Browsers hijacked again! fatal to Chrome

Viruses and worms
1

We just went through this a short while ago. thanks for the great help then. But, here I am again. I run Avast free - would paid version work better for me? I was running Malwarebytes but it expired and I couldn’t seem to get the free version - kept asking for license key. should I buy that? I also run Spybot at startup.

anyway, here are all the logs you asked for last time:

(Am I missing a log file?)

2

PS: I had done a system restore prior to running the programs you suggest, adwcleaner et al

3

Hi what sort of problems are you experiencing ? As I cannot see Chrome on the computer

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
SRV:64bit: - [2013/05/16 11:11:14 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe -- (Updater By SweetPacks)
IE - HKU\S-1-5-21-3482580495-2383476838-1609486079-1000\..\SearchScopes\{6003853C-82BD-404B-AEDE-C1AE2072E8A5}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3279453&CUI=UN21563897091049893&UM=2
IE - HKU\S-1-5-21-3482580495-2383476838-1609486079-1000\..\SearchScopes\{AC527A54-3439-4C23-B59A-CE772D09CC79}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=78ADC3A3-9113-4060-884C-7947E23CE29D&apn_sauid=A2D489CB-E7CC-46F1-BC49-D8D7EFBAEDE9
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX [2013/06/19 21:20:58 | 000,000,000 | ---D | M]
[2013/06/24 20:18:40 | 000,000,000 | ---D | M] (GetSavin) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\getsavin@jetpack
[2013/03/06 08:45:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\extension21804@extension21804.com\chrome
[2013/03/06 08:45:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\extension21804@extension21804.com\defaults
[2013/03/06 08:45:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\extension21804@extension21804.com\locale
[2013/03/06 08:45:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\extension21804@extension21804.com\skin
[2013/03/06 08:45:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\extension21804@extension21804.com\chrome\content\extensionCode
[2013/04/26 19:29:15 | 000,120,870 | ---- | M] () (No name found) -- C:\Users\Bill\AppData\Roaming\Mozilla\Firefox\Profiles\9xdn5nan.default\extensions\searchy@searchy.xpi
[2013/06/19 21:20:58 | 000,000,000 | ---D | M] (Updater By SweetPacks) -- C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX
[2013/06/19 21:20:57 | 000,000,000 | ---D | C] -- C:\Program Files\Updater By SweetPacks
[2013/04/11 19:44:04 | 000,000,000 | ---D | M] -- C:\Users\Bill\AppData\Roaming\Strongvault


:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

4
I was running Malwarebytes but it expired and I couldn't seem to get the free version - kept asking for license key.
there should be a "end trail version" button or something like that... anyway i would recomend buying the pro version, it is a one time fee for a lifetime license then you get autoupdate and a protection module
5

Chrome was there but screwed-up, failed to start up (error message re missing some files). Just before your post I used revo uninstaller, advanced uninstall option (regular windows uninstaller didn’t work). It cleaned it out. I have reinstalled chrome and it seems fine now.

Will run OTL as instructed now.

6

ran OTL again with new script. Log attached

7

How is it behaving now ?

8

Looks good! Just ordered Malwarebytes Pro.

Going to start new topic on Java - the source of my issues - maybe?

9

Probably a bundled add on with a programme you downloaded