malware on father in law's computer

Uninstall the below programs. If you do not find them or they will not uninstall, just keep going.
Java(TM) 6 Update 24
Search-Results Toolbar
SpeedMaxPc

Now install the current version of Sun Java from:

• Go here for 64 bit OS = Sun Java 64 bit Runtime Environment Make sure that when you see the form asking about installing Ask Toolbar that you uncheck this.
• Go here for 32 bit OS = Sun Java 32 bit Runtime Environment Make sure that when you see the form asking about installing Ask Toolbar that you uncheck this.

Make sure that when you install the new version of Java that you uncheck the Install the Ask Toolbar junkware checkbox. Also if it asks if you want to install McAfee Security Scan Plus that you uncheck this too. You do not need to add these unncessary items and to your PC. Also just in case Oracle changes the Java installation in the future to possibly install other junk, uncheck all but just installing Java.

Please download OTM by Old Timer and save it to your Desktop.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
 
:Files
C:\Windows\system32\config\systemprofile\AppData\Local\Temp\nsaA881.tmp
C:\Windows\system32\config\systemprofile\AppData\Local\Temp\nsv1F37.tmp
C:\Users\Hassan\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff
C:\Users\Hassan\AppData\Roaming\Mozilla\Firefox\Profiles\jlvohps2.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}
C:\Users\Yasamin\AppData\Roaming\Mozilla\Firefox\Profiles\vfnwwj4p.default\extensions\ffxtlbr@mysearchdial.com
C:\Users\Yasamin\AppData\Roaming\Mozilla\Firefox\Profiles\vfnwwj4p.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}
C:\Program Files\Movies Toolbar
C:\Program Files\Mozilla Firefox\searchplugins\Ask.xml
C:\Program Files\Mozilla Firefox\searchplugins\Search_Results.xml
C:\ProgramData\BitGuard
C:\ProgramData\BrowserProtect
C:\ProgramData\Datamngr
C:\Users\Hassan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob
C:\Users\Hassan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_aaaaabcbmongicmdegkmmfgdickgnnob_0.localstorage
C:\Users\Hassan\AppData\LocalLow\DataMngr
C:\Users\Hassan\AppData\Roaming\Mozilla\Firefox\Profiles\jlvohps2.default\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
C:\Users\Hassan\AppData\Roaming\Mozilla\Firefox\Profiles\jlvohps2.default\searchplugins\Ask.xml
C:\Users\Hassan\AppData\Roaming\Mozilla\Firefox\Profiles\jlvohps2.default\searchplugins\Search_Results.xml
C:\Users\Yasamin\AppData\LocalLow\DataMngr]
C:\Users\yasaminnajla1\AppData\LocalLow\DataMngr
C:\Users\Hassan\AppData\Local\iLivid
C:\Windows\Tasks\SpeedMaxPc.job
C:\Windows\Tasks\SpeedMaxPc Update3.job
C:\Windows\Tasks\SpeedMaxPc Registration3.jobB6}.job
C:\Users\Hassan\AppData\Roaming\DriverCure
C:\Users\Hassan\AppData\Roaming\Movies Toolbar
C:\Users\Hassan\AppData\Roaming\SpeedMaxPc
C:\ProgramData\Datamngr
C:\Windows\Temp\*.*
C:\Users\Hassan\AppData\Local\Temp\*.*

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1003\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1003_Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BrowserConnection.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\DnsBHO.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DnsBHO.BHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DnsBHO.BHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\s]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{58124A0B-DC32-4180-9BFF-E0E21AE34026}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DatamngrCoordinator]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F06DEFF2-5B9C-490D-910F-35D3A91196222]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\DatamngrCoordinator]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\F06DEFF2-5B9C-490D-910F-35D3A91196222]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DatamngrCoordinator]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F06DEFF2-5B9C-490D-910F-35D3A91196222]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1003\Software\APN DTX]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1003\Software\iLivid]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1003\Software\Microsoft\Internet Explorer\Approved Extensions\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1003\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1004-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchnu.com]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1004-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1008-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\Approved Extensions\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}]
[-HKEY_USERS\S-1-5-21-123110550-4289728209-2577616128-1008-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{57B23F2E-210E-8FAC-43CA-149F9E0C1A09}"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{365A79D7-6350-4282-88E3-0427134D8C7C}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{57B23F2E-210E-8FAC-43CA-149F9E0C1A09}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
Make sure that you shutdown all other programs this time and watch for the notice about running TrendMicro HijackThis. You need to click the Accept button twice to run it. YOu did not do this when you ran MGtools.exe the first time.
Then attach the below logs:

• the C:\_OTM\MovedFiles log
• the JRT.TXT log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

With which browsers? Actually looking pretty clean now but let's run a couple other tools.

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Attach the logfile to your next next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Please download OTL by OldTimer.

• Save it to your desktop.
• Double-click on the OTL icon on your desktopto run it. (Note: if using Vista, Win7 or Win8 use right-click and select Run as Administrator)
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  activex
  netsvcs
  drives
  

• Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)