Hi welcome to daniweb;
For heavens sake leave the reg cleaners alone. You can do more damage to the system.
Follow THESE instructions;
If you are able, RUN ATF-Cleaner.exe.
-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK
If you use Firefox browser, do this also:
* Click Firefox at the top and choose Select All from the list.
* Click the Empty Selected button.
* NOTE : If you would like to keep your saved passwords, click No at the prompt.
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.
* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Reboot the computer.
Right Click the desktop and choose New, Folder. Name this folder HiJackThis.
Next download HiJackThis and save it to that new folder.
Once it is in that folder then run a FULL System scan with it. Save the log.
Post back here with the MBA-M log and the HJT log.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
You did one of the three steps required. You now need to do the other two.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
That's fine we don't need a log from ATF as long as you ran it.
You now need to go into Start, Control Panel, Add/Remove and look for anything with these names;
FunWebProducts
My Web Search
My Way Speedbar
Search Assistant - My Way
Smiley Central
Also look for Cyberdefender and My Identity Defender
Any of the above, Uninstall them.
Next, open My Computer, Drive C, and double-click on the Program Files folder
Right-click and delete the folders for:
FunWebProducts
MyWebSearch
Cyberdefender
My Identity Defender
Then go to Start, Search and look for items of the same name on the computer. Delete any found.
Reboot the computer.
Run a new HJT scan and post back here with that new log and also the result of your uninstall search.
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Please follow all of Judy's instructions. We are here to help, but a little dialogue from you would be nice :).
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Please follow all of Judy's instructions. We are here to help, but a little dialogue from you would be nice :).
Thanks crunchie! It WOULD be nice to know if Uninstalls indicated were attempted and what was found.
You need to TURN OFF the following programs and LEAVE THEM TURNED OFF.
NapsterShell (you don't need to be downloading anything until this computer is clean, otherwise this defeats the purpose of trying to clean)
Windows Defender
iPodService.exe
Roxio Shared
iTunesHelper
RegistryCleanerProMFCT
InterVideo WinCinema Manager
LiveShare P2P Server
SoundMovieServer
P2P is very likely how you got infected to begin with. We do not condone this or recommend this. Please refrain from file sharing or we cannot help you.
Once you have turned off all those programs then reboot the computer.
Update MBA-M and once you have done that, with ALL UNNECESSARY programs CLOSED, including browsers, please run another Full System scan with MBA-M and allow it to remove everything found.
Reboot and run a new HJT scan and post both logs.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Your log shows you took no action. Is that the case, or did you post the wrong log?
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
