Hijacked Laptop

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by GodMadeDirt, Jul 28, 2014.

  1. GodMadeDirt

    GodMadeDirt Private E-2

    I wish I could give you more detail on what happened leading up to this infection. Unfortunately, I can't offer any information other than two teenagers have full administrative access to this laptop and thus have nuked it. I assume they tried in desperation to clean themselves as I see some installed software but unfortunately these days it's difficult to distinguish between legitimate software and malware.

    I can tell you it's the typical hijack type malware - we've scanned your computer and found thousands of problems click here to fix (regcleaner pro). The scans in read n run me first didn't fix anything unfortunately. I think I ran them right and attached the correct logs. It was difficult because I had to keep working around the endless popups and warnings etc.

    Thanks for any help.
     

    Attached Files:

    GodMadeDirt, Jul 28, 2014
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You forgot the Hitman Pro log. If too large to attach then put it into a ZIP file and attach it.

    You are correct your kids have really installed a ton of garbage on this PC. After we get this fixed, you need to change their user accounts into Restricted User Accounts. This PC is really a mess as you will see from the size of the fix required below.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz3A,,&q={searchTerms}
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz3A,,&q={searchTerms}
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://feed.helperbar.com/?p=mKO_Aw...BWxdzl5DVTj2_N0-_06_DY_cUoCzVAK5J51xCBErEfE8w,,
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...FtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=758365504&ir=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz3A,,&q={searchTerms}
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz3A,,&q={searchTerms}
    O1 - Hosts: 54.204.28.26 imfpmncmbojnbdhnogcegojocabhpbnh
    O1 - Hosts: 54.225.95.126 dmcecclamecbinmplcolhaljlclhbgah
    O2 - BHO: CrossriderApp0032850 - {11111111-1111-1111-1111-110311281150} - C:\Program Files (x86)\Object Browser\Object Browser-bho.dll
    O2 - BHO: CrossriderApp0035510 - {11111111-1111-1111-1111-110311551110} - C:\Program Files (x86)\iWebar\iWebar-bho.dll
    O2 - BHO: CrossriderApp0044150 - {11111111-1111-1111-1111-110411411150} - C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-bho.dll
    O2 - BHO: CrossriderApp0050776 - {11111111-1111-1111-1111-110511071176} - C:\Program Files (x86)\Plus-HD-7.5\Plus-HD-7.5-bho.dll
    O2 - BHO: CrossriderApp0051578 - {11111111-1111-1111-1111-110511151178} - C:\Program Files (x86)\HQ-Video-Profession-1.3\HQ-Video-Profession-1.3-bho.dll
    O2 - BHO: Start Savin BHO - {181F2C09-56DD-4F98-86D7-59BA2BC59B5A} - C:\Program Files (x86)\Start Savin\FrameworkBHO.dll
    O2 - BHO: SmartbarInternetExplorerBHOEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll (file missing)
    O2 - BHO: Quiknowledge - {323C6E6D-1621-470F-8A52-4FDEC4E75E40} - C:\Program Files (x86)\Quiknowledge\IE\QuiknowledgeClientIE.dll
    O2 - BHO: SaveSense - {71e129ff-6c2a-4984-818c-7e2c998b8d99} - C:\Users\Ashley\AppData\Local\SaveSense\SaveSenseIE.dll
    O2 - BHO: ValueApps Loader - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll
    O2 - BHO: ShopperProBHO - {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} - C:\ProgramData\ShopperPro\ShopperPro.dll
    O2 - BHO: TheSea.TheSeaPlugin - {C585D593-E7F3-4852-A200-561686EE02E4} - mscoree.dll (file missing)
    O2 - BHO: mysearchdial Helper Object - {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} - C:\PROGRA~2\MYSEAR~1\1821~1.0\bh\mysearchdial.dll
    O2 - BHO: Coupon Server BHO - {F791D8AE-47E8-40A5-A913-EB2D2AF29602} - C:\Program Files (x86)\Coupon Server\FrameworkBHO.dll
    O2 - BHO: PricePeep - {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} - (no file)
    O3 - Toolbar: mysearchdial Toolbar - {3004627E-F8E9-4E8B-909D-316753CBA923} - C:\PROGRA~2\MYSEAR~1\1821~1.0\mysearchdialTlbr.dll
    O3 - Toolbar: Muvic - {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll (file missing)
    O4 - HKLM\..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
    O4 - HKLM\..\Run: [pcreg] C:\Program Files\pcreg\service.exe
    O4 - HKLM\..\Run: [BService] C:\Program Files (x86)\Bench\BService\bservice.exe
    O4 - HKLM\..\Run: [Wd] C:\Program Files (x86)\Bench\Wd\wd.exe
    O4 - HKLM\..\Run: [YTDownloader] "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
    O4 - HKLM\..\Run: [SPDriver] C:\Program Files (x86)\ShopperPro\JSDriver\1.36.1.172\jsdrv.exe
    O4 - HKLM\..\RunOnce: [Start Savin-repairJob] wscript.exe "C:\Users\Vides Family\AppData\Local\Start Savin\repair.js" "Start Savin-repairJob"
    O4 - HKLM\..\RunOnce: [Coupon Server-repairJob] wscript.exe "C:\Users\Vides Family\AppData\Local\Coupon Server\repair.js" "Coupon Server-repairJob"
    O4 - HKCU\..\Run: [Optimizer Pro] C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
    O4 - HKCU\..\Run: [NextLive] C:\windows\SysWOW64\rundll32.exe "C:\Users\Vides Family\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
    O4 - HKCU\..\Run: [pcreg] C:\Program Files\pcreg\service.exe
    O4 - HKCU\..\Run: [Browser Infrastructure Helper] C:\Users\Vides Family\AppData\Local\Smartbar\Application\Muvic.exe startup
    O4 - HKUS\S-1-5-21-332858677-1064991925-2542400343-501\..\Run: [Driver Restore] C:\Program Files (x86)\Driver Restore\Driver Restore\DriverRestore.exe /applicationMode:systemTray /showWelcome:false (User 'Guest')
    O4 - S-1-5-21-332858677-1064991925-2542400343-1002 Startup: PricePeepUpdater.lnk = C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe (User 'Ashley')
    O4 - S-1-5-21-332858677-1064991925-2542400343-1002 User Startup: PricePeepUpdater.lnk = C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe (User 'Ashley')
    O4 - Startup: DesktopWeatherAlerts.lnk = Vides Family\AppData\Local\WeatherAlerts\DesktopWeatherAlertsApp.exe
    O4 - Startup: MyPC Backup.lnk = C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
    O4 - Startup: Severe Weather Alerts App.lnk = Vides Family\AppData\Local\SevereWeatherAlerts\SevereWeatherAlertsApp.exe
    O4 - Startup: Severe Weather Alerts.lnk = Vides Family\AppData\Local\SevereWeatherAlerts\SevereWeatherAlerts.exe
    O4 - Startup: Weather Alerts.lnk = Vides Family\AppData\Local\WeatherAlerts\WeatherAlerts.exe
    O20 - AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll c:\progra~2\optimi~1\optpro~1.dll
    O23 - Service: Optimizer Pro Crash Monitor (70e6ca8c) - Unknown owner - c:\progra~2\optimi~1\OptProCrash.exe
    O23 - Service: LPT System Updater Service (LPTSystemUpdater) - Unknown owner - C:\Program Files (x86)\LPT\srpts.exe
    O23 - Service: MgAssist Service (MgAssistService) - Unknown owner - C:\Program Files (x86)\Mobogenie\MgAssist.exe
    O23 - Service: MobogenieService - Mobogenie.com - C:\Program Files (x86)\Mobogenie3\MobogenieService.exe
    O23 - Service: NewPlayer Updater Service (NewPlayerUpdaterService) - Unknown owner - C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
    O23 - Service: pcregservice Service (pcregservice) - Unknown owner - C:\Program Files\pcreg\pcreg.exe
    O23 - Service: Quiknowledge Client Service (qksvc) - Quiknowledge - C:\Program Files (x86)\Quiknowledge\Service\qksvc.exe
    O23 - Service: Re-markit - Unknown owner - C:\Program Files (x86)\Re-markit\Re-markitfQL161.exe
    O23 - Service: SaveSenseLive Service (savesenselive) (savesenselive) - SaveSense - C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe
    O23 - Service: SaveSenseLive Service (savesenselivem) (savesenselivem) - SaveSense - C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe
    O23 - Service: Search Module Update (SMUpd) - Search Module Ltd. - C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe

    After clicking Fix, exit HJT.

    Now uninstall the below programs. If you do not find them or they will not uninstall, just keep going.
    Advanced System Protector
    AnyProtect
    Coupon Server
    HQ-Video-Profession-1.3
    iWebar
    Lightspark 0.5.3-git
    LPT System Updater Service
    MediaPlayerEnhance
    Mobogenie
    Mobogenie3
    Muvic Smartbar
    Mysearchdial
    NewPlayer
    Object Browser
    Optimizer Elite Max
    Optimizer Pro v3.2
    Plus-HD-7.5
    PricePeep
    Quiknowledge
    Re-markit
    RegClean Pro
    Search module
    Search Protect
    Shopper-Pro
    Start Savin
    YTDownloader

    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
explorer.exe

:Services
70e6ca8c
LPTSystemUpdater
MgAssistService
MobogenieService
NewPlayerUpdaterService
pcregservice
qksvc
Re-markit
savesenselive
savesenselivem
SMUpd
 
:Files
C:\windows\tasks\APSnotifierCA.job
C:\windows\tasks\bench-S-1-5-21-332858677-1064991925-2542400343-1001.job
C:\windows\tasks\bench-sys.job
C:\windows\tasks\HQ-Video-Profession-1.3-chromeinstaller.job
C:\windows\tasks\HQ-Video-Profession-1.3-codedownloader.job
C:\windows\tasks\HQ-Video-Profession-1.3-enabler.job
C:\windows\tasks\HQ-Video-Profession-1.3-firefoxinstaller.job
C:\windows\tasks\HQ-Video-Profession-1.3-updater.job
C:\windows\tasks\iWebar-codedownloader.job
C:\windows\tasks\iWebar-enabler.job
C:\windows\tasks\iWebar-firefoxinstaller.job
C:\windows\tasks\iWebar-updater.job
C:\windows\tasks\MediaPlayerEnhance-chromeinstaller.job
C:\windows\tasks\MediaPlayerEnhance-codedownloader.job
C:\windows\tasks\MediaPlayerEnhance-enabler.job
C:\windows\tasks\MediaPlayerEnhance-firefoxinstaller.job
C:\windows\tasks\MediaPlayerEnhance-updater.job
C:\windows\tasks\MySearchDial.job
C:\windows\tasks\Object Browser-codedownloader.job
C:\windows\tasks\Object Browser-enabler.job
C:\windows\tasks\Object Browser-firefoxinstaller.job
C:\windows\tasks\Object Browser-updater.job
C:\windows\tasks\PCHelpers1st.job
C:\windows\tasks\PCHelpers_period.job
C:\windows\tasks\Plus-HD-7.5-codedownloader.job
C:\windows\tasks\Plus-HD-7.5-enabler.job
C:\windows\tasks\Plus-HD-7.5-firefoxinstaller.job
C:\windows\tasks\Plus-HD-7.5-updater.job
C:\windows\tasks\Plus-HD-7.5-validator.job
C:\windows\tasks\Re-markit Update.job
C:\windows\tasks\Re-markit_wd.job
C:\windows\tasks\RegClean Pro_DEFAULT.job
C:\windows\tasks\RegClean Pro_UPDATES.job
C:\windows\tasks\SaveSense.job
C:\windows\tasks\SaveSenseLiveUpdateTaskMachineCore.job
C:\windows\tasks\SaveSenseLiveUpdateTaskMachineUA.job
C:\Users\Vides Family\Desktop\AnyProtect.lnk
C:\Users\Vides Family\Desktop\Clean Registry for Free!.lnk
C:\Users\Vides Family\Desktop\Computer.lnk
C:\Users\Vides Family\Desktop\Continue VuuPC Installation.lnk
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DesktopWeatherAlerts.lnk
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts App.lnk
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts.lnk
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Weather Alerts.lnk 
C:\Users\Vides Family\Desktop\MyPC Backup.lnk
C:\Users\Vides Family\Desktop\Optimizer Pro.lnk
C:\ProgramData\SearchModule
C:\ProgramData\ShopperPro
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobogenie3
C:\Program Files (x86)\Re-markit
C:\Program Files (x86)\Re-markit-soft
C:\Program Files (x86)\Mobogenie
C:\Program Files (x86)\Mobogenie3
C:\Program Files (x86)\Advanced System Protector
C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
C:\Program Files (x86)\Optimizer Pro
C:\Program Files (x86)\Bench
C:\Program Files (x86)\LPT
C:\Program Files (x86)\YTDownloader
C:\Program Files (x86)\ShopperPro
C:\Program Files (x86)\SaveSenseLive
C:\Program Files\Common Files\Goobzo
C:\Program Files (x86)\Object Browser
C:\Program Files (x86)\iWebar
C:\Program Files (x86)\MediaPlayerEnhance
C:\Program Files (x86)\MyPC Backup
C:\Program Files (x86)\NewPlayer
C:\Program Files (x86)\Plus-HD-7.5
C:\Program Files (x86)\HQ-Video-Profession-1.3
C:\Program Files (x86)\Start Savin
C:\Program Files (x86)\Quiknowledge
C:\Users\Ashley\AppData\Local\SaveSense
C:\Program Files (x86)\Conduit\ValueApps
C:\PROGRA~2\MYSEAR~1\1821~1.0
C:\Program Files (x86)\Coupon Server
C:\Program Files\pcreg
C:\Users\Vides Family\AppData\Local\Start Savin
C:\Users\Vides Family\AppData\Local\Coupon Server
C:\Users\Vides Family\AppData\Roaming\newnext.me
C:\Users\Vides Family\AppData\Local\Smartbar
C:\Program Files (x86)\PricePeep
C:\PROGRA~2\SearchProtect
C:\Users\Vides Family\AppData\Local\WeatherAlerts
C:\Users\Vides Family\AppData\Local\SevereWeatherAlerts
C:\Users\Vides Family\AppData\Local\SevereWeatherAlerts
C:\Users\Vides Family\AppData\Local\WeatherAlerts
C:\Users\Ashley\AppData\Roaming\MYSEAR~1
C:\Users\Ashley\AppData\Roaming\SAVESE~1
C:\windows\TEMP\*.*
C:\Users\Vides Family\AppData\Local\Temp\*.*

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Optimizer Pro"=-
"NextLive"=-
"pcreg"=-
"Browser Infrastructure Helper"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"mobilegeni daemon"=-
"pcreg"=-
"BService"=-
"Wd"=-
"YTDownloader"=-
"SPDriver"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\RunOnce]
"Start Savin-repairJob"=-
"Coupon Server-repairJob"=-
[HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\Run]
"mobilegeni daemon"=-
"pcreg"=-
"BService"=-
"Wd"=-
"YTDownloader"=-
"SPDriver"=-
[HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\RunOnce]
"Start Savin-repairJob"=-
"Coupon Server-repairJob"=-
[HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\run]
"Optimizer Pro"=-
"NextLive"=-
"pcreg"=-
"Browser Infrastructure Helper"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXT log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 28, 2014
    #2
  3. GodMadeDirt

    GodMadeDirt Private E-2

    O4 - S-1-5-21-332858677-1064991925-2542400343-1002 Startup: PricePeepUpdater.lnk = C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe (User 'Ashley')
    O4 - S-1-5-21-332858677-1064991925-2542400343-1002 User Startup: PricePeepUpdater.lnk = C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe (User 'Ashley')

    The above lines I couldn;t find in the mgtools (analyse)

    Sorry about omitting Hitman Pro log. Should be attached now. I have to make this quick; can't close pop-ups fast enough. seemed quiet for a bit but looks like it's just been sleeping. Also, noticed there is no AV (expired Trend)or FW on this PC.
     

    Attached Files:

    GodMadeDirt, Aug 3, 2014
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If TrendMicro is expired it is of no use to you. So please uninstall it now before continuing unless you plan to pay for an install a new version.

    Yes I expected there would still be problems. I needed the Hitman log to make a more complete fix. So now we will run another fix with a bunch of redundency to help cleanup more problems.

    Did you forget to fix the below with the analyse.exe fix last time? They are still present. Try again with no browsers open!!

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz2w,,&q={searchTerms}
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz2w,,&q={searchTerms}
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz2w,,&q={searchTerms}
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.helperbar.com/?p=mKO_Aw...NVODqszxMS1PAv-_v7UsKoP6rz2w,,&q={searchTerms}


    Also I see that the below are still installed. Did you run into a problem attempting to uninstall this?

    AnyProtect
    Shopper-Pro
    YTDownloader

    Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
explorer.exe

:Files
C:\Program Files (x86)\NewPlayer
C:\Program Files (x86)\Re-markit
C:\Program Files (x86)\SaveSenseLive
C:\Users\Ashley\AppData\Local\Installer\Install_4949\cr.exe
C:\Users\Ashley\AppData\Local\MoboGenie
C:\Users\Vides Family\AppData\Local\genienext
C:\Users\Vides Family\AppData\Roaming\newnext.me
C:\Program Files (x86)\Mysearchdial
C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_licjnkifamhpbaefhdpacpmihicfbomb_0.localstorage
C:\Users\Ashley\AppData\Local\SearchProtect
C:\Users\Ashley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PricePeepUpdater.lnk
C:\Users\Ashley\AppData\Roaming\mysearchdial
C:\windows\system32\Tasks\MySearchDial
C:\Users\Ashley\Desktop\MySearchDial.url
C:\Users\Guest\AppData\Local\SearchProtect
C:\Program Files (x86)\Advanced System Protector
C:\windows\system32\Tasks\Advanced System Protector_startup
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
C:\Users\Public\Desktop\Advanced System Protector.lnk
C:\Program Files (x86)\Mobogenie
C:\Users\Vides Family\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie
C:\Program Files (x86)\NewPlayer
C:\Users\Vides Family\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mobogenie.lnk
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie\Mobogenie.lnk
C:\Users\Vides Family\AppData\Local\Smartbar
C:\Users\Vides Family\AppData\LocalLow\Smartbar
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
C:\Users\Vides Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
C:\Users\Vides Family\AppData\Roaming\Optimizer Pro
C:\Users\Vides Family\AppData\Roaming\Systweak\Advanced System Protector
C:\Users\Vides Family\AppData\Roaming\Systweak
C:\Users\Vides Family\AppData\Roaming\Uniblue
C:\Users\Vides Family\Desktop\MyPC Backup.lnk
C:\Users\Vides Family\Desktop\Optimizer Pro.lnk
C:\Users\Vides Family\Documents\Optimizer Pro
C:\Users\Vides Family\Local Settings\Temp\Smartbar
C:\Users\Vides Family\My Documents\Mobogenie
C:\Users\Vides Family\AppData\Local\Smartbar
C:\Windows\Tasks\RegClean Pro_DEFAULT.job
C:\Windows\Tasks\RegClean Pro_UPDATES.job
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewPlayer\NewPlayer.lnk
C:\Users\Public\Desktop\NewPlayer.lnk
C:\Program Files (x86)\Optimizer Pro
C:\Program Files (x86)\RegClean Pro
C:\windows\system32\Tasks\RegClean Pro
C:\windows\system32\Tasks\RegClean Pro_DEFAULT
C:\windows\system32\Tasks\RegClean Pro_UPDATES
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro\RegClean Pro.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro\Register RegClean Pro.lnk
C:\Program Files\Conduit
C:\Users\Vides Family\AppData\Local\Temp\*.*

:Reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"pcreg"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\mysearchdial.mysearchdialHlpr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\mysearchdial.mysearchdialHlpr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-501\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.mysearchdialESrvc.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.mysearchdialESrvc]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\m]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mysearchdial.mysearchdialappCore.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mysearchdial.mysearchdialappCore]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mysearchdial.mysearchdialdskBnd.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mysearchdial.mysearchdialdskBnd]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mysearchdial.mysearchdialHlpr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mysearchdial.mysearchdialHlpr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FBC322D5-407E-4854-8C0B-555B951FD8E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\PricePeep.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4ED063C9-4A0B-4B44-A9DC-23AFF424A0D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C358B3D0-B911-41E3-A276-E7D43A6BA56D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FBC322D5-407E-4854-8C0B-555B951FD8E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Start Page]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\InstallCore\mysearchdial]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs (Adware.MyWebSearch)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page (Adware.MyWebSearch)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{3004627E-F8E9-4E8B-909D-316753CBA923} (MySearchDial)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mysearchdial]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PricePeep]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SearchProtect]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MgAssistService]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93DBF2BB-A2B3-4683-A92E-57E60751F346}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93DBF2BB-A2B3-4683-A92E-57E60751F346}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{93DBF2BB-A2B3-4683-A92E-57E60751F346}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{4A36AF02-3E2F-47DD-A102-784D22E8C2B8}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{93DBF2BB-A2B3-4683-A92E-57E60751F346}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{93DBF2BB-A2B3-4683-A92E-57E60751F346}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-501\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{93DBF2BB-A2B3-4683-A92E-57E60751F346}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Browser Infrastructure Helper]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.3gp\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.AAC\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.aif\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mov\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp3\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp4\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpeg\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpg\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wav\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wma\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmv\newp.backup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escort.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortApp.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortEng.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlbr.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NewPlayer.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.BandObjectAttribute]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.BHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.DockingPanel]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.IESmartBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.3gp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.3gp\shell]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.aac]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.aif]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.avi]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.divx]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.flv]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.mkv]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.mov]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.mp3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.mp4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.mpeg]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.mpg]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.wav]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.wma]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\newp.wmv]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{425E7597-03A2-338D-B72A-0E51FFE77A7E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{915BB7D5-082E-3B91-B1E0-45B5FDE01F24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\speedupmypc]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\Advanced System Protector.bak]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command\Advanced System Protector.bak]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\escort.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\escortApp.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\escortEng.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\escorTlbr.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\esrv.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DomaIQ]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Mobogenie.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DealPlyLive]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\speedupmypc_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\speedupmypc_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\Mobogenie.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mobilegeni daemon (Rocketfuel)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NewPlayer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RegClean Pro_is1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NewPlayer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Systweak\Advanced System Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Systweak\RegClean Pro]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Taronja]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\AppDataLow\Software\Conduit]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\AppDataLow\Software\Crossrider]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Conduit]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\InstalledBrowserExtensions\Feven]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\MAIN\Search Bar]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\MAIN\Search Page]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\MAIN\Start Page]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\Search\Default_Search_URL]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\Search\SearchAssistant]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Run\Browser Infrastructure Helper]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Microsoft\Windows\CurrentVersion\Run\Optimizer Pro (PCOptimizerPro)
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Optimizer Pro]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Smartbar]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\SmartbarBackup]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\SmartbarLog]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Softonic\ (Softonic)
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Systweak\Advanced System Protector]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1001\Software\Systweak\RegClean Pro]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\Software\Microsoft\Internet Explorer\MAIN\Search Bar]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\Software\Microsoft\Internet Explorer\MAIN\Search Page]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\Software\Microsoft\Internet Explorer\Search\Default_Search_URL]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\Software\Microsoft\Internet Explorer\Search\SearchAssistant]
[-HKEY_USERS\S-1-5-21-332858677-1064991925-2542400343-1002\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Aug 3, 2014
    #4
  5. GodMadeDirt

    GodMadeDirt Private E-2

    I cleaned the 4 remaining HKCU lines from alalyse.

    Anyprotect will not uninstall. I captured a screenshot but it basically says error, check your connection to the internet. This happens indefinitely and will not finish uninstalling.

    The other two error'd out but it said they might have been previously uninstalled and would I like to remove them from the list.

    Unfortunately, I'm still having problems when I open a browser with a bunch of popups and redirects. It doesn't seem as aggressive as the last time, if that helps.

    Thanks
     

    Attached Files:

    GodMadeDirt, Aug 7, 2014
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run the below procedure.

    Reset Chrome to Defaults

    Any better?
     
    chaslang, Aug 7, 2014
    #6
  7. GodMadeDirt

    GodMadeDirt Private E-2

    That last Chrome reset seemed to have fixed it. I haven't had a chance to kick the tires yet but at least there's nothing wrong that I can tell yet. Even MSE returns a clean scan.

    I'm sure you have some final steps for me but if not I appreciate all your help. Once I get back to my PC I'll donate to the site.
     
    GodMadeDirt, Aug 22, 2014
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    Thanks!


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.
    8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    9. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Aug 23, 2014
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds