06-A797-82FA574E8678} => pcalua.exe -a "C:\Users\MOHAN KUMAR\Desktop\Desk\objectdock_freeware.exe" -d "C:\Users\MOHAN KUMAR\Desktop\Desk"
Task: {F03FAE6C-1221-4F2B-B31D-00B1010B39FC} - System32\Tasks\{03532AE2-465A-42C8-8B0B-46886E491B3C} => pcalua.exe -a C:\ProgramData\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Nokia_PC_Suite_683_rel_14_1_APAC.exe -c /LANG="2057"
Task: C:\Windows\Tasks\FreeFileViewerUpdateChecker.job => C:\Program Files\FreeFileViewer\FFVCheckForUpdates.exe <==== ATTENTION
C:\Program Files\FreeFileViewer
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:A8ADE5D8
AlternateDataStreams: C:\ProgramData\Temp:AD022376
AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
HKU\S-1-5-21-2838180248-1747301453-3343412843-1000\Software\Classes\.exe: exefile => <===== ATTENTION
C:\PROGRA~1\MYWEBS~1
C:\Users\MOHAN KUMAR\AppData\Roaming\Yontoo
C:\Program Files\RelevantKnowledge
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

LAST >>>>
How is your system running now?

Malware Removal

Getting tradeexchange.com redirect in my browsers

Post by mohan on Jan 22, 2016 18:51:20 GMT -8

Post by dbrisen on Jan 25, 2016 23:12:43 GMT -8