Need help found some stuff on this computer

Viruses and worms
1

HI everyone how is it going today. One of the family members of this computer was a little shocked that the homepage had changed on this computer. Everyone on this computer uses Internet Explorer 10. The other thing I have noticed lately is that this computer is slow to startup it sometimes takes it five minutes or so to go from the splash screen to the desktop. So I updated the free version of malwarebytes free and I did a quick scan on October 3, 2013. Malwarebytes did find lots of stuff including something I have never heard of it was called Search protect. I also downloaded Adwcleaner and the folder search protect is still their I also found some other stuff in the adwcleaner log I am going to post that to. I should mention that I did do another quick scan after updating malwarebytes free and their was nothing found so I did not save the log. I should also tell you that when starting Internet Explorer 10 on this computer some times it takes a few minutes to launch and then for a homepage to come up. Sometimes though when some one will push on internet Explorer shortcut on the desktop the browser window will come up without any content at all and then if you exit and then go back in to internet Explorer then the homepage will appear out of no where. What can cause this sort of thing to happen. The people that use this computer get mad or frusterated that this is happening some of the time.

Any help would be appreciated

Thanks.
here is some info that might be helpful:
Windows 7 home Premium
Service Pack 1

2

Where there was something found by Malwarebytes Quick scan you should also run a Full scan.

Can you attach the logs from Malwarebytes? That would be helpful. :smiley:

3

Someone has been downloading programmes and just clicking through rather than custom installing and refusing the toolbars

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
IE - HKLM\..\URLSearchHook: {da7a20cf-bef4-4342-ad78-0240fdf87055} - C:\Program Files\WiseConvert_B2\prxtbWise.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3820247636-946552630-513738638-1000\..\URLSearchHook: {08f9937e-0a4f-48cf-94e7-827223daec1d} - SOFTWARE\Classes\CLSID\{08f9937e-0a4f-48cf-94e7-827223daec1d}\InprocServer32 File not found
IE - HKU\S-1-5-21-3820247636-946552630-513738638-1000\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No CLSID value found
IE - HKU\S-1-5-21-3820247636-946552630-513738638-1000\..\URLSearchHook: {da7a20cf-bef4-4342-ad78-0240fdf87055} - C:\Program Files\WiseConvert_B2\prxtbWise.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3820247636-946552630-513738638-1000\..\SearchScopes,DefaultScope = {6B4DF73A-2E56-4E4A-9645-27C324C1CC07}
IE - HKU\S-1-5-21-3820247636-946552630-513738638-1000\..\SearchScopes\{41163266-319F-468B-8E92-24D5A1DB885D}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297951&CUI=UN32503107121219914&UM=2
FF - prefs.js..browser.startup.homepage: "http://mystart.incredimail.com/?a=IAWMfVuZ5g"
[2009/12/18 14:36:09 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.78\oberontb.dll File not found
O2 - BHO: (WiseConvert B2 Toolbar) - {da7a20cf-bef4-4342-ad78-0240fdf87055} - C:\Program Files\WiseConvert_B2\prxtbWise.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (WiseConvert B2 Toolbar) - {da7a20cf-bef4-4342-ad78-0240fdf87055} - C:\Program Files\WiseConvert_B2\prxtbWise.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3820247636-946552630-513738638-1000\..\Toolbar\WebBrowser: (WiseConvert B2 Toolbar) - {DA7A20CF-BEF4-4342-AD78-0240FDF87055} - C:\Program Files\WiseConvert_B2\prxtbWise.dll (Conduit Ltd.)
[2013/09/29 10:42:41 | 000,000,000 | ---D | C] -- C:\Users\Gary\AppData\Roaming\SearchProtect
[2013/09/29 10:42:40 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2013/09/29 10:42:38 | 000,000,000 | ---D | C] -- C:\Program Files\WiseConvert_B2
[2013/09/29 10:42:38 | 000,000,000 | ---D | C] -- C:\Users\Gary\AppData\Local\Conduit
[2013/09/29 10:42:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Conduit

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

4

hI Essexboy here is the otl quick scan log below.

Thanks very much

5

That looks better, now I will not tell you who it was but… [2013/09/29 10:42:41 ] was when it got onto the system :slight_smile:

Any further problems ?

6

HI Essexboy I have not tried it since then I will let you now if their are any more problems. We will talk to you later Essexboy thanks very much for your time and help.

7

My pleasure :slight_smile: