CAUTION : This fix is only valid for this specific machine, using it on another may break your computer Open
notepad and copy/paste the text in the quotebox below into it:
HKLM-x32\...\Run: [wscript.exe] => wscript.exe //B C:\Windows\win.vbs
FF HKLM-x32\...\Firefox\Extensions: [SpecialSavings@SpecialSavings.com] - C:\Users\Gandhi\AppData\Roaming\Mozilla\Extensions\SpecialSavings@SpecialSavings.com
FF Extension: SpecialSavings - C:\Users\Gandhi\AppData\Roaming\Mozilla\Extensions\SpecialSavings@SpecialSavings.com [2013-04-29]
CHR HKLM-x32\...\Chrome\Extension: [bfcpnihmbfoaeoakalclfalkdepgiaje] - C:\Users\Gandhi\AppData\Roaming\SpecialSavings\SpecialSavings.crx [2013-02-26]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2014-10-13 14:40 - 2014-06-28 12:40 - 00000547 _____ () C:\Windows\win.vbs
2014-10-13 14:40 - 2014-02-16 13:01 - 00490496 _____ (cURL, http://curl.haxx.se/) C:\Windows\curl.exe
2014-10-13 14:40 - 2010-03-15 11:26 - 00246272 _____ () C:\Windows\unrar.exe
2014-10-18 00:07 - 2013-12-22 22:24 - 00000000 ____D () C:\ProgramData\Conduit
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as
fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
THENPlease download
AdwCleaner by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
NEXTDownload
MCShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick
unhide items on flash drivesPlug in the drive and McShield will start a scan
Then get the log which will be located under the logs tab on the main page
And post that