Search.Conduit annoying add on.

[Valinorum]

Hi daveyden,

• Step #5 Scan with Malwarebytes' Anti-Malware
  
  • Download Malwarebytes' Anti-Malware from the suitable link below --
    
    • Download Link #1
      
    • Download Link #2
      
    • Download Link #3
  • Double-click mbam-setup.exe to install the application.
    
  • Before clicking Finish perform the following actions --
    
    • Un-check the box beside Enable free trial of Malwarebytes Anti-Malware Premium.
      
    • Check the box beside Launch Malwarebytes Anti-Malware
  • Once the program has loaded, The MBAM dashboard will appear with an alert to update - click the green button Update Now;
    
  • Click on Setting--
    
    • Navigate to the tab Detection and Protection and check all the boxes under Detection Options
  • From the Dashboard click on Scan Now;
    
  • If threats are detected click on Apply actions. If the program asks to reboot your PC, let it do so;
    
  • On completion of the scan click on View Detailed Log after that click on Export Button, select Text File and save the log to your Desktop;
    
  • Attach the log in your next reply.

• Step #6 ESET Online Scanner
  Disable your security programs which includes but not limited to anti-virus, anti-malware, anti-spyware et cetera. Peruse this for additional information.
  
  • Go here from Internet Explorer and click on Run ESET Online Scanner.
    
    • Note: If you use any browser other than Internet Explorer, you will have to download and install esetsmartinstaller_enu.exe when prompt to run the scan.
  • Accept their terms and condition and proceed.
  • Install Add-On/Active X if prompted.
    
  • From the Computer Scan Setting --
    
    • Uncheck the box beside Remove Found Threats;
      
    • Check the box beside Scan archives
  • Click on Advanced Setting and check the following boxes--
    
    • Scan for potentially unwanted applications
      
    • Scan for potentially unsafe applications
      
    • Enable Anti-Stealth Technology
  • Click on Start and wait for the virus signature database to update.
    
  • The online scan will begin automatically and can take several hours.
    
    • Note: Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
  • After the Scan finishes --
  • If no threats were found:
    
    • Put a checkmark in Uninstall application on close.
      
    • Close the program and report that nothing was found
  • If threats were found:
    
    • Navigate to the log file located at C:\Program Files\ESET\ESET Online Scanner\log.txt (32-bit) or C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt (64-bit).
      
    • Attach the log file in your next reply.
  Note: Enable your security programs afterwards.

• Required Log(s):
  
  • MBAM Log;
  • ESET Scan Log

Regards,
Valinorum

[daveyden]

Hi jeff, took so long as I mis-placed 1st attempt!

[Valinorum]

Make sure that all your windows including your browsers are closed and re-do step 5.

[daveyden]

Now I'm a bit lost! I turned off Avast and am here through I/E, which I need to get through to this forum, as the "help" option has disappeared in the Avast site options. Shall I re-do step 5 with I/E or is there a way I can get to you without a browser? (Sorry to sound so dumb, but this really is all new to me) I'm not used to working with I/E as Chrome has made me a bit lazy! Thanks for your patience..Dave

[Pondus]

When you do step 5 ..... you close all windows/browsers before you run malwarebytes ...... if that is what you wonder about

[daveyden]

Also, I ran the eset scan, and, of course, just before it was due to finish ny screen saver started...meaning the program stalled when I touched the cursor...as you predicted! you have just replied, so I will look at your msg after posting this...

[daveyden]

Shall I go to step 6 now? I will wait for your go ahead.

[daveyden]

sorry, forgot to get detailed log, will do it again!

[Valinorum]

Skip Step 6 for now and await my next reply.

[daveyden]

Will do, I'll put the virus protection back on in the mean time.

[Valinorum]

Hi daveyden,

Is your Chrome synchronization turned on?

• Step #7 Run Zoek
  Temporary disable your security software i.e. anti-virus, anti-malware. Peruse this if you are unsure. Download Zoek.exe by smeenk from one of the following locations listed below --
  Download Link #1
  Download Link #2
  
  • Right-click and choose Run as administrator to run the program.
    
    • Note: The program may not appear instantaneously. Await few minutes for the program to start if that happens
  • Copy and Paste the following content inside the code box into Zoek's box --
    

Code: [Select]

chromelook;
CHRdefaults;
autoclean;


• Close all open Windows including your web-browser.
• Click on Run Script.
  
• Your system may reboot and a log file will open which is also located in your systemdrive.
• Copy and Paste the contents of the log in your next reply.

• Required Log(s):
  
  • Zoek Log

Regards,
Valinorum

[daveyden]

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by dave on 24/04/2014 at 19:53:09.92.
Microsoft® Windows Vista™ Home Basic  6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\dave\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

24/04/2014 19:56:32 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\Program Files\Hosts_Anti_Adwares_PUPs deleted
C:\found.000 deleted
C:\found.001 deleted
C:\Windows\wininit.ini deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension" [26/02/2014 21:40]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
glbgajbkjkcejdmjdepmchnlbnddogej - C:\Program Files\Fluxbee\fluxbee.crx[]
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[05/04/2014 08:49]

Google Docs - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
AdBlock - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
avast Online Security - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
Guitar Chords - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\megglpjmadjmghjegnallnhiknjnnjhh
Google Wallet - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Picasa - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb
Gmail - dave\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/?pc=AV01"
"Search Page"="http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://search.fluxbee.com/?id=fluxbee1c"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.msn.com/?pc=AV01"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} Microsoft (Bing) Url="http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\dave\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\dave\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\glbgajbkjkcejdmjdepmchnlbnddogej deleted successfully

==== Empty IE Cache ======================

C:\Users\dave\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\dave\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\dave\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=40 folders=5 24845782 bytes)

==== Empty Temp Folders ======================

C:\Users\dave\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\dave\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\dave\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on 24/04/2014 at 20:13:38.78 ======================

[daveyden]

Sorry, didn't mean to send whole file in this area, meant to send in attachment but mis-clicked, will await further instructions, and sorry for calling you "jeff" earlier, am dealing with him at bleeping computers!

[Valinorum]

May I ask why you have sought counsel on two different sites? Not only it may conflict with the fixes but also wastes a helper's time. I implore you to continue with either jeffce or myself.
jeffce has been notified as well.

[daveyden]

One reason is that I got pointed to that side via this one, and, having posted the same query on both sites, not only did I not want to let you or jeff down after you were both good enough to engage with me in my plight, but I have the same problem on both of my laptops, ( Vista and  Windows8.1), and I didn't want to confuse matters. (I cannot use them at the same time as they are n different places.) I apologise if this is not protocol, but I assure you both that there was no underhand reason for doing this, it's just a novices mistake and I hope that you will be willing to work with me. If you think it best, and are prepared to do it, I am happy for either of you to help me with both laptop's. Thank you for your understanding, I will say the same to jeff...Regards, Dave