I keep getting popup warnings from Avast about “harmful webpage or file.” I followed the instructions in the topic about attaching logs, but Farbar Recovery Scan Tool always hangs at “Getting Office Sessions Errors: 1183.” I cleared the Addition.txt check box, and then Farbar ran for a short time and produced a log. I’ve attached that log, for what it’s worth, along with the others.
Thanks for any help you can give me!
Note: My problem sounds very similar to the one posted by hobbit1969.
Let me know how the computer is behaving after this
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint: HKLM\...\Run: [ShopAtHomeWatcher] => C:\Users\Sherry\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe HKLM\...\Run: [ShopAtHomeUpdater] => C:\Users\Sherry\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe HKU\S-1-5-21-3178491884-2083923246-136613409-1002\...\Run: [Gjuhqrs] => regsvr32.exe /s "C:\Users\Sherry\AppData\Local\Temp\26c4\AppData\Local\Microsoft\Gjuhqrs.dll" <===== ATTENTION HKU\S-1-5-21-3178491884-2083923246-136613409-1002\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks! HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: No Name -> {66516A07-F617-488A-90CF-4E690CFB3C5F} -> No File Toolbar: HKLM - No Name - {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} - No File Toolbar: HKLM - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} - No File Toolbar: HKU\.DEFAULT -> No Name - {0123B506-0AD9-43AA-B0CF-916C122AD4C5} - No File Toolbar: HKU\.DEFAULT -> No Name - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File Toolbar: HKU\.DEFAULT -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKU\.DEFAULT -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File Toolbar: HKU\.DEFAULT -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {0123B506-0AD9-43AA-B0CF-916C122AD4C5} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2} - No File Toolbar: HKU\S-1-5-21-3178491884-2083923246-136613409-1002 -> No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} - No File FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009-04-03] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009-08-20] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2009-10-20] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2009-11-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-05-03] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-08-12] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-10-12] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-01-12] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-03-12] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} [2011-05-11] CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_47_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0E0E0CyDyBtDzz0FyDzyyBzytAtN0D0Tzu0StCtDyDtAtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StD0A0CtCyC0EtB0AtGyC0F0DtCtG0EyD0CyDtG0Dzz0EtCtGyBtD0DzytB0AtD0FtDyE0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyB0E0C0F0EyCtG0CyByD0BtGyE0A0B0DtG0AtDyEyCtGtBtAyCyB0FtD0AyE0BtC0AyE2Q&cr=796308637&ir= CHR StartupUrls: Default -> "hxxp://Vosteran.com/?f=7&a=vst_ggfc_14_47_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0E0E0CyDyBtDzz0FyDzyyBzytAtN0D0Tzu0StCtDyDtAtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StD0A0CtCyC0EtB0AtGyC0F0DtCtG0EyD0CyDtG0Dzz0EtCtGyBtD0DzytB0AtD0FtDyE0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyB0E0C0F0EyCtG0CyByD0BtGyE0A0B0DtG0AtDyEyCtGtBtAyCyB0FtD0AyE0BtC0AyE2Q&cr=796308637&ir=", "hxxp://www.google.com/" CHR DefaultSearchKeyword: Default -> vosteran.com CHR DefaultSearchURL: Default -> http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggfc_14_47_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0E0E0CyDyBtDzz0FyDzyyBzytAtN0D0Tzu0StCtDyDtAtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StD0A0CtCyC0EtB0AtGyC0F0DtCtG0EyD0CyDtG0Dzz0EtCtGyBtD0DzytB0AtD0FtDyE0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyB0E0C0F0EyCtG0CyByD0BtGyE0A0B0DtG0AtDyEyCtGtBtAyCyB0FtD0AyE0BtC0AyE2Q&cr=796308637&ir= S3 499; C:\Windows\System32\DRIVERS\499 [9072 2012-12-04] () 2015-01-05 19:24 - 2013-12-08 11:14 - 00000406 _____ () C:\Windows\Tasks\BeFrugal.com Toolbar.job C:\Users\Sherry\AppData\Local\dsisetup1821150522.exe C:\Users\Sherry\AppData\Local\Temp\26c4\AppData\Local\Microsoft\Gjuhqrs.dll EmptyTemp: CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.