Malware Removal Forums

"Luckysearches" hijacking browser and other adware

TheDoctor46 · 2015-03-30T18:06:45+00:00

I recently got caught installing some software in the process of attempting to download a legit application, basically a lot of the software that got installed was adware/malware. Problems included unwanted adverts in browser, fake notifications about PC problems inviting you to scan/try products etc. I have removed a lot of this stuff. My remaining problem that is visible to me at the moment is my browser (Opera) still loads up the page (luckysearches.com) upon startup. It is not set as the homepage, but appears each time I start it up. None of my other browsers (IE, firefox) exhibit this behaviour. I believe that the sweep I did with malwarebytes removed the entries for these browsers. I have the log from the removal I did with malwarebytes if you need it later to see what was removed. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 11.0.9600.17689 Run by [removed] at 18:27:46 on 2015-03-30 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.16331.12878 [GMT 1:00] . A

157 min read

mAL_rEm018

April 6, 2015, 7:41 AM UTC

Hello TheDoctor46,

I noticed that you did not re-enable Microsoft Security Essentials after the ESET scan. If you haven't already done so, please do the following:

Right-click on the Microsoft Security Essentials logo and select Open.
Open Settings and click Real Time Protection.
Ensure that the following box is checked:

Turn on real time protection
Select Save changes and exit Microsoft Security Essentials.

MSConfig should not be used to disable programs from running as a long term solution. Why did you disable MSI Live Update?

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Live Update => C:\Program Files (x86)\MSI\Live Update\Live Update.exe /REMINDER

"TheDoctor46" wrote:
Luckysearches still appears as the first page when I open Opera. Maybe it's this registry entry causing that. It's still in the registry. It was picked up by the FarBar scan done near the start of this thread.

Yes this entry is most likely the culprit, however we already tried to remove it. At this point, my advise would be to remove Opera completely and re-install it. In order to do this, please follow the steps below..

In the following steps we will reset your Opera browser, therefore I advise you to backup any bookmarks before you remove it:

How to backup and restore my Favorites or Bookmarks

Removing a program in Windows 7

Click the Star Menu and select Control Panel.
Click Programs, then Programs and Features.
Select the following programs:

Opera 12.14
Opera Stable 28.0.1750.48
Select Uninstall.
Make sure that delete my Opera user data is selected.
When prompted select Yes.
Answer any questions attentively.
When the process is finished, please restart your computer.

Note: you can only remove one program at a time.

Re-install Opera

Download and save to your desktop Opera from the following link Opera.
Right-click on Opera_NI_stable.exe and select Run as administrator.
Read the Terms of Service and if you agree select Accept and Install.

I need you to run the following fix..

Click Start
Type notepad.exe in the search programs and files box and click Enter.
A blank Notepad page should open.
- Copy/Paste the contents of the code box below into Notepad.



HKU\S-1-5-21-2940932314-315015785-212226153-1000\...\MountPoints2: {8095312a-039c-11e4-8021-d43d7e2bd256} - E:\RUS-Setup.exe

FF Extension: SharkManCoupon - C:\Users\Raymond\AppData\Roaming\Mozilla\Firefox\Profiles\yporo9y6.default\Extensions\_ldod_kbrcdtsauxcc@hvwvdh_uskydndcolx.org [2015-04-03]

S3 cpuz138; \??\C:\Windows\TEMP\cpuz138\cpuz138_x64.sys [X]

AlternateDataStreams: C:\Users\Public\DRM:احتضان

B:\$RECYCLE.BIN\S-1-5-21-2940932314-315015785-212226153-1000\$R5KS6QQ.exe

B:\Users\Raymond\Desktop\Games Related\Monitoring tools\coretemp_1236.exe

Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post me the log

Next..

Please download a fresh copy of AdwCleaner to you Desktop from here.
Close all your programs and right-click adwcleaner_4.200.exe and select Run as administrator.
Click on Scan.
After the scan is over, select Logfile.
A notepad window will open. Please copy/paste the contents in your next reply.
Note: do not select Cleaning at this point

I need you to run a search..

Please download System look to your desktop.
Right-click on SystemLook_x64.exe and select Run as administrator.

A window will open. Copy/paste the following inside the window:



:filefind

*Lucky Searches*

*Luckysearches*

*SharkManCoupon*



:folderfind

*Lucky Searches*

*Luckysearches*

*SharkManCoupon*



:regfind 

Lucky Searches

Luckysearches

SharkManCoupon

Select Look and the scan will start.
After the scan is finished a window will open. Please post the content in your next reply.

-----------------------------------------
In your next reply, I would like to see..

Did you have trouble performing any of the steps?
Answer to my question.
fixlog.txt
AdwCleaner Logfile.
System Look log.
Is Lucky Searches still affecting you opera browser?
Please post everything in the order given.

TheDoctor46

April 6, 2015, 11:45 AM UTC

I turned MS security essentials back on at the end of doing all the scans in my last reply.

MSI live update was probably disabled in msconfig because it was a nuisance or too insistent on pushing me to update non-essential services, or notifying me about updates I was aware of or had chosen not to install. I run it manually form time to time to check updates. Most of the updates it would recommend to me I manually install anyway via other means.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by [removed] at 2015-04-06 12:32:35 Run:3
Running from B:\Users\[removed]\Desktop\FRST
[removed]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-2940932314-315015785-212226153-1000\...\MountPoints2: {8095312a-039c-11e4-8021-d43d7e2bd256} - E:\RUS-Setup.exe
FF Extension: SharkManCoupon - C:\Users\Raymond\AppData\Roaming\Mozilla\Firefox\Profiles\yporo9y6.default\Extensions\_ldod_kbrcdtsauxcc@hvwvdh_uskydndcolx.org [2015-04-03]
S3 cpuz138; \??\C:\Windows\TEMP\cpuz138\cpuz138_x64.sys [X]
AlternateDataStreams: C:\Users\Public\DRM:احتضان
B:\$RECYCLE.BIN\S-1-5-21-2940932314-315015785-212226153-1000\$R5KS6QQ.exe
B:\Users\Raymond\Desktop\Games Related\Monitoring tools\coretemp_1236.exe

*****************

"HKU\S-1-5-21-2940932314-315015785-212226153-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8095312a-039c-11e4-8021-d43d7e2bd256}" => Key deleted successfully.
HKCR\CLSID\{8095312a-039c-11e4-8021-d43d7e2bd256} => Key not found.
C:\Users\Raymond\AppData\Roaming\Mozilla\Firefox\Profiles\yporo9y6.default\Extensions\_ldod_kbrcdtsauxcc@hvwvdh_uskydndcolx.org => Moved successfully.
cpuz138 => Service deleted successfully.
C:\Users\Public\DRM => ":احتضان" ADS removed successfully.
B:\$RECYCLE.BIN\S-1-5-21-2940932314-315015785-212226153-1000\$R5KS6QQ.exe => Error: No automatic fix found for this entry.
B:\Users\Raymond\Desktop\Games Related\Monitoring tools\coretemp_1236.exe => Error: No automatic fix found for this entry.

==== End of Fixlog 12:32:36 ====

# AdwCleaner v4.200 - Logfile created 06/04/2015 at 12:40:48
# Updated 29/03/2015 by Xplode
# Database : 2015-03-29.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Raymond - RMWD-Z77
# Running from : B:\Users\Raymond\Desktop\adwcleaner_4.200.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17689

-\\ Mozilla Firefox v37.0.1 (x86 en-US)

[yporo9y6.default] - Line Found : user_pref("extensions.crossrider.bic", "14c6b5e3fe149b736985c3757bc5cbd3");

-\\ Chromium v

*************************

AdwCleaner[R0].txt - [24092 bytes] - [30/03/2015 16:43:13]
AdwCleaner[R1].txt - [932 bytes] - [30/03/2015 16:45:50]
AdwCleaner[R2].txt - [876 bytes] - [06/04/2015 12:40:48]
AdwCleaner[S0].txt - [22977 bytes] - [30/03/2015 16:44:06]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [994 bytes] ##########

SystemLook 04.09.10 by jpshortstuff
Log created at 12:42 on 06/04/2015 by Raymond
Administrator - Elevation successful

========== filefind ==========

Searching for "*Lucky Searches*"
No files found.

Searching for "*Luckysearches*"
C:\Users\Raymond\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.luckysearches.com%2Ffavicon.png --a---- 636 bytes [15:06 30/03/2015] [15:06 30/03/2015] 64261493BB9C060F07AC4D119F2915AD
C:\Users\Raymond\AppData\Local\Opera\Opera\icons\www.luckysearches.com.idx --a---- 152 bytes [16:23 30/03/2015] [16:23 30/03/2015] D8B04FCD5CE3E4BA768A635628FC60C2

Searching for "*SharkManCoupon*"
No files found.

========== folderfind ==========

Searching for "*Lucky Searches*"
No folders found.

Searching for "*Luckysearches*"
No folders found.

Searching for "*SharkManCoupon*"
No folders found.

========== regfind ==========

Searching for "Lucky Searches"
No data found.

Searching for "Luckysearches"
No data found.

Searching for "SharkManCoupon"
No data found.

-= EOF =-

Luckysearches isn't appearing in Opera anymore.

mAL_rEm018

April 7, 2015, 5:02 AM UTC

Hello TheDoctor46,

"TheDoctor46" wrote:
Luckysearches isn't appearing in Opera anymore.

That's good news however we still have a little more work to do.

"TheDoctor46" wrote:
MSI live update was probably disabled in msconfig because it was a nuisance or too insistent on pushing me to update non-essential services, or notifying me about updates I was aware of or had chosen not to install. I run it manually form time to time to check updates. Most of the updates it would recommend to me I manually install anyway via other means.

MSConfig should only be used as a troubleshooting tool and if used incorrectly could cause a lot of damage to your computer. If you want we can disable "MSI live update" from loading when your computer boots via other means and then you can run it whenever you wish. Let me know your decision in your next reply.

PUP (Potentially Unwanted Programs)

[yporo9y6.default] - Line Found : user_pref("extensions.crossrider.bic", "14c6b5e3fe149b736985c3757bc5cbd3");

Potentially Unwanted Programs (PUP) are software that have unpredictable behaviour and/or might have been installed on your computer without your direct consent. You might have installed them willingly, in which case feel free to keep them. However, if you did not I advise you to remove them. If you decide to remove this PUP, please follow the steps below to run AdwCleaner.

Adwcleaner

Close all your programs and right-click adwcleaner_4.200.exe and select Run as administrator.
Click on Scan.
After the scan is over, select Cleaning.
Note: All programs will be closed and your computer will be rebooted, therefore I advise you to save any unsaved work.
A notepad window will open. Please copy/paste the contents in your next reply.

I need you to run another fix..

Click Start
Type notepad.exe in the search programs and files box and click Enter.
A blank Notepad page should open.
- Copy/Paste the contents of the code box below into Notepad.



C:\Users\Raymond\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.luckysearches.com%2Ffavicon.png

C:\Users\Raymond\AppData\Local\Opera\Opera\icons\www.luckysearches.com.idx

Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"

Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"

Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"

Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"

Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"

Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"



CreateRestorePoint:

Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post me the log

-----------------------------------------
In your next reply, I would like to see..

Decision about "MSI live update"
AdwCleaner Log (if you chose to run it)
fixlog.txt
Please post everything in the order given.

TheDoctor46

April 7, 2015, 7:06 AM UTC

OK, let's disable MSI update from startup another way.

For some reason ADWCleaner is not finding the crossrider program when it scans now. I tried twice. Even tried downloading the program again and rescanning.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by [removed] at 2015-04-07 08:04:14 Run:4
Running from B:\Users\[removed]\Desktop\FRST
[removed]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Raymond\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.luckysearches.com%2Ffavicon.png
C:\Users\Raymond\AppData\Local\Opera\Opera\icons\www.luckysearches.com.idx
Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"
Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"
Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"
Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"

CreateRestorePoint:
*****************

C:\Users\Raymond\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.luckysearches.com%2Ffavicon.png => Moved successfully.
C:\Users\Raymond\AppData\Local\Opera\Opera\icons\www.luckysearches.com.idx => Moved successfully.

========= reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" =========

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
BtTray REG_SZ "C:\Program Files (x86)\Bluetooth Suite\BtTray.exe"
BtvStack REG_SZ "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
Cmaudio8788 REG_SZ C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
Cmaudio8788GX REG_SZ C:\Windows\syswow64\HsMgr.exe Envoke
Cmaudio8788GX64 REG_SZ C:\Windows\system\HsMgr64.exe Envoke
EvtMgr6 REG_SZ C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
MSC REG_SZ "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
XboxStat REG_SZ "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
RTHDVCPL REG_SZ "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
Start WingMan Profiler REG_SZ C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
NvBackend REG_SZ "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
ShadowPlay REG_SZ C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

========= End of Reg: =========

========= reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" =========

========= End of Reg: =========

========= reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" =========

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
DAEMON Tools Lite REG_SZ "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
NvLedServiceHost REG_SZ C:\Program Files (x86)\NVIDIA Corporation\LED Visualizer\NvLedServiceHost.exe RunStartup

========= End of Reg: =========

========= reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" =========

========= End of Reg: =========

========= reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

Restore point was successfully created.

==== End of Fixlog 08:04:18 ====

mAL_rEm018

April 7, 2015, 10:16 PM UTC

Hello TheDoctor46,

"TheDoctor46" wrote:
For some reason ADWCleaner is not finding the crossrider program when it scans now. I tried twice. Even tried downloading the program again and rescanning.

Can you see the extension in the Firefox Browser?

Open Firefox.
Click on Tools in the Menu bar.
Select Add-ons.
Note: this can also be accomplished by pressing on Ctrl+Shift+A inside the browser.
Click on Extensions on the left-side panel. Try to locate the following:

Crossrider
If the extension is present, select Remove.
Click Restart now. The extension should now be gone.

"TheDoctor46" wrote:
OK, let's disable MSI update from startup another way.

No problem, first we will need to re-enable MSI update. To do this, please follow the steps below..

Enable a program through CCleaner

Open the Start menu.
Inside the Search programs and files type the following:

CCleaner
Right-click on CCleaner and select Run as administrator.
Select Tools from the left-side panel.
Open Startup.
Select the Windows tab. Locate the following program:

MSI Live Update
Click Enable.
Exit CCleaner and reboot your computer.

Next..

Click Start
Type notepad.exe in the search programs and files box and click Enter.
A blank Notepad page should open.
- Copy/Paste the contents of the code box below into Notepad.



Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" 

Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"

Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"

Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" 

Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"

Reg: reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"

Reg: reg.exe query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"

Reg: reg.exe query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce"

Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post me the log

-----------------------------------------
In your next reply, I would like to see..

Did you have trouble performing any of the steps?
Was Crossrider present in your Firefox browser, and if so were you able to remove it?
fixlog.txt
Please post everything in the order given.

TheDoctor46

April 8, 2015, 7:30 AM UTC

Re-enabled MSI update

Crossrider is not in the list of firefox extensions. There are 4 in there and I know what all of them are.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by [removed] at 2015-04-08 08:28:05 Run:5
Running from B:\Users\[removed]\Desktop\FRST
[removed]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
Reg: reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"
Reg: reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
Reg: reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
Reg: reg.exe query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"
Reg: reg.exe query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce"
*****************

========= reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" =========

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
BtTray REG_SZ "C:\Program Files (x86)\Bluetooth Suite\BtTray.exe"
BtvStack REG_SZ "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
Cmaudio8788 REG_SZ C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
Cmaudio8788GX REG_SZ C:\Windows\syswow64\HsMgr.exe Envoke
Cmaudio8788GX64 REG_SZ C:\Windows\system\HsMgr64.exe Envoke
EvtMgr6 REG_SZ C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
MSC REG_SZ "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
XboxStat REG_SZ "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
RTHDVCPL REG_SZ "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
Start WingMan Profiler REG_SZ C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
NvBackend REG_SZ "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
ShadowPlay REG_SZ C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

========= End of Reg: =========

========= reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" =========

========= End of Reg: =========

========= reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" =========

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
NvLedServiceHost REG_SZ C:\Program Files (x86)\NVIDIA Corporation\LED Visualizer\NvLedServiceHost.exe RunStartup

========= End of Reg: =========

========= reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" =========

========= End of Reg: =========

========= reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg.exe query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" =========

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
USB3MON REG_SZ "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
RUSB3MON REG_SZ "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe"
IAStorIcon REG_SZ C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
WinampAgent REG_SZ "C:\Program Files (x86)\Winamp\winampa.exe"
HP Software Update REG_SZ C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
ControlCenterCount REG_SZ C:\Program Files (x86)\MSI\ControlCenter\ControlCenterCount.exe
Fast Boot REG_SZ C:\Program Files (x86)\MSI\Fast Boot\StartFastBoot.exe
SunJavaUpdateSched REG_SZ "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
Live Update REG_SZ C:\Program Files (x86)\MSI\Live Update\Live Update.exe /REMINDER

========= End of Reg: =========

========= reg.exe query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" =========

========= End of Reg: =========

==== End of Fixlog 08:28:06 ====

mAL_rEm018

April 8, 2015, 3:34 PM UTC

Hello TheDoctor46,

"TheDoctor46" wrote:
Crossrider is not in the list of firefox extensions. There are 4 in there and I know what all of them are.

If you don't see the extension in your Firefox browser and AdwCleaner does not detect it anymore, then it's safe to say that it no longer is present on your computer

I noticed that your Firefox browser was outdated. If you have not already done so, please follow the steps below to update it.

Update Firefox

Open Firefox.
Click on Help in the Menu Bar.
Select About Firefox.
When the update has finished downloading, click Restart Firefox to Update.
Firefox should now be updated. If you were unable to update FF, please let me know in your next post.

I need you to run a fix..

Click Start
Type notepad.exe in the search programs and files box and click Enter.
A blank Notepad page should open.
- Copy/Paste the contents of the code box below into Notepad.



Reg: reg.exe delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /v "Live Update" /f

Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post me the log

Reboot your computer and please answer the following question

Does "MSI Live Update" still run at startup?

-----------------------------------------
In your next reply, I would like to see..

Did you have trouble performing any of the steps?
fixlog.txt
Answer to my question.
Please post everything in the order given.

TheDoctor46

April 9, 2015, 12:45 PM UTC

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by [removed] at 2015-04-09 07:33:20 Run:6
Running from B:\Users\[removed]\Desktop\FRST
[removed]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Reg: reg.exe delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /v "Live Update" /f
*****************

========= reg.exe delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /v "Live Update" /f =========

The operation completed successfully.

========= End of Reg: =========

==== End of Fixlog 07:33:20 ====

MSI update has been disabled at startup now.

mAL_rEm018

April 9, 2015, 3:30 PM UTC

Hello TheDoctor46,

"TheDoctor46" wrote:
MSI update has been disabled at startup now.

Great! I have good news..there are no more signs of malware on your computer Please follow the steps below and then you'll be all set to go.

Let's remove the tools we have been using so far..

Please download Delfix to your desktop.
Right-click on delfix_10.9.exe and select Run as administrator.
Check the following boxes:
Remove disinfection tools
Purge system restore
You can safely remove any tools and/or logs that may remain on your computer.

You should read and get acquainted with the following topic COMPUTER SECURITY - a short guide to staying safer online , which goes into depth on how to keep your computer secure.

I would really appreciate it if you could reply to this post to let me know that you've seen it, so that I can ask for this topic to be closed.

mAL_rEm018

April 9, 2015, 4:55 PM UTC

Hello TheDoctor46,