theredog

Didn't I? Don't like the new version too much. Around the same time, a new version of GOM player bundled AVG toolbar to the Firefox browser. Can't remember if I chose to quarantine or remove. Had to be quarantine because there are only two other options, ignore and add to list. Here is a new log and now some crap called open candy is detected. PUP.Optional.OpenCandy, C:\Users\Redog\AppData\Roaming\OpenCandy, , [525fec8e88f359ddb73b5537758d0ff1], PUP.Optional.OpenCandy, C:\Users\Redog\AppData\Roaming\OpenCandy\E7B9FD8AB57A4EBDA1F7BEDDF102756C, , [525fec8e88f359ddb73b5537758d0ff1], Files:

Malwarebytes updated to new version a few days ago. I ran a quick scan and to my surprise an old nemesis appeared. Chuck removed "Scorpion Saver" more than a year ago (page 3 on this forum) So here I am, in shame. Malwarebytes log: Scan Date: 6/12/2014 Scan Time: 10:46:32 AM Logfile: 123.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.06.12.06 Rootkit Database: v2014.06.02.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Redog Scan Type: Threat Sc

Alright. The double AGV entry in Codestuff was gone today. I think after I ran ADW Cleaner. Maybe No Script is blocking java. Who knows. No big deal, they're all loaded again. Thanks so much for all your help and tolerance. Going to refrain from sniffing around the net for a while now.

It happened again. I was looking for a reply and didn't see page 2. I ran a Java check and a Java removal tool and both say I have the latest version. Can't work it in Firefox but in IE. Why is that? Would you suggest I go back to Avast instead of AGV? I manually update that at least once a week but more often than not I check it a few times a day. Depends on how slow the connection is.

Well, the last time (Scorpion Saver Thread) you said you couldn't understand what would cause that. What about the updates? I have two in Firefox a Java Development Toolkit and VLC Web Plug In that are out of date. Are you telling me I need to update other stuff?

Done OTL clean up with AGV enabled and Firewall disabled. Again I noticed this process has removed most plug ins from Firefox Flags, WOT, Anonymox, No Script etc. . .

Understand. It will eventually be removed.

All processes killed ========== OTL ========== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\Defaul

We went through this on the last infection last week. I haven't used BT in awhile due to other issues and I have removed Tribler from computer. I don't plan on using Fremake video converter from their website or CNET either. Their website suggests adding browser toolbars also. What about your " a lot of out of dates but hold off on updating them untill i look threw the OTL log"? Is the confuser clean again?

Firewall off, agv disabled until reboot OTL: OTL logfile created on: 12/19/2013 9:58:12 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Redog\Desktop\CNET 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16428) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 6.00 Gb Total Physical Memory | 4.55 Gb Available Physical Memory | 75.87% Memory free 12.00 Gb Paging File | 10.31 Gb Available in Paging File | 85.95% Paging File free Paging file location(s): ?:\pagefile.sys [bi

OK, I took it upon myself to run ADW Cleaner and the "connect" toolbar is now gone. Windows firewall was turned off and agv disabled until reboot. Don't see "conduit" folder anymore. ADW Cleaner Log: # AdwCleaner v3.015 - Report created 19/12/2013 at 08:34:02 # Updated 10/12/2013 by Xplode # Operating System : Windows 7 Professional Service Pack 1 (64 bits) # Username : Redog - T00T1E_3564 # Running from : C:\Users\Redog\Desktop\CNET\adwcleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\AVG Security Toolbar Folder Deleted

I can't believe this happened so soon after you fixed me up last week. I asked a forum member at IOM TT Forum what program he used to convert video to upload and he tells me Freemake video converter. Found it at CNET,wnet through the install instructions and declined 4 installs of other BS. Well, I now have "connect" toolbar that I don't want and it won't remove. CNET use to be safe, I thought. So far I have run Malwarebytes twice. First time it had 80 hits. Second time one hit. Removed but the toolbar is still there. Why me?

In Codestuff Starter some items are missing and AGV now has two items enabled and I noticed most of the add ons and plug-ins I had in Firefox are gone. What's with that? Thanks for all that Chuck. Will work on the stuff you posted above in the next few days.

OK, ran the other in run as admin and I see after reboot that the OLT folder is gone from where it was. I haven't seen the ScorpionSaver in control panel/program removal since the last scan on December 4th.

I have another OTL in the Malware Removal folder that I can right click and run as admin, but it isn't the one I used before.

Right click doesn't offer run as admin

Posted the logs you requested above. I had AGV and Firewall disabled when I ran the checks though.

Results of screen317's Security Check version 0.99.77 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Windows Firewall Disabled! AVG AntiVirus Free Edition 2014 Antivirus out of date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 JavaFX 2.1.0 Java 7 Update 45 Adobe Flash Player 11.9.900.152 Adobe Reader 10.1.8 Adobe Reader out of Date! Mozilla Firefox (25.0.1) Google Chrome 31.0.1650.57 Google Chrome 3

Hope I have checked all you asked for in Old Timers:

Yes, I rebooted after running quick scan of Malwarebytes.

OTL logfile created on: 12/4/2013 11:51:26 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = D:\Libraries\Documents\Programs 2011\ScorpionSaver 12 2013 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16428) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 6.00 Gb Total Physical Memory | 4.27 Gb Available Physical Memory | 71.14% Memory free 12.00 Gb Paging File | 10.13 Gb Available in Paging File | 84.43% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %Sy

Here is the Malwarebytes log BEFORE rebooting Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.12.04.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16428 Redog :: T00T1E_3564 [administrator] 12/4/2013 11:12:37 AM mbam-log-2013-12-04 (11-12-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 262046 Time elapsed: 5 minute(s), 34 second(s) Memory Processes Detected: 0 (No malicious items detected) Mem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.8 (11.05.2013:1) OS: Windows 7 Professional x64 Ran by Redog on Wed 12/04/2013 at 10:58:57.33 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Successfully deleted the following from C:\Users\Redog\AppData\Roaming\mozilla\firefox\profiles\ovc4b2qd.default\prefs.js user_pref("extensions.alexa.demographics-session", "fNNaf1KOv900MH"); user_pref("extensions.alexa.sess

Shouldn't I check the top three and remove? They weren't checked after the quick scan.

Chuck, I'm a little confused on the Old Timer download. I just downloaded it from another link at BT yesterday. If you want me to delete that one, which one of the two links you provided do you want me to use? The last one ends in scr. What is scr? Have over 200 Gb of movies from Kick Ass Torrents and I try to use the ones marked with a crown, which is supposed to mean it's safe to download. I haven't been downloading for the last couple of months because the HDD is taking a crap (I think) 1TB second HDD does this now: When I click on the HDD partition where movies and clips are located, the