Computer Suddenly Extremly SLOW 100% CPU Usage

Will I be able to download in Safe Mode, because I can't get to the internet on that computer in normal mode?

GypsyCowgirl wrote:

Will I be able to download in Safe Mode, because I can't get to the internet on that computer in normal mode?

When you boot in Safe mode, select Safe mode with NetWorking.

Okay, I got it to work. 14 different viruses and adware were found. I chose to save the file, or so I thought, but I can not find the file on the desk top or anywhere. The computer does seem to be working again. Is there something else I should do? Of something I should copy and paste here?

Good job. Now we finish up with the cleaning.

Please download AdwCleaner by Xplode onto your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  
• Click on Search.
  
• A logfile will automatically open after the scan has finished.
  
• Please post the content of that logfile in your reply.
  
• You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.
  

*********************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

The AdwCleaner report is below. Will update MBAM now.

# AdwCleaner v2.113 - Logfile created 03/04/2013 at 14:00:10
# Updated 23/02/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Robert - R2D2
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Robert\My Documents\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\searchplugins\Ask.xml
File Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\searchplugins\Conduit.xml
File Found : C:\Program Files\Mozilla FireFox\Components\AskSearch.js
File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Folder Found : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
Folder Found : C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
Folder Found : C:\Documents and Settings\Robert\Application Data\AVG Secure Search
Folder Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\ConduitCommon
Folder Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\CT3008668
Folder Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\extensions\{9427041a-a8dc-4d06-9a68-93873486e957}
Folder Found : C:\Documents and Settings\Robert\Local Settings\Application Data\AVG Secure Search
Folder Found : C:\Documents and Settings\Robert\Local Settings\Application Data\AVG Security Toolbar
Folder Found : C:\Program Files\AVG Secure Search
Folder Found : C:\Program Files\Common Files\AVG Secure Search
Folder Found : C:\Program Files\Viewpoint

***** [Registry] *****

Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\AVG Security Toolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\Software\AskBarDis
Key Found : HKLM\Software\AVG Secure Search
Key Found : HKLM\Software\AVG Security Toolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Found : HKU\S-1-5-21-1214440339-1078145449-854245398-1004\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKU\S-1-5-21-1214440339-1078145449-854245398-1004\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={369CAF9B-66B5-461B-B6EB-962E8E2D023A}&mid=de4cc499fa0e87c0ae03227b4fc32547-c9c8ad02dccbcdd6d63b555250e55cbd3d762a86&lang=us&ds=AVG&pr=fr&d=2012-01-11 03:43:50&pid=avg&sg=&v=14.2.0.1&sap=nt

-\\ Mozilla Firefox v19.0 (en-US)

File : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\prefs.js

Found : user_pref("CT3008668..clientLogIsEnabled", false);
Found : user_pref("CT3008668..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT3008668..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT3008668.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT3008668.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT3008668.AppTrackingLastCheckTime", "Tue Mar 20 2012 13:39:41 GMT-0500 (Central Daylight[...]
Found : user_pref("CT3008668.BrowserCompStateIsOpen_129558882344224997", true);
Found : user_pref("CT3008668.BrowserCompStateIsOpen_129683379764764212", true);
Found : user_pref("CT3008668.CT3008668", "CT3008668");
Found : user_pref("CT3008668.CurrentServerDate", "22-3-2012");
Found : user_pref("CT3008668.DSChangedManually", false);
Found : user_pref("CT3008668.DSInstall", true);
Found : user_pref("CT3008668.DSProtectChoice", true);
Found : user_pref("CT3008668.DSProtectCount", 1);
Found : user_pref("CT3008668.DialogsAlignMode", "LTR");
Found : user_pref("CT3008668.DialogsGetterLastCheckTime", "Wed Mar 21 2012 13:39:49 GMT-0500 (Central Daylig[...]
Found : user_pref("CT3008668.DownloadReferralCookieData", "");
Found : user_pref("CT3008668.EMailNotifierCheckInterval", "5");
Found : user_pref("CT3008668.EMailNotifierPollDate", "Wed Mar 21 2012 23:54:07 GMT-0500 (Central Daylight Ti[...]
Found : user_pref("CT3008668.EMailNotifierSound", "C:\\WINDOWS\\MEDIA\\ding.wav");
Found : user_pref("CT3008668.ExternalComponentPollDate129498282979356777", "Wed Mar 21 2012 23:43:52 GMT-050[...]
Found : user_pref("CT3008668.FirstServerDate", "15-3-2012");
Found : user_pref("CT3008668.FirstTime", true);
Found : user_pref("CT3008668.FirstTimeFF3", true);
Found : user_pref("CT3008668.FixPageNotFoundErrors", false);
Found : user_pref("CT3008668.GroupingServerCheckInterval", 1440);
Found : user_pref("CT3008668.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT3008668.HPInstall", true);
Found : user_pref("CT3008668.HasUserGlobalKeys", true);
Found : user_pref("CT3008668.HomePageProtectorEnabled", true);
Found : user_pref("CT3008668.HomepageBeforeUnload", "hxxp://search.conduit.com/?ctid=CT3008668&SearchSource=[...]
Found : user_pref("CT3008668.Initialize", true);
Found : user_pref("CT3008668.InitializeCommonPrefs", true);
Found : user_pref("CT3008668.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT3008668.InstallationType", "Unknown");
Found : user_pref("CT3008668.InstalledDate", "Thu Mar 15 2012 13:39:56 GMT-0500 (Central Daylight Time)");
Found : user_pref("CT3008668.InvalidateCache", false);
Found : user_pref("CT3008668.IsAlertDBUpdated", true);
Found : user_pref("CT3008668.IsGrouping", false);
Found : user_pref("CT3008668.IsInitSetupIni", true);
Found : user_pref("CT3008668.IsMulticommunity", false);
Found : user_pref("CT3008668.IsOpenThankYouPage", true);
Found : user_pref("CT3008668.IsOpenUninstallPage", true);
Found : user_pref("CT3008668.IsProtectorsInit", true);
Found : user_pref("CT3008668.LanguagePackLastCheckTime", "Wed Mar 21 2012 13:39:56 GMT-0500 (Central Dayligh[...]
Found : user_pref("CT3008668.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT3008668.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT3008668.LastLogin_3.10.0.1", "Wed Mar 21 2012 23:43:55 GMT-0500 (Central Daylight Time)[...]
Found : user_pref("CT3008668.LatestVersion", "3.10.0.1");
Found : user_pref("CT3008668.Locale", "en");
Found : user_pref("CT3008668.MCDetectTooltipHeight", "83");
Found : user_pref("CT3008668.MCDetectTooltipShow", false);
Found : user_pref("CT3008668.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT3008668.MCDetectTooltipWidth", "295");
Found : user_pref("CT3008668.MyStuffEnabledAtInstallation", true);
Found : user_pref("CT3008668.OriginalFirstVersion", "3.10.0.1");
Found : user_pref("CT3008668.RadioIsPodcast", false);
Found : user_pref("CT3008668.RadioLastCheckTime", "Wed Mar 21 2012 13:41:17 GMT-0500 (Central Daylight Time)[...]
Found : user_pref("CT3008668.RadioLastUpdateIPServer", "3");
Found : user_pref("CT3008668.RadioLastUpdateServer", "3");
Found : user_pref("CT3008668.RadioMediaID", "9962");
Found : user_pref("CT3008668.RadioMediaType", "Media Player");
Found : user_pref("CT3008668.RadioMenuSelectedID", "EBRadioMenu_CT30086689962");
Found : user_pref("CT3008668.RadioShrinkedFromSetup", false);
Found : user_pref("CT3008668.RadioStationName", "California%20Rock");
Found : user_pref("CT3008668.RadioStationURL", "hxxp://feedlive.net/california.asx");
Found : user_pref("CT3008668.SavedHomepage", "hxxp://mail.google.com/mail/?shva=1#inbox");
Found : user_pref("CT3008668.SearchCaption", "Productivity 3.1 Customized Web Search");
Found : user_pref("CT3008668.SearchEngineBeforeUnload", "Productivity 3.1 Customized Web Search");
Found : user_pref("CT3008668.SearchFromAddressBarIsInit", true);
Found : user_pref("CT3008668.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT300[...]
Found : user_pref("CT3008668.SearchInNewTabEnabled", true);
Found : user_pref("CT3008668.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT3008668.SearchInNewTabLastCheckTime", "Wed Mar 21 2012 13:40:47 GMT-0500 (Central Dayli[...]
Found : user_pref("CT3008668.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT3008668.SearchProtectorEnabled", true);
Found : user_pref("CT3008668.SearchProtectorToolbarDisabled", true);
Found : user_pref("CT3008668.SendProtectorDataViaLogin", true);
Found : user_pref("CT3008668.ServiceMapLastCheckTime", "Wed Mar 21 2012 13:39:41 GMT-0500 (Central Daylight [...]
Found : user_pref("CT3008668.SettingsLastCheckTime", "Wed Mar 21 2012 23:43:49 GMT-0500 (Central Daylight Ti[...]
Found : user_pref("CT3008668.SettingsLastUpdate", "1330964899");
Found : user_pref("CT3008668.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT3008668&SearchSource=13");
Found : user_pref("CT3008668.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT3008668.ThirdPartyComponentsLastCheck", "Thu Mar 15 2012 13:39:29 GMT-0500 (Central Day[...]
Found : user_pref("CT3008668.ThirdPartyComponentsLastUpdate", "1312887586");
Found : user_pref("CT3008668.ToolbarDisabled", true);
Found : user_pref("CT3008668.ToolbarShrinkedFromSetup", false);
Found : user_pref("CT3008668.TrusteLinkUrl", "hxxp://trust.conduit.com/CT3008668");
Found : user_pref("CT3008668.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT3008668.UserID", "UN99091306974699165");
Found : user_pref("CT3008668.ValidationData_Toolbar", 2);
Found : user_pref("CT3008668.WeatherNetwork", "");
Found : user_pref("CT3008668.WeatherPollDate", "Wed Mar 21 2012 23:44:04 GMT-0500 (Central Daylight Time)");
Found : user_pref("CT3008668.WeatherUnit", "F");
Found : user_pref("CT3008668.alertChannelId", "1400399");
Found : user_pref("CT3008668.approveUntrustedApps", false);
Found : user_pref("CT3008668.backendstorage.cb_firstuse0100", "31");
Found : user_pref("CT3008668.backendstorage.cb_user_id_000", "43423434303235363635353631325F46697265666F78")[...]
Found : user_pref("CT3008668.backendstorage.cbfirsttime", "546875204D617220313520323031322031333A34313A31342[...]
Found : user_pref("CT3008668.backendstorage.event_data", "253542253544");
Found : user_pref("CT3008668.backendstorage.fired_events", "");
Found : user_pref("CT3008668.backendstorage.key_date", "3231");
Found : user_pref("CT3008668.backendstorage.shoppingapp.gk.exipres", "4D6F6E204D617220323620323031322031323A[...]
Found : user_pref("CT3008668.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");
Found : user_pref("CT3008668.backendstorage.url_history0001", "687474703A2F2F7777772E6666746F6F6C626F782E636[...]
Found : user_pref("CT3008668.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT3008668.globalFirstTimeInfoLastCheckTime", "Thu Mar 15 2012 13:39:35 GMT-0500 (Central [...]
Found : user_pref("CT3008668.homepageProtectorEnableByLogin", true);
Found : user_pref("CT3008668.initDone", true);
Found : user_pref("CT3008668.isAppTrackingManagerOn", true);
Found : user_pref("CT3008668.isFirstRadioInstallation", false);
Found : user_pref("CT3008668.myStuffEnabled", true);
Found : user_pref("CT3008668.myStuffPublihserMinWidth", 400);
Found : user_pref("CT3008668.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT3008668.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT3008668.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT3008668.navigateToUrlOnSearch", false);
Found : user_pref("CT3008668.revertSettingsEnabled", false);
Found : user_pref("CT3008668.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT3008668.searchProtectorEnableByLogin", true);
Found : user_pref("CT3008668.testingCtid", "");
Found : user_pref("CT3008668.toolbarAppMetaDataLastCheckTime", "Wed Mar 21 2012 13:39:46 GMT-0500 (Central D[...]
Found : user_pref("CT3008668.toolbarContextMenuLastCheckTime", "Thu Mar 15 2012 13:39:48 GMT-0500 (Central D[...]
Found : user_pref("CT3008668.usagesFlag", 2);
Found : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3008668&Search[...]
Found : user_pref("CommunityToolbar.ConduitSearchList", "Productivity 3.1 Customized Web Search");
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3008668/CT3008668[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1400399/1396057/US", "\"0\"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3008668", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3008668",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"15c[...]
Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\Robert\\Applicatio[...]
Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Found : user_pref("CommunityToolbar.ToolbarsList", "CT3008668");
Found : user_pref("CommunityToolbar.ToolbarsList2", "CT3008668");
Found : user_pref("CommunityToolbar.ToolbarsList4", "CT3008668");
Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Wed Mar 21 2012 13:40:01 GMT-0500 (Cen[...]
Found : user_pref("CommunityToolbar.globalUserId", "dc5f93a7-52b8-4d9e-93fd-6ddcd1246666");
Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3008668");
Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Thu Mar 15 2012 13:39:4[...]
Found : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Mar 21 2012 23:44:04 GMT-050[...]
Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.notifications.locale", "en");
Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Mar 21 2012 13:39:44 GMT-0500 (C[...]
Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.notifications.userId", "d7d8a32c-80b2-4307-9733-bf558d0a9484");
Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://mail.google.com/mail/?shva=1#inbox");
Found : user_pref("CommunityToolbar.originalSearchEngine", "AVG Secure Search");
Found : user_pref("avg.install.installDirPath", "C:\\Documents and Settings\\All Users\\Application Data\\AV[...]
Found : user_pref("avg.install.userHPSettings", "hxxp://mail.google.com/mail/?shva=1#inbox");
Found : user_pref("avg.toolbar.websearchlink", "hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg");
Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Found : user_pref("browser.search.defaultthis.engineName", "Productivity 3.1 Customized Web Search");
Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3008668&Sea[...]
Found : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3008668&SearchSource=13");
Found : user_pref("extensions.snipit.askTbInstalled", true);
Found : user_pref("extensions.snipit.chromeURL", "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&g[...]
Found : user_pref("startup.homepage_override_url", "hxxp://www.ask.com/?o=20011&l=dis");

*************************

AdwCleaner[R1].txt - [21193 octets] - [04/03/2013 14:00:10]

########## EOF - C:\AdwCleaner[R1].txt - [21254 octets] ##########

Mbam scan was clean

Should I run another search with AdwCleaner, or just select delete?

Should I run another search with AdwCleaner, or just select delete?

Just run it again and select "Delete" instead of Search.

Download Combofix from any of the links below, and save it to your DESKTOP.
If your version of Windows defaults to you download folder you will need to copy it to your desktop.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

This is the report from AdwCleaner


# AdwCleaner v2.113 - Logfile created 03/04/2013 at 17:30:18
# Updated 23/02/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Robert - R2D2
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Robert\My Documents\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search
File Deleted : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\searchplugins\Ask.xml
File Deleted : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\searchplugins\Conduit.xml
File Deleted : C:\Program Files\Mozilla FireFox\Components\AskSearch.js
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
Folder Deleted : C:\Documents and Settings\Robert\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\ConduitCommon
Folder Deleted : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\CT3008668
Folder Deleted : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\extensions\{9427041a-a8dc-4d06-9a68-93873486e957}
Folder Deleted : C:\Documents and Settings\Robert\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Robert\Local Settings\Application Data\AVG Security Toolbar
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\Viewpoint

***** [Registry] *****

Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\Software\AskBarDis
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={369CAF9B-66B5-461B-B6EB-962E8E2D023A}&mid=de4cc499fa0e87c0ae03227b4fc32547-c9c8ad02dccbcdd6d63b555250e55cbd3d762a86&lang=us&ds=AVG&pr=fr&d=2012-01-11 03:43:50&pid=avg&sg=&v=14.2.0.1&sap=nt --> hxxp://www.google.com

-\\ Mozilla Firefox v19.0 (en-US)

File : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\prefs.js

C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\o2ztdjru.default\user.js ... Deleted !

Deleted : user_pref("CT3008668..clientLogIsEnabled", false);
Deleted : user_pref("CT3008668..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT3008668..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT3008668.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT3008668.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT3008668.AppTrackingLastCheckTime", "Tue Mar 20 2012 13:39:41 GMT-0500 (Central Daylight[...]
Deleted : user_pref("CT3008668.BrowserCompStateIsOpen_129558882344224997", true);
Deleted : user_pref("CT3008668.BrowserCompStateIsOpen_129683379764764212", true);
Deleted : user_pref("CT3008668.CT3008668", "CT3008668");
Deleted : user_pref("CT3008668.CurrentServerDate", "22-3-2012");
Deleted : user_pref("CT3008668.DSChangedManually", false);
Deleted : user_pref("CT3008668.DSInstall", true);
Deleted : user_pref("CT3008668.DSProtectChoice", true);
Deleted : user_pref("CT3008668.DSProtectCount", 1);
Deleted : user_pref("CT3008668.DialogsAlignMode", "LTR");
Deleted : user_pref("CT3008668.DialogsGetterLastCheckTime", "Wed Mar 21 2012 13:39:49 GMT-0500 (Central Daylig[...]
Deleted : user_pref("CT3008668.DownloadReferralCookieData", "");
Deleted : user_pref("CT3008668.EMailNotifierCheckInterval", "5");
Deleted : user_pref("CT3008668.EMailNotifierPollDate", "Wed Mar 21 2012 23:54:07 GMT-0500 (Central Daylight Ti[...]
Deleted : user_pref("CT3008668.EMailNotifierSound", "C:\\WINDOWS\\MEDIA\\ding.wav");
Deleted : user_pref("CT3008668.ExternalComponentPollDate129498282979356777", "Wed Mar 21 2012 23:43:52 GMT-050[...]
Deleted : user_pref("CT3008668.FirstServerDate", "15-3-2012");
Deleted : user_pref("CT3008668.FirstTime", true);
Deleted : user_pref("CT3008668.FirstTimeFF3", true);
Deleted : user_pref("CT3008668.FixPageNotFoundErrors", false);
Deleted : user_pref("CT3008668.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT3008668.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT3008668.HPInstall", true);
Deleted : user_pref("CT3008668.HasUserGlobalKeys", true);
Deleted : user_pref("CT3008668.HomePageProtectorEnabled", true);
Deleted : user_pref("CT3008668.HomepageBeforeUnload", "hxxp://search.conduit.com/?ctid=CT3008668&SearchSource=[...]
Deleted : user_pref("CT3008668.Initialize", true);
Deleted : user_pref("CT3008668.InitializeCommonPrefs", true);
Deleted : user_pref("CT3008668.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT3008668.InstallationType", "Unknown");
Deleted : user_pref("CT3008668.InstalledDate", "Thu Mar 15 2012 13:39:56 GMT-0500 (Central Daylight Time)");
Deleted : user_pref("CT3008668.InvalidateCache", false);
Deleted : user_pref("CT3008668.IsAlertDBUpdated", true);
Deleted : user_pref("CT3008668.IsGrouping", false);
Deleted : user_pref("CT3008668.IsInitSetupIni", true);
Deleted : user_pref("CT3008668.IsMulticommunity", false);
Deleted : user_pref("CT3008668.IsOpenThankYouPage", true);
Deleted : user_pref("CT3008668.IsOpenUninstallPage", true);
Deleted : user_pref("CT3008668.IsProtectorsInit", true);
Deleted : user_pref("CT3008668.LanguagePackLastCheckTime", "Wed Mar 21 2012 13:39:56 GMT-0500 (Central Dayligh[...]
Deleted : user_pref("CT3008668.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT3008668.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT3008668.LastLogin_3.10.0.1", "Wed Mar 21 2012 23:43:55 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT3008668.LatestVersion", "3.10.0.1");
Deleted : user_pref("CT3008668.Locale", "en");
Deleted : user_pref("CT3008668.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT3008668.MCDetectTooltipShow", false);
Deleted : user_pref("CT3008668.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT3008668.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT3008668.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT3008668.OriginalFirstVersion", "3.10.0.1");
Deleted : user_pref("CT3008668.RadioIsPodcast", false);
Deleted : user_pref("CT3008668.RadioLastCheckTime", "Wed Mar 21 2012 13:41:17 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT3008668.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT3008668.RadioLastUpdateServer", "3");
Deleted : user_pref("CT3008668.RadioMediaID", "9962");
Deleted : user_pref("CT3008668.RadioMediaType", "Media Player");
Deleted : user_pref("CT3008668.RadioMenuSelectedID", "EBRadioMenu_CT30086689962");
Deleted : user_pref("CT3008668.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT3008668.RadioStationName", "California%20Rock");
Deleted : user_pref("CT3008668.RadioStationURL", "hxxp://feedlive.net/california.asx");
Deleted : user_pref("CT3008668.SavedHomepage", "hxxp://mail.google.com/mail/?shva=1#inbox");
Deleted : user_pref("CT3008668.SearchCaption", "Productivity 3.1 Customized Web Search");
Deleted : user_pref("CT3008668.SearchEngineBeforeUnload", "Productivity 3.1 Customized Web Search");
Deleted : user_pref("CT3008668.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT3008668.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT300[...]
Deleted : user_pref("CT3008668.SearchInNewTabEnabled", true);
Deleted : user_pref("CT3008668.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT3008668.SearchInNewTabLastCheckTime", "Wed Mar 21 2012 13:40:47 GMT-0500 (Central Dayli[...]
Deleted : user_pref("CT3008668.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT3008668.SearchProtectorEnabled", true);
Deleted : user_pref("CT3008668.SearchProtectorToolbarDisabled", true);
Deleted : user_pref("CT3008668.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT3008668.ServiceMapLastCheckTime", "Wed Mar 21 2012 13:39:41 GMT-0500 (Central Daylight [...]
Deleted : user_pref("CT3008668.SettingsLastCheckTime", "Wed Mar 21 2012 23:43:49 GMT-0500 (Central Daylight Ti[...]
Deleted : user_pref("CT3008668.SettingsLastUpdate", "1330964899");
Deleted : user_pref("CT3008668.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT3008668&SearchSource=13");
Deleted : user_pref("CT3008668.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT3008668.ThirdPartyComponentsLastCheck", "Thu Mar 15 2012 13:39:29 GMT-0500 (Central Day[...]
Deleted : user_pref("CT3008668.ThirdPartyComponentsLastUpdate", "1312887586");
Deleted : user_pref("CT3008668.ToolbarDisabled", true);
Deleted : user_pref("CT3008668.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT3008668.TrusteLinkUrl", "hxxp://trust.conduit.com/CT3008668");
Deleted : user_pref("CT3008668.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT3008668.UserID", "UN99091306974699165");
Deleted : user_pref("CT3008668.ValidationData_Toolbar", 2);
Deleted : user_pref("CT3008668.WeatherNetwork", "");
Deleted : user_pref("CT3008668.WeatherPollDate", "Wed Mar 21 2012 23:44:04 GMT-0500 (Central Daylight Time)");
Deleted : user_pref("CT3008668.WeatherUnit", "F");
Deleted : user_pref("CT3008668.alertChannelId", "1400399");
Deleted : user_pref("CT3008668.approveUntrustedApps", false);
Deleted : user_pref("CT3008668.backendstorage.cb_firstuse0100", "31");
Deleted : user_pref("CT3008668.backendstorage.cb_user_id_000", "43423434303235363635353631325F46697265666F78")[...]
Deleted : user_pref("CT3008668.backendstorage.cbfirsttime", "546875204D617220313520323031322031333A34313A31342[...]
Deleted : user_pref("CT3008668.backendstorage.event_data", "253542253544");
Deleted : user_pref("CT3008668.backendstorage.fired_events", "");
Deleted : user_pref("CT3008668.backendstorage.key_date", "3231");
Deleted : user_pref("CT3008668.backendstorage.shoppingapp.gk.exipres", "4D6F6E204D617220323620323031322031323A[...]
Deleted : user_pref("CT3008668.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");
Deleted : user_pref("CT3008668.backendstorage.url_history0001", "687474703A2F2F7777772E6666746F6F6C626F782E636[...]
Deleted : user_pref("CT3008668.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT3008668.globalFirstTimeInfoLastCheckTime", "Thu Mar 15 2012 13:39:35 GMT-0500 (Central [...]
Deleted : user_pref("CT3008668.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT3008668.initDone", true);
Deleted : user_pref("CT3008668.isAppTrackingManagerOn", true);
Deleted : user_pref("CT3008668.isFirstRadioInstallation", false);
Deleted : user_pref("CT3008668.myStuffEnabled", true);
Deleted : user_pref("CT3008668.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT3008668.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT3008668.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT3008668.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT3008668.navigateToUrlOnSearch", false);
Deleted : user_pref("CT3008668.revertSettingsEnabled", false);
Deleted : user_pref("CT3008668.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT3008668.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT3008668.testingCtid", "");
Deleted : user_pref("CT3008668.toolbarAppMetaDataLastCheckTime", "Wed Mar 21 2012 13:39:46 GMT-0500 (Central D[...]
Deleted : user_pref("CT3008668.toolbarContextMenuLastCheckTime", "Thu Mar 15 2012 13:39:48 GMT-0500 (Central D[...]
Deleted : user_pref("CT3008668.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3008668&Search[...]
Deleted : user_pref("CommunityToolbar.ConduitSearchList", "Productivity 3.1 Customized Web Search");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3008668/CT3008668[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1400399/1396057/US", "\"0\"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3008668", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3008668",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"15c[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\Robert\\Applicatio[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT3008668");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT3008668");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT3008668");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Wed Mar 21 2012 13:40:01 GMT-0500 (Cen[...]
Deleted : user_pref("CommunityToolbar.globalUserId", "dc5f93a7-52b8-4d9e-93fd-6ddcd1246666");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3008668");
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Thu Mar 15 2012 13:39:4[...]
Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Mar 21 2012 23:44:04 GMT-050[...]
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Mar 21 2012 13:39:44 GMT-0500 (C[...]
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "d7d8a32c-80b2-4307-9733-bf558d0a9484");
Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://mail.google.com/mail/?shva=1#inbox");
Deleted : user_pref("CommunityToolbar.originalSearchEngine", "AVG Secure Search");
Deleted : user_pref("avg.install.installDirPath", "C:\\Documents and Settings\\All Users\\Application Data\\AV[...]
Deleted : user_pref("avg.install.userHPSettings", "hxxp://mail.google.com/mail/?shva=1#inbox");
Deleted : user_pref("avg.toolbar.websearchlink", "hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg");
Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Deleted : user_pref("browser.search.defaultthis.engineName", "Productivity 3.1 Customized Web Search");
Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3008668&Sea[...]
Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3008668&SearchSource=13");
Deleted : user_pref("extensions.snipit.askTbInstalled", true);
Deleted : user_pref("extensions.snipit.chromeURL", "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&g[...]
Deleted : user_pref("startup.homepage_override_url", "hxxp://www.ask.com/?o=20011&l=dis");

*************************

AdwCleaner[R1].txt - [21324 octets] - [04/03/2013 14:00:10]
AdwCleaner[S1].txt - [346 octets] - [04/03/2013 17:27:01]
AdwCleaner[S2].txt - [21642 octets] - [04/03/2013 17:30:18]

########## EOF - C:\AdwCleaner[S2].txt - [21703 octets] ##########

I installed ComboFix and have attempted several times to use it, but every single time it freezes up. I even turned off the screen saver after the third attempt so that nothing can interfere. The mouse was not clicked. The computer was left untouched. Each time the blue screen appears that states the scan can take up to 10 minutes though in cases of virus infestation the time can double. A cursor comes up under this paragraph and it blinks for about 30 minutes, and then the cursor disappears. At first I thought perhaps it was still scanning, then I realized the clock in the tray had stopped running. I let it set for a couple of hours waiting for something to happen. Nothing did. Each attempt ends with the same result. The computer freezing up.

CF can be tricky or cranky at times. Let's try this"

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan

•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.

• Leave the check mark next to Remove found threats.
  

•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

Can I turn my virus protection back on for this?

GypsyCowgirl wrote:

Can I turn my virus protection back on for this?

Yes.

The scan has completed, but before I select "Finish", should I select, Uninstall Application on Close, and Delete Quarantined Flies?

GypsyCowgirl wrote:

The scan has completed, but before I select "Finish", should I select, Uninstall Application on Close, and Delete Quarantined Flies?

Yes please and post the log if it gives you one.

This is the scan information.
C:\Program Files\MusicMatch\MusicMatch Jukebox\HWUpdateMove.exe Win32/Adware.HiWire application cleaned by deleting - quarantined
C:\Documents and Settings\Robert\Desktop\couponprinter.exe probably a variant of Win32/Adware.Softomate.AD application cleaned by deleting - quarantined

I did a search and I could not find
C:\Program Files\ESET\ESET Online Scanner\log.txt

How's your computer running now? Any other issues?

It seems to be doing okay.

Ok. We can do some cleanup.

Click Start> Computer> right click the C Drive and choose Properties> enter
Click Disk Cleanup from there.



Click OK on the Disk Cleanup Screen.
Click Yes on the Confirmation screen.



This runs the Disk Cleanup utility along with other selections if you have chosen any. (if you had a lot System Restore points, you will see a significant change in the free space in C drive)
**************************************************
To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.
********************************************
Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!