Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

idp.alexa.51 detected by avg? Please help.


  • Please log in to reply
37 replies to this topic

#1 lilbonkers290

lilbonkers290

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 05 February 2016 - 11:23 PM

Last week, An AVG popup - identity protection; Something called IDP.Alexa.51 popped up while I was using a messenger app (Kakao) which I had no problems using it before on my PC. Before that I clicked on an instagram link in the chats I was in? I'm not sure if that is what trigger the popup to come up.

I did uninstall Kakao and try to reinstall on the C drive but it wouldn't let me, so I installed on my desktop instead.

I don't know if this is a false positive by AVG

I am using Windows 8.1

 

I have done scans with malwarebytes, avg and kaspersky; nothing is showing with the alexa?

I do have logs from a long time ago with mbam that have opencandy.pup which I can show if requested?

 

Minor Issues to date as of now;

- When I reboot my laptop, it takes a while like 2-3 minutes to start up

- When I click mozilla firefox shortcut on my desktop, it has an error that says application wrong pathway or something like that, I try clicking on it again and works

- When I tried to save an mbam file, all of my C drive folders show up but I have the hidden folders option turned off? When just go to the This PC > C: drive the folders aren't showing the hidden ones

- I have moved my files to external hard drive, 2-3 days ago and while I was moving some of my files the drive closed by itself and I had to click on it again?

- My laptop did freeze so had to force restart with the power button;

 

Is it normal to have 16 svchosts.exe processes running?

 

That is all I can think of as right now; Thank you!


Edited by lilbonkers290, 06 February 2016 - 12:03 AM.


BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:55 AM

Posted 06 February 2016 - 09:04 AM

Welcome to BC...

It is not unusual to have that many svchosts processes running.

 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

Download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 03:14 PM

Hello!

Here is the ADW Log 

 

# AdwCleaner v5.032 - Logfile created 06/02/2016 at 12:41:55
# Updated 31/01/2016 by Xplode
# Database : 2016-02-05.1 [Server]
# Operating system : Windows 8.1  (x64)
# Username : j - JJ
# Running from : C:\Users\j\Desktop\AdwCleaner.exe
# Option : Cleaning
 
***** [ Services ] *****
 
[-] Service Deleted : vToolbarUpdater19.2.0
 
***** [ Folders ] *****
 
[-] Folder Deleted : C:\Program Files\AVG SafeGuard toolbar
[-] Folder Deleted : C:\Program Files (x86)\AVG SafeGuard toolbar
[-] Folder Deleted : C:\Program Files (x86)\AVG Security Toolbar
[-] Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
[-] Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility
[-] Folder Deleted : C:\ProgramData\AVG SafeGuard toolbar
[-] Folder Deleted : C:\ProgramData\AVG Secure Search
[-] Folder Deleted : C:\ProgramData\AVG Security Toolbar
[-] Folder Deleted : C:\Users\j\AppData\Local\AVG SafeGuard toolbar
[-] Folder Deleted : C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
[-] Folder Deleted : C:\Users\j\AppData\LocalLow\AVG SafeGuard toolbar
 
***** [ Files ] *****
 
[-] File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
[-] File Deleted : C:\Users\j\AppData\Roaming\Mozilla\Firefox\Profiles\bm5h063n.default\searchplugins\avg-secure-search.xml
[-] File Deleted : C:\Users\j\AppData\Roaming\Mozilla\Firefox\Profiles\bm5h063n.default\user.js
[-] File Deleted : C:\Users\Public\Desktop\eBay.lnk
 
***** [ DLLs ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
[-] Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\handler\viprotocol
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKCU\Software\AVG Security Toolbar
[-] Key Deleted : HKCU\Software\Conduit
[-] Key Deleted : HKLM\SOFTWARE\AVG Security Toolbar
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
[!] Key Not Deleted : HKU\S-1-5-21-198127752-3230977668-144626966-1001\Software\AVG Security Toolbar
[!] Key Not Deleted : HKU\S-1-5-21-198127752-3230977668-144626966-1001\Software\Conduit
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKU\S-1-5-21-198127752-3230977668-144626966-1001\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[!] Key Not Deleted : HKU\S-1-5-21-198127752-3230977668-144626966-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Data Restored : HKU\S-1-5-21-198127752-3230977668-144626966-1001\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
 
***** [ Web browsers ] *****
 
[-] [C:\Users\j\AppData\Roaming\Mozilla\Firefox\Profiles\bm5h063n.default\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");
[-] [C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
[-] [C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : ndibdjnfmopecpmkdieinmbadjfpblof
 
*************************
 
:: "Tracing" keys removed
:: Winsock settings cleared
 
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [9267 bytes] ##########


#4 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:55 AM

Posted 06 February 2016 - 03:26 PM

After posting the JRT scan result and the Eset Online scan results, please do this:

 

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.


Edited by buddy215, 06 February 2016 - 03:30 PM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#5 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 03:29 PM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.2 (01.06.2016)
Operating System: Windows 8.1 x64 
Ran by j (Administrator) on 2016-02-06 at 13:22:20.48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 9 
 
Successfully deleted: C:\ProgramData\Avg_Update_0116av (Folder) 
Successfully deleted: C:\ProgramData\Avg_Update_1015av (Folder) 
Successfully deleted: C:\ProgramData\Avg_Update_1215av (Folder) 
Successfully deleted: C:\Users\j\AppData\Local\crashrpt (Folder) 
Successfully deleted: C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio (Folder) 
Successfully deleted: C:\Users\j\AppData\Local\kakao (Folder) 
Successfully deleted: C:\Users\j\Appdata\LocalLow\thunder network (Folder) 
Successfully deleted: C:\Users\j\AppData\Roaming\Mozilla\Firefox\Profiles\bm5h063n.default\searchplugins\youtube-video-search.xml (File) 
Successfully deleted: C:\Users\Public\thunder network (Folder) 
 
 
 
Registry: 5 
 
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{7F19CFB4-F111-44A0-90E9-FE42270544C3} (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{7F19CFB4-F111-44A0-90E9-FE42270544C3} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} (Registry Value) 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 2016-02-06 at 13:28:30.67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


#6 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 06:44 PM

ESET Log
 
C:\Users\j\AppData\LocalLow\Sun\Java\jre1.8.0_45\java_sp.dll a variant of Win32/Bundled.Toolbar.Ask.M potentially unsafe application cleaned by deleting
C:\Users\j\AppData\Roaming\BitTorrent\updates\7.8.2_30265.exe a variant of Win32/AdkDLLWrapper.A potentially unwanted application cleaned by deleting
 


#7 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 06:51 PM

CCleaner Windows Startup
 
Yes HKCU:Run AIM for Windows AOL Inc. "C:\Users\j\AppData\Local\AOL\AIM\aim.exe"
Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
Yes HKCU:Run KakaoTalk Kakao Corp. "C:\Users\j\Desktop\KakaoTalk\KakaoTalk.exe" -bystartup
No HKCU:Run Power2GoExpress8 CyberLink Corp. "C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe"
Yes HKLM:Run AVG_UI AVG Technologies CZ, s.r.o. "C:\Program Files (x86)\AVG\Av\avuirunnerx.exe" C:\Program Files (x86)\AVG\Av\avgui.exe
Yes HKLM:Run AvgUi AVG Technologies CZ, s.r.o. "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw
Yes HKLM:Run BtTray IVT Corporation "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
Yes HKLM:Run GrooveMonitor Microsoft Corporation "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
Yes HKLM:Run HP Software Update Hewlett-Packard C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
Yes HKLM:Run HPMessageService Hewlett-Packard Development Company, L.P. C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
Yes HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
Yes HKLM:Run RemoteControl10 CyberLink Corp. "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
Yes HKLM:Run RTHDVCPL Realtek Semiconductor C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
Yes HKLM:Run StartCCC Advanced Micro Devices, Inc. "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
No HKLM:Run SunJavaUpdateSched Oracle Corporation "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
Yes Startup Common AdFender.lnk AdFender, Inc. C:\Program Files (x86)\AdFender\AdFender.exe
Yes Startup Common HP Digital Imaging Monitor.lnk Hewlett-Packard Co. C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
 
Scheduled Tasks
 
Yes Task Adobe Acrobat Update Task Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Yes Task Adobe Flash Player Updater Adobe Systems Incorporated C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Yes Task HPCeeScheduleForj Hewlett-Packard C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForj (null)
Yes Task Java Update Scheduler Oracle Corporation C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
No Task Optimize Start Menu Cache Files-S-1-5-21-198127752-3230977668-144626966-1001
Yes Task Optimize Start Menu Cache Files-S-1-5-21-198127752-3230977668-144626966-500
Yes Task Synaptics TouchPad Enhancements Synaptics Incorporated "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
Yes Task {C347E92B-F184-4569-B91F-F75D01A65494} Microsoft Corporation C:\Windows\system32\pcalua.exe -a F:\Setup.exe -d F:\
Yes Task {D8D132FF-AD7C-4B69-9EA7-66D9ED78BB9A} Microsoft Corporation C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Thunder Network\Thunder\ThunderUninstall.exe"
 
 
Program Installed
7-Zip 9.20 (x64 edition) Igor Pavlov 2013-03-22 4.53 MB 9.20.00.0
AdFender AdFender, Inc. 2014-10-27 1.82
Adobe Acrobat Reader DC Adobe Systems Incorporated 2016-01-13 194 MB 15.010.20056
Adobe Flash Player 20 NPAPI Adobe Systems Incorporated 2016-01-19 4.29 MB 20.0.0.286
Adobe Shockwave Player 12.1 Adobe Systems, Inc. 2014-10-27 12.1.0.150
AIM for Windows AOL Inc. 2014-10-27
AMD Catalyst Install Manager Advanced Micro Devices, Inc. 2013-07-24 26.3 MB 8.0.911.0
Apple Application Support (32-bit) Apple Inc. 2015-12-12 114 MB 4.1.1
Apple Application Support (64-bit) Apple Inc. 2015-12-12 128 MB 4.1.1
Apple Mobile Device Support Apple Inc. 2015-12-04 28.0 MB 9.1.0.6
Apple Software Update Apple Inc. 2015-12-04 2.40 MB 2.1.4.131
AVG Protection AVG Technologies 2016-01-22 2016.31.7357
AVG SafeGuard toolbar AVG Technologies 2016-01-25 19.2.0.326
Bing News Microsoft Corporation 2014-10-27 3.0.2.309
Bing Travel Microsoft Corporation 2014-10-27 3.0.2.309
BitTorrent BitTorrent Inc. 2016-01-31 7.9.5.41373
Bonjour Apple Inc. 2015-12-04 2.01 MB 3.1.0.1
Box Box, Inc. 2014-10-27 1.6.3.1920
Catalyst Control Center 2015-09-25 1.00.0000
CCleaner Piriform 2016-01-31 5.14
CyberLink LabelPrint CyberLink Corp. 2013-11-04 280 MB 2.5.4.6515
CyberLink Media Suite 10 CyberLink Corp. 2014-12-02 61.0 MB 10.0.6.3728
Cyberlink PhotoDirector CyberLink Corp. 2014-12-02 222 MB 3.0.4.4824
CyberLink Power2Go 8 CyberLink Corp. 2014-05-04 408 MB 8.0.6.3821
CyberLink PowerDirector 10 CyberLink Corp. 2013-07-24 1.34 GB 10.0.3.2606
CyberLink PowerDVD CyberLink Corp. 2013-11-04 248 MB 10.0.8.5511
CyberLink YouCam CyberLink Corp. 2013-07-24 221 MB 3.5.6.6117
Energy Star Hewlett-Packard Company 2013-07-24 5.56 MB 1.0.9
ESET Online Scanner v3 2016-02-06
Games Microsoft Corporation 2014-10-27 2.0.139.0
Garry's Mod Facepunch Studios 2015-06-15
Getting Started with Windows 8 Hewlett-Packard Company 2014-10-27 1.4.1.1
Google Chrome Google Inc. 2015-02-09 48.0.2564.103
HP 3D DriveGuard Hewlett-Packard Company 2013-07-24 7.01 MB 4.2.9.1
HP Connected Music (Meridian - installer) Meridian Audio Ltd 2014-10-27 605 KB 1.0
HP Connected Music (Meridian - player) Meridian Audio Ltd 2014-10-27 102 MB 1.1 (build 59) hp
HP Connected Photo powered by Snapfish Hewlett-Packard Company 2014-10-27 2.1.107.2597
HP CoolSense Hewlett-Packard Company 2014-06-17 148 MB 2.20.31
HP Customer Participation Program 14.0 HP 2015-10-27 14.0
HP Deskjet F4400 Printer Driver Software 14.0 Rel. 5 HP 2015-10-27 14.0
HP Documentation Hewlett-Packard 2013-07-24 219 MB 1.2.0.0
HP Imaging Device Functions 14.0 HP 2014-10-27 14.0
HP MyRoom Hewlett-Packard Company 2013-07-24 104 KB 9.0.0.0
HP Photo Creations HP Photo Creations Powered by RocketLife 2014-10-27 14.6 MB 1.0.0.2024
HP Printer Control Hewlett-Packard Company 2014-10-27 35.0.97.0
HP Quick Start Hewlett-Packard 2013-07-24 1.67 MB 1.0.4660.30220
HP Registration Hewlett-Packard Company 2014-10-27 1.2.1.141
HP Registration Service Hewlett-Packard 2013-07-24 29.5 MB 1.2.6317.4309
HP Solution Center 14.0 HP 2015-10-27 14.0
HP Support Assistant Hewlett-Packard Company 2015-10-24 23.7 MB 8.1.40.3
HP Support Solutions Framework Hewlett-Packard Company 2015-10-24 5.48 MB 12.0.30.219
HP System Event Utility Hewlett-Packard Company 2014-12-02 6.79 MB 1.1.4
HP Update Hewlett-Packard 2014-08-06 3.99 MB 5.005.002.002
HP Utility Center Hewlett-Packard Company 2013-07-24 4.47 MB 2.1.5
HP Wireless Button Driver Hewlett-Packard Company 2014-01-14 733 KB 1.1.2.1
HP+ Hewlett-Packard Company 2014-10-27 1.2.0.93
Intel® Management Engine Components Intel Corporation 2014-11-03 9.5.13.1706
Intel® Processor Graphics Intel Corporation 2015-09-25 10.18.10.4276
Intel® Rapid Storage Technology Intel Corporation 2014-11-03 12.8.1.1000
Intel® SDK for OpenCL - CPU Only Runtime Package Intel Corporation 2013-07-24 3.0.0.63463
iTunes Apple Inc. 2015-12-12 215 MB 12.3.2.35
Java 8 Update 71 Oracle Corporation 2016-01-31 88.6 MB 8.0.710.15
KakaoTalk Kakao Corp. 2016-01-31 2.1.0.1072
Kaspersky Anti-Virus Kaspersky Lab 2016-02-01 16.0.0.614
League of Legends Riot Games 2014-10-27 3.0.0
Left 4 Dead 2 Valve 2014-10-27
LINE LINE Corporation 2016-01-29 1.0.14.107
Mail, Calendar and People 2015-10-09
Malwarebytes Anti-Malware version 2.2.0.1024 Malwarebytes 2015-10-13 66.1 MB 2.2.0.1024
Maps Microsoft Corporation 2014-12-03 2.1.3230.2048
Microsoft Mahjong Microsoft Studios 2014-10-27 1.8.0.40211
Microsoft Office Enterprise 2007 Microsoft Corporation 2016-01-28 12.0.6612.1000
Microsoft Office File Validation Add-In Microsoft Corporation 2014-05-15 10.9 MB 14.0.5130.5003
Microsoft Silverlight Microsoft Corporation 2016-01-28 249 MB 5.1.41212.0
Microsoft SkyDrive Microsoft Corporation 2014-10-27 25.1 MB 16.4.6013.0910
Microsoft Solitaire Collection Microsoft Studios 2014-10-27 1.8.0.31029
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 2013-03-22 1.92 MB 3.1.0000
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2013-07-24 4.84 MB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 2013-08-31 6.88 MB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 Microsoft Corporation 2013-07-24 8.14 MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 2013-07-24 13.1 MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 2014-03-09 13.2 MB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 2013-07-24 8.12 MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 2013-07-24 8.76 MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2013-07-24 8.69 MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 2014-03-09 10.1 MB 9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 Microsoft Corporation 2014-11-03 13.8 MB 10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 Microsoft Corporation 2014-11-03 11.1 MB 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 Microsoft Corporation 2015-09-25 20.4 MB 11.0.50727.1
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 Microsoft Corporation 2015-09-25 17.3 MB 11.0.50727.1
Mozilla Firefox 44.0 (x86 en-US) Mozilla 2016-01-28 87.9 MB 44.0
Mozilla Maintenance Service Mozilla 2016-01-28 341 KB 44.0.0.5866
MSN Weather Microsoft Corporation 2014-12-03 3.0.4.249
Music Microsoft Corporation 2014-10-27 2.2.903.0
NARUTO SHIPPUDEN: Ultimate Ninja STORM 3 Full Burst CyberConnect 2 2015-12-22
OneNote Microsoft Corporation 2014-10-27 16.0.2731.1018
OpenAL 2015-12-22
Ralink Bluetooth Stack Mediatek 2014-01-14 81.3 MB 11.0.748.2
Ralink RT3290 802.11bgn Wi-Fi Adapter Mediatek 2013-12-30 5.0.33.1
Reader Microsoft Corporation 2014-10-27 6.3.9654.17044
Realtek Ethernet Controller Driver Realtek 2014-11-03 8.20.815.2013
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 2014-10-27 6.0.1.6870
Realtek PCIE Card Reader Realtek Semiconductor Corp. 2013-07-24 1.1.9200.007
Scribblenauts Unlimited 5th Cell Media 2014-10-27
Scribblenauts Unmasked 5th Cell Media 2014-10-27
Shop for HP Supplies HP 2015-10-27 14.0
Skype™ 7.17 Skype Technologies S.A. 2015-12-18 79.2 MB 7.17.105
South Park™: The Stick of Truth™ Obsidian Entertainment 2015-09-08
Stealth Inc 2 Carbon 2015-12-22
Steam Valve Corporation 2014-10-27
Surgeon Simulator Bossa Studios 2014-10-27
Synaptics Pointing Device Driver Synaptics Incorporated 2014-12-02 46.4 MB 17.0.6.2
The Walking Dead 2015-05-21
Update for Korean Microsoft IME Standard Dictionary Microsoft Corporation 2015-03-24 2.43 MB 16.0.662.1
Video Microsoft Corporation 2014-10-27 2.2.902.0
Visual Studio 2010 x64 Redistributables AVG Technologies 2013-08-31 12.4 MB 13.0.0.1
Visual Studio 2012 x64 Redistributables AVG Technologies 2013-09-28 12.9 MB 14.0.0.1
Visual Studio 2012 x86 Redistributables AVG Technologies CZ, s.r.o. 2013-09-28 10.5 MB 14.0.0.1
VLC media player VideoLAN 2015-05-18 2.2.1
Windows Help+Tips Microsoft Corporation 2014-10-27 6.3.9654.20453
Windows Live Essentials Microsoft Corporation 2013-03-22 16.4.3505.0912
Windows Scan Microsoft Corporation 2014-10-27 6.3.9600.16422
Windows Sound Recorder Microsoft Corporation 2014-10-27 6.3.9600.20280
YouCam for HP CYBERLINKCOM CORP 2014-10-27 1.0.2.29632
 
 
 
 


#8 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:55 AM

Posted 06 February 2016 - 07:15 PM

Disable these Windows Startups: Use CCleaner by clicking on each item and then choose Disable on the right.

Yes HKCU:Run AIM for Windows AOL Inc. "C:\Users\j\AppData\Local\AOL\AIM\aim.exe"
Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
Yes HKCU:Run KakaoTalk Kakao Corp. "C:\Users\j\Desktop\KakaoTalk\KakaoTalk.exe" -bystartup
Yes HKLM:Run GrooveMonitor Microsoft Corporation "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
Yes HKLM:Run HP Software Update Hewlett-Packard C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
Yes HKLM:Run HPMessageService Hewlett-Packard Development Company, L.P. C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
Yes HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
 
Disable these Scheduled Tasks:
Yes Task Adobe Acrobat Update Task Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Yes Task HPCeeScheduleForj Hewlett-Packard C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForj (null)
Yes Task Java Update Scheduler Oracle Corporation C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Yes Task Optimize Start Menu Cache Files-S-1-5-21-198127752-3230977668-144626966-500
Yes Task {C347E92B-F184-4569-B91F-F75D01A65494} Microsoft Corporation C:\Windows\system32\pcalua.exe -a F:\Setup.exe -d F:\
Yes Task {D8D132FF-AD7C-4B69-9EA7-66D9ED78BB9A} Microsoft Corporation C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Thunder Network\Thunder\ThunderUninstall.exe"

 

Uninstall These Programs:

AVG SafeGuard toolbar AVG Technologies 2016-01-25 19.2.0.326 (It may attempt to reinstall during an upgrade or update...it is adware)

BitTorrent BitTorrent Inc. 2016-01-31 7.9.5.41373 (If you decide not to uninstall....it is VERY RISKY to download cracked software, free movies and music)

ESET Online Scanner v3 2016-02-06

KakaoTalk Kakao Corp. 2016-01-31 2.1.0.1072

Windows Live Essentials Microsoft Corporation 2013-03-22 16.4.3505.0912

 

Is the computer performing up to par? Any problems noted after completing the above and rebooting?


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#9 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 07:34 PM

Yes Task Optimize Start Menu Cache Files-S-1-5-21-198127752-3230977668-144626966-500

I cannot disable, CCleaner error message says: Failed to enable/disable startup item

No mapping between account names and security IDs was done

 

AVG SafeGuard toolbar AVG Technologies - Error 2  The system cannot find the file specified

 

Kaspersky has just detected Adware - not-a-virus:Adware.Win32.OpenCandy.bg

while I uninstalled the BitTorrent?

 

I want to attach an image to show you



#10 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 07:36 PM

If I uninstall the Windows  Live essentials, it will remove the photo gallery and Movie Maker?



#11 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:55 AM

Posted 06 February 2016 - 07:43 PM

One Optimize start menu was disabled....perhaps that is why

AVG SafeGuard was removed by the other scans...to be sure it is no longer in browsers check the Add-ons in each...extensions.

Rerun AdwCleaner and MBAM to find more OpenCandy if it exists after uninstalling BitTorrent

 

You can keep the Windows Live Essentials....rather than risk any component of it you may still use...but be aware it is no longer supported.

 

If you have Kaspersky actively running then you don't need AVG....one antivirus is enough and having two active may cause 

a conflict plus using extra resources.


Edited by buddy215, 06 February 2016 - 07:46 PM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#12 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 08:01 PM

adware%20error_zpszppox7wa.png


Edited by lilbonkers290, 06 February 2016 - 08:04 PM.


#13 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 08:06 PM

Should I delete those three from Kaspersky?



#14 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:55 AM

Posted 06 February 2016 - 08:41 PM

Yes...delete them or quarantine them if that option is offered. My search for that file says it is adware and likely open candy.

I see you have a trial version of Kaspersky. Personally, I would much prefer it over AVG.

I would disable AVG while using the trial version of Kaspersky.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#15 lilbonkers290

lilbonkers290
  • Topic Starter

  • Members
  • 137 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:05:55 AM

Posted 06 February 2016 - 08:46 PM

mbam%20old%20quarantine_zps0vcjenz6.gif

 

mbam%20old%20quarantine2_zpsndaoazgw.gif

 

And these as well? I just want check before deleting a crucial system file;






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users