ore262

# AdwCleaner v3.018 - Report created 14/02/2014 at 15:46:28 # Updated 28/01/2014 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Oscar - OSCAR-HP # Running from : C:\Users\Oscar\Desktop\adwcleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.16518 -\\ Mozilla Firefox v27.0 (en-US) [ File : C:\Users\Oscar\AppData\Roaming\Mozilla\Firefox\Profiles\e4ga19tc.default\prefs.js ] Line Deleted : user_pref(

hi chuck, sorry to take so long to reply. I don't see it in add/remove. More than happy to do cleanup

I have utop.it home page and wow in internet explorer search box. I downloaded a program recently and I guess this was bundled in it. I have attempted to remove it by restoring IE to it's original settings but it is still there. Can you please help me remove it? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.1 (02.04.2014:1) OS: Windows 7 Home Premium x64 Ran by Oscar on Fri 02/14/2014 at 12:59:04.54 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired:

I have re-installed chrome and prefer it, has some features I like. Today has been uneventful, you saved my butt, will check back and let you know how it works out. Thanks Oscar

Chuck, New avast scan came up clean. The threat detected warnings I am referring to are the little pop ups in the lower right hand screen, they only give you the option that says details and when you click it, it opens a browser page with the name of the threat. I have not had any more of them today. Firefox seems so slow compared to chrome, haven't used it much in a while. Thank you again .....Oscar

None of the shields show any event. Is that where I would look?

Chrome is not that great, the problem I was having was also happening initially in Fire fox. I have used FF for years and try not to use IE. I will remove chrome and see what happens. While I was typing this I had FF open and avast gave me a threat detected warning, go figure. I am using chrome to post this, may be from that. Will keep you posted, thank you so much for your help........ Oscar

Farbar Service Scanner Version: 04-08-2013 Ran by Oscar (administrator) on 09-08-2013 at 10:51:22 Running from "C:\Users\Oscar\Desktop" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabl

Does this only happen on PCH site ??? no, this morning I clicked on my home page link and it directed me to one of the sites telling me I was a winner in a new tab on chrome.

Ran combofix but could not use the laptop and had to restart it, retrieved log from C: ComboFix 13-08-07.01 - Oscar 08/09/2013 8:58.1.2 - x64Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.1768 [GMT -4:00]Running from: c:\users\Oscar\Desktop\ComboFix.exeAV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))

Hi Chuck, I was confident you had removed the problem with my lap top yesterday but this morning I was redirected to the same pages as before a couple of times.Something is lingering, Ihope you can help me get rid of it. I would like to add that I may be just be typing a text document while I have chrome browser open and Avast will show a pop up that it has blocked a virus or malware.You mentioned yesterday that 2 AVs may conflict, I already knew that but I am certain Defender is turned off, should 1 of the 2 be uninstalled? Thank you

ok

Chuck, thank you very much, I would PM you if I could figure it out, will let you know how it works out, so far it looks like you did it, Oscar

I think I figured it out, thank you so much for your help, this is the log you asked for: All processes killed========== OTL ==========No active process named TeaTimer.exe was found!No active process named SDWinSec.exe was found!HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.64bit-

Did you install/create this >>> C:\Users\Oscar\Desktop\IF I DIE OPEN THIS folder, i just need to know ??? yes i did... uninstalled Spybot - Search & Destroy. I am unclear what to do with old timer, do not understand what you are telling me to do.

Chuck, thank you for your help, I think I set up old timer scan properly, logs follow: OTL logfile created on: 8/8/2013 3:09:13 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Oscar\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.86 Gb Total Physical Memory | 2.01 Gb Available Physical Memory | 52.26% Memory free 7.71 Gb Paging File | 5.36 Gb Available in Paging File | 69.59% Paging File free P

OTL Extras logfile created on: 8/8/2013 3:09:13 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Oscar\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.86 Gb Total Physical Memory | 2.01 Gb Available Physical Memory | 52.26% Memory free 7.71 Gb Paging File | 5.36 Gb Available in Paging File | 69.59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %System

I have not figured out how to pm, like I said I am impaired. 2 logs to follow: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 5.3.8 (08.07.2013:4)OS: Windows 7 Home Premium x64Ran by Oscar on Thu 08/08/2013 at 14:36:15.53~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\trolltech ~~~ Files ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\Oscar\appdata\local\{7E6CF47A-7CC9-4245-B3EA-0455B6B

I have something in my windows 7 laptop, when I go to PCH website it redirects me to a survey site or a site that says " congratulations, you are the 100,000th visitor, choose your prize". I have run avast scan and it found something, also ran malware bytes and it found 2 items. Eset online scanner came up clean. I am not good with windows 7 and I am impaired as the result of a stroke so if I get help from someone they will need to be patient with me. I am not sure what to do first other than start a new thread. thank you for assistance in advance. What's next? MBAM quick scan log follows: