Solved Another crudware machine

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-10-2014 01
Ran by pcuser at 2014-10-28 16:43:22 Run:1
Running from C:\Documents and Settings\pcuser\Desktop
Loaded Profile: pcuser (Available profiles: pcuser)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect "
C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect
ProxyServer: http=127.0.0.1:13091;
SearchScopes: HKLM - {246A41D6-8573-909C-93FF-2DADB0FCBF14} URL =
Toolbar: HKCU - No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
S3 catchme; \??\C:\DOCUME~1\pcuser\LOCALS~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
C:\Documents and Settings\pcuser\Local Settings\temp\Quarantine.exe
C:\Documents and Settings\pcuser\Local Settings\temp\sqlite3.dll
C:\Documents and Settings\TEMP\Local Settings\temp\jre-6u31-windows-i586-iftw-rv.exe

*****************

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpUninstallDeleteDir => value deleted successfully.
"C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect" => File/Directory not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{246A41D6-8573-909C-93FF-2DADB0FCBF14}" => Key deleted successfully.
"HKCR\CLSID\{246A41D6-8573-909C-93FF-2DADB0FCBF14}" => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} => value deleted successfully.
"HKCR\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}" => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
"HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found.
catchme => Service deleted successfully.
IntelIde => Service deleted successfully.
C:\Documents and Settings\pcuser\Local Settings\temp\Quarantine.exe => Moved successfully.
C:\Documents and Settings\pcuser\Local Settings\temp\sqlite3.dll => Moved successfully.
C:\Documents and Settings\TEMP\Local Settings\temp\jre-6u31-windows-i586-iftw-rv.exe => Moved successfully.

==== End of Fixlog ====

 

Machine is running very well. The search function is still damaged. But doing some research, it appears to be a Microsoft download called Windows Search 4.0. I was gonna uninstall it and it tossed up a warning saying several other programs would be affected by uninstalling. But, other places say there's no prob dumping it

Thanks

Results of screen317's Security Check version 0.99.89
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java 7 Update 71
Java version out of Date!
Adobe Flash Player 15.0.0.189
Adobe Reader XI
Mozilla Firefox (33.0.1)
Google Chrome 35.0.1916.153
Google Chrome 38.0.2125.104
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````


Farbar Service Scanner Version: 21-07-2014
Ran by pcuser (administrator) on 28-10-2014 at 18:14:06
Running from "C:\Documents and Settings\pcuser\Desktop "
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
IE proxy is enabled.
ProxyServer: http=127.0.0.1:13091;


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Other Services:
==============


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) NwlnkIpx(9) NwlnkNb(10) PSched(7) Tcpip(4)
0x0B00000005000000010000000200000003000000040000000C0000000B0000000600000007000000090000000A000000
IpSec Tag value is correct.

**** End of log ****

C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\apn\APN-Stub\W3IV6-G\APNIC.7z.vir Win32/Bundled.Toolbar.Ask.B potentially unsafe application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\All Users\Application Data\apn\APN-Stub\W3IV6-G\APNIC.dll.vir Win32/Bundled.Toolbar.Ask.B potentially unsafe application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Application Data\eDownload\iSafe_setup.exe.vir a variant of Win32/ELEX.Q potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\CRE\edfllcfghbogdahicgpcmnmkgpcmdjeo.crx.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\CRE\nemfjadlboooiffmcelkafilagddogim.crx.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe.vir Win32/Somoto.D potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\edfllcfghbogdahicgpcmnmkgpcmdjeo\10.31.4.510_0\APISupport\APISupport.dll.vir a variant of Win32/Conduit.SearchProtect.P potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\edfllcfghbogdahicgpcmnmkgpcmdjeo\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\edfllcfghbogdahicgpcmnmkgpcmdjeo\10.31.4.510_0\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lgonpmchaeokedifbjenbcnjcdefdceg\1.26.62_0\extensionData\plugins\91.js.vir JS/Toolbar.Crossrider.B potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nemfjadlboooiffmcelkafilagddogim\10.31.4.510_0\APISupport\APISupport.dll.vir a variant of Win32/Conduit.SearchProtect.P potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nemfjadlboooiffmcelkafilagddogim\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nemfjadlboooiffmcelkafilagddogim\10.31.4.510_0\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir Win32/Toolbar.Conduit.Y potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\Conduit\CT3282812\plugins\TBVerifier.dll.vir Win32/Toolbar.Conduit.AC potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\Conduit\CT3289663\plugins\TBVerifier.dll.vir Win32/Toolbar.Conduit.AC potentially unwanted application deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\PC Health Kit\PCHealthKit.exe.vir a variant of Win32/SpeedingUpMyPC.F application cleaned by deleting - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\PC Health Kit\PCHKSmartScan.exe.vir a variant of Win32/Adware.SpeedingUpMyPC.C application cleaned by deleting - quarantined
C:\AdwCleaner\Quarantine\C\windows\system32\roboot.exe.vir a variant of Win32/Systweak.A potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\Application Data\VisicomToolBar\GamesAGoGo_toolbar_3.0.0.2.exe a variant of Win32/Toolbar.Visicom.A potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\cdbxp_setup_4.4.1.3341.exe Win32/OpenCandy potentially unsafe application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\Chrome (1).exe a variant of Win32/AirAdInstaller.A potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\iSafe (1).exe a variant of Win32/ELEX.C potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\iSafe (2).exe a variant of Win32/ELEX.C potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\iSafe.exe a variant of Win32/ELEX.C potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\speedupmypc (1).exe Win32/SpeedUpMyPC potentially unwanted application deleted - quarantined
C:\Documents and Settings\pcuser\My Documents\Downloads\speedupmypc.exe Win32/SpeedUpMyPC potentially unwanted application deleted - quarantined
C:\Program Files\FLV Player\Uninstall\__Uninstall_.exe a variant of Win32/InstallCore.BY potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP756\A0209219.exe a variant of Win32/InstallIQ.C potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209253.dll Win32/Bundled.Toolbar.Ask.B potentially unsafe application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209255.dll Win32/Toolbar.Conduit.AC potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209256.dll Win32/Toolbar.Conduit.AC potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209257.dll Win32/Toolbar.Conduit.Y potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209263.exe a variant of Win32/ELEX.Q potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209281.exe Win32/Somoto.D potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209323.exe a variant of Win32/SpeedingUpMyPC.F application cleaned by deleting - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209328.exe a variant of Win32/Adware.SpeedingUpMyPC.C application cleaned by deleting - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209337.dll a variant of Win32/Conduit.SearchProtect.N potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209338.exe a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209339.dll a variant of Win32/Conduit.SearchProtect.P potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209342.dll a variant of Win32/Conduit.SearchProtect.N potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209343.exe a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209344.dll a variant of Win32/Conduit.SearchProtect.P potentially unwanted application deleted - quarantined
C:\System Volume Information\_restore{298B278E-AC83-4387-8D34-EE0A30F3019B}\RP757\A0209346.exe a variant of Win32/Systweak.A potentially unwanted application deleted - quarantined

 

The search function is damaged. The search window comes up with missing areas. No on the proxy. Let me see if I can create an image

 

Done.

 

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\pcuser\Desktop>CD /D C:\

C:\>chkdsk C:
The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
4 percent completed.
5 percent completed.
6 percent completed.
7 percent completed.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
12 percent completed.
13 percent completed.
14 percent completed.
15 percent completed.
16 percent completed.
17 percent completed.
18 percent completed.
19 percent completed.
20 percent completed.
21 percent completed.
22 percent completed.
23 percent completed.
24 percent completed.
25 percent completed.
26 percent completed.
27 percent completed.
28 percent completed.
29 percent completed.
30 percent completed.
31 percent completed.
32 percent completed.
33 percent completed.
34 percent completed.
35 percent completed.
36 percent completed.
37 percent completed.
38 percent completed.
39 percent completed.
40 percent completed.
41 percent completed.
42 percent completed.
43 percent completed.
44 percent completed.
45 percent completed.
46 percent completed.
47 percent completed.
48 percent completed.
49 percent completed.
50 percent completed.
51 percent completed.
52 percent completed.
53 percent completed.
54 percent completed.
55 percent completed.
56 percent completed.
57 percent completed.
58 percent completed.
59 percent completed.
60 percent completed.
61 percent completed.
62 percent completed.
63 percent completed.
64 percent completed.
65 percent completed.
66 percent completed.
67 percent completed.
68 percent completed.
69 percent completed.
70 percent completed.
71 percent completed.
72 percent completed.
73 percent completed.
74 percent completed.
75 percent completed.
76 percent completed.
77 percent completed.
78 percent completed.
79 percent completed.
80 percent completed.
81 percent completed.
82 percent completed.
83 percent completed.
84 percent completed.
85 percent completed.
86 percent completed.
87 percent completed.
88 percent completed.
89 percent completed.
90 percent completed.
91 percent completed.
92 percent completed.
93 percent completed.
94 percent completed.
95 percent completed.
96 percent completed.
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
4 percent completed.
5 percent completed.
6 percent completed.
7 percent completed.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
12 percent completed.
13 percent completed.
14 percent completed.
15 percent completed.
16 percent completed.
17 percent completed.
18 percent completed.
19 percent completed.
20 percent completed.
21 percent completed.
22 percent completed.
23 percent completed.
24 percent completed.
25 percent completed.
26 percent completed.
27 percent completed.
28 percent completed.
29 percent completed.
30 percent completed.
31 percent completed.
32 percent completed.
33 percent completed.
34 percent completed.
35 percent completed.
36 percent completed.
37 percent completed.
38 percent completed.
39 percent completed.
40 percent completed.
41 percent completed.
42 percent completed.
43 percent completed.
44 percent completed.
45 percent completed.
46 percent completed.
47 percent completed.
48 percent completed.
49 percent completed.
50 percent completed.
51 percent completed.
52 percent completed.
53 percent completed.
54 percent completed.
55 percent completed.
56 percent completed.
57 percent completed.
58 percent completed.
59 percent completed.
60 percent completed.
61 percent completed.
62 percent completed.
63 percent completed.
64 percent completed.
65 percent completed.
66 percent completed.
67 percent completed.
68 percent completed.
69 percent completed.
70 percent completed.
71 percent completed.
72 percent completed.
73 percent completed.
74 percent completed.
75 percent completed.
76 percent completed.
77 percent completed.
78 percent completed.
79 percent completed.
80 percent completed.
81 percent completed.
82 percent completed.
83 percent completed.
84 percent completed.
85 percent completed.
86 percent completed.
87 percent completed.
88 percent completed.
89 percent completed.
90 percent completed.
91 percent completed.
92 percent completed.
93 percent completed.
94 percent completed.
95 percent completed.
96 percent completed.
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
4 percent completed.
5 percent completed.
6 percent completed.
7 percent completed.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
12 percent completed.
13 percent completed.
14 percent completed.
15 percent completed.
16 percent completed.
17 percent completed.
18 percent completed.
19 percent completed.
20 percent completed.
21 percent completed.
22 percent completed.
23 percent completed.
24 percent completed.
25 percent completed.
26 percent completed.
27 percent completed.
28 percent completed.
29 percent completed.
30 percent completed.
31 percent completed.
32 percent completed.
33 percent completed.
34 percent completed.
35 percent completed.
36 percent completed.
37 percent completed.
38 percent completed.
39 percent completed.
40 percent completed.
41 percent completed.
42 percent completed.
43 percent completed.
44 percent completed.
45 percent completed.
46 percent completed.
47 percent completed.
48 percent completed.
49 percent completed.
50 percent completed.
51 percent completed.
52 percent completed.
53 percent completed.
54 percent completed.
55 percent completed.
56 percent completed.
57 percent completed.
58 percent completed.
59 percent completed.
60 percent completed.
61 percent completed.
62 percent completed.
63 percent completed.
64 percent completed.
65 percent completed.
66 percent completed.
67 percent completed.
68 percent completed.
69 percent completed.
70 percent completed.
71 percent completed.
72 percent completed.
73 percent completed.
74 percent completed.
75 percent completed.
76 percent completed.
77 percent completed.
78 percent completed.
79 percent completed.
80 percent completed.
81 percent completed.
82 percent completed.
83 percent completed.
84 percent completed.
85 percent completed.
86 percent completed.
87 percent completed.
88 percent completed.
89 percent completed.
90 percent completed.
91 percent completed.
92 percent completed.
93 percent completed.
94 percent completed.
95 percent completed.
96 percent completed.
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

78116030 KB total disk space.
31556424 KB in 225959 files.
112380 KB in 15632 indexes.
0 KB in bad sectors.
402686 KB in use by the system.
65536 KB occupied by the log file.
46044540 KB available on disk.

4096 bytes in each allocation unit.
19529007 total allocation units on disk.
11511135 allocation units available on disk.

C:\>


Tweaking.com - Windows Repair v2.10.0
--------------------------------------------------------------------------------

System Variables
--------------------------------------------------------------------------------
OS: Microsoft Windows XP
OS Architecture: 32-bit
OS Version: 5.1.2600
OS Service Pack: Service Pack 3
Computer Name: 745REGMSO-07
Windows Drive: C:\
Windows Path: C:\WINDOWS
Program Files: C:\Program Files
Current Profile: C:\Documents and Settings\pcuser
Current Profile SID: S-1-5-21-1060284298-1409082233-839522115-1003
Current Profile Classes: S-1-5-21-1060284298-1409082233-839522115-1003_Classes
Profiles Location: C:\Documents and Settings
Profiles Location 2: C:\WINDOWS\ServiceProfiles
Local Settings AppData: C:\Documents and Settings\pcuser\Local Settings\Application Data
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 00:12:19

Process Count: 32
Commit Total: 268.16 MB
Commit Limit: 3.84 GB
Commit Peak: 275.04 MB
Handle Count: 8155
Kernel Total: 71.25 MB
Kernel Paged: 58.20 MB
Kernel Non Paged: 13.04 MB
System Cache: 1.57 GB
Thread Count: 483
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 1.99 GB
Memory Used: 458.06 MB(22.481%)
Memory Avail.: 1.54 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 1.99 GB
Memory Used: 337.79 MB(16.5785%)
Memory Avail.: 1.66 GB
--------------------------------------------------------------------------------

Starting Repairs...
Started at (10/28/2014 8:42:07 PM)

Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...
Total Missing 'InstallDate' Fixed: 142

01 - Reset Registry Permissions 01/03
HKEY_CURRENT_USER & Sub Keys
Start (10/28/2014 8:42:11 PM)
Running Repair Under Current User Account
Done (10/28/2014 8:42:23 PM)

01 - Reset Registry Permissions 02/03
HKEY_LOCAL_MACHINE & Sub Keys
Start (10/28/2014 8:42:23 PM)
Running Repair Under System Account
Done (10/28/2014 8:46:01 PM)

01 - Reset Registry Permissions 03/03
HKEY_CLASSES_ROOT & Sub Keys
Start (10/28/2014 8:46:01 PM)
Running Repair Under System Account
Done (10/28/2014 8:48:01 PM)

03 - Reset Service Permissions
Start (10/28/2014 8:48:01 PM)
Running Repair Under System Account
Done (10/28/2014 8:48:34 PM)

04 - Register System Files
Start (10/28/2014 8:48:34 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:50:23 PM)

05 - Repair WMI
Start (10/28/2014 8:50:24 PM)

Starting Security Center So We Can Export The Security Info.

Exporting Antivirus Info...
Microsoft Security Essentials Exported.
Microsoft Security Essentials Exported.

Exporting 3rd Party Firewall Info...
No 3rd Party Firewall Products Reported.

Running Repair Under Current User Account
Done (10/28/2014 8:56:49 PM)

06 - Repair Windows Firewall
Start (10/28/2014 8:56:49 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:57:05 PM)

07 - Repair Internet Explorer
Start (10/28/2014 8:57:05 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:59:20 PM)

08 - Repair MDAC/MS Jet
Start (10/28/2014 8:59:20 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:59:33 PM)

09 - Repair Hosts File
Start (10/28/2014 8:59:33 PM)
Running Repair Under System Account
Done (10/28/2014 8:59:35 PM)

10 - Remove Policies Set By Infections
Start (10/28/2014 8:59:35 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:59:37 PM)

11 - Repair Start Menu Icons Removed By Infections
Start (10/28/2014 8:59:37 PM)
Running Repair Under System Account
Done (10/28/2014 8:59:39 PM)

12 - Repair Icons
Start (10/28/2014 8:59:39 PM)
Running Repair Under Current User Account
Done (10/28/2014 8:59:40 PM)

13 - Repair Winsock & DNS Cache
Start (10/28/2014 8:59:40 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:59:53 PM)

15 - Repair Proxy Settings
Start (10/28/2014 8:59:53 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 8:59:56 PM)

17 - Repair Windows Updates
Start (10/28/2014 8:59:56 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.
Done (10/28/2014 9:00:30 PM)

18 - Repair CD/DVD Missing/Not Working
Start (10/28/2014 9:00:30 PM)
iTunes not found, not applying UpperFilters iTunes Reg Key
Done (10/28/2014 9:00:30 PM)

19 - Repair Volume Shadow Copy Service
Start (10/28/2014 9:00:30 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:08 PM)

21 - Repair MSI (Windows Installer)
Start (10/28/2014 9:01:08 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:17 PM)

23.01 - Repair bat Association
Start (10/28/2014 9:01:17 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:20 PM)

23.02 - Repair cmd Association
Start (10/28/2014 9:01:20 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:22 PM)

23.03 - Repair com Association
Start (10/28/2014 9:01:22 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:24 PM)

23.04 - Repair Directory Association
Start (10/28/2014 9:01:24 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:26 PM)

23.05 - Repair Drive Association
Start (10/28/2014 9:01:26 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:28 PM)

23.06 - Repair exe Association
Start (10/28/2014 9:01:28 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:31 PM)

23.07 - Repair Folder Association
Start (10/28/2014 9:01:31 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:33 PM)

23.08 - Repair inf Association
Start (10/28/2014 9:01:33 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:36 PM)

23.09 - Repair lnk (Shortcuts) Association
Start (10/28/2014 9:01:36 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:38 PM)

23.10 - Repair msc Association
Start (10/28/2014 9:01:38 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:40 PM)

23.11 - Repair reg Association
Start (10/28/2014 9:01:40 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:43 PM)

23.12 - Repair scr Association
Start (10/28/2014 9:01:43 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:45 PM)

24 - Repair Windows Safe Mode
Start (10/28/2014 9:01:45 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:01:47 PM)

25 - Repair Print Spooler
Start (10/28/2014 9:01:47 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:02:04 PM)

26 - Restore Important Windows Services
Start (10/28/2014 9:02:04 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:02:14 PM)

27 - Set Windows Services To Default Startup
Start (10/28/2014 9:02:14 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:02:26 PM)

Skipping Repair.
Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
Current version: 5.1

Skipping Repair.
Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
Current version: 5.1

Skipping Repair.
Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
Current version: 5.1

31 - Repair Windows 'New' Submenu
Start (10/28/2014 9:02:26 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (10/28/2014 9:02:29 PM)

Cleaning up empty logs...

All Selected Repairs Done.
Done at (10/28/2014 9:02:29 PM)
Total Repair Time: 00:20:23


...YOU MUST RESTART YOUR SYSTEM...

 

still is the same.. Maybe removing windows search 4.0 will revert back to the original

 

Machine is running well. I do not think I wil pursue the search issue. The owner is happy to get her machine back.. Looking at various Microsoft web forums there could be some fixes such as registering .dlls again. If she wants that, then.... I just wanted to help get the malware cleaned off.

Again thanks. And just a comment, the tools you run are fairly predictable, but knowing which objects to apply to the various fix files was fascinating and I'll assume it took years to acquire that knowledge..

Thanks again