Hi again Cypher, thanks so much for your continued assistance
My pleasure
Does this latest analysis mean that TornTV is still in operation on my system?
Yes there are a lot of "leftovers" which we will remove now.
Do the following please then give me another update on the Adds you're seeing in FireFox.
- Click Start
- Type notepad.exe in the search programs and files box and click Enter.
- A blank Notepad page should open.
- Copy and Paste the following script into Notepad, Do not include the words Code: select all
- (Click the select all button next to code to select the entire script).
- Code: Select all
C:\Program Files (x86)\TheTorntv 2015-04-01 18:46 - 2015-04-02 22:53 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-04-01 17:46 - 2015-04-04 12:46 - 00001336 _____ () C:\Windows\Tasks\helper_king_notification_service.job 2015-04-01 17:46 - 2015-04-04 12:21 - 00000698 _____ () C:\Windows\Tasks\helper_king_updating_service.job 2015-04-01 17:46 - 2015-04-02 22:56 - 00000000 ____D () C:\Program Files (x86)\helper king 2015-04-01 17:46 - 2015-04-01 17:46 - 00004374 _____ () C:\Windows\System32\Tasks\helper_king_notification_service 2015-04-01 17:46 - 2015-04-01 17:46 - 00003738 _____ () C:\Windows\System32\Tasks\helper_king_updating_service Task: {3DE241CC-3AA7-4B1A-B76A-1E19A4B7C10A} - \ItI78RqBO8wx3 No Task File <==== ATTENTION Task: {4B505419-B3C8-446E-9CA7-321CE5129ED1} - System32\Tasks\BGCOB => C:\Users\Simon Harries\AppData\Roaming\BGCOB.exe <==== ATTENTION Task: {B35755DB-2BCD-4B68-9AC1-7CE7E4DC56BA} - System32\Tasks\VLJUVMT => C:\Users\Simon Harries\AppData\Roaming\VLJUVMT.exe <==== ATTENTION AlternateDataStreams: C:\Users\Simon Harries\Cookies:a7dP5gmDxMWNYDpRgL5irjL AlternateDataStreams: C:\Users\Simon Harries\AppData\Local\Temporary Internet Files:bEKR1DIHW3xLarnNstx7rkLTThfuc AlternateDataStreams: C:\Users\Simon Harries\AppData\Local\Temporary Internet Files:ITppCZk9JDyaYIWh2MRE1VO7IGe [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49D262F-604A-45E5-988A-151F8A2C1F2}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{63AAC20A-5A0-4A1D-8C7A-2CA89A2ADB1}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEAB6BEC-4762-40AA-8A65-CF86E7F9ED6}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CD7616DA-858-41D1-AA1D-A85854C4F11C}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DEDFAB7E-4B9-4695-8DF7-AE35772F9EB0}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F122AE0D-E4F4-4185-921D-692FE0C748DA}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F59B62D4-F56D-4298-B81F-5133112910C9}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA86571B-5756-4D09-8F63-B278A636B8C2}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_CURRENT_USER\Software\Classes\.torrent] [-HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\TheTorntv V10] [-HKEY_CURRENT_USER\Software\Classes\TornTvDownloader.File] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TornTvDownloader.File] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Torntv] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application\Torntv] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Torntv] [-HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\TheTorntv V10] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49D262F-604A-45E5-988A-151F8A2C1F2}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{63AAC20A-5A0-4A1D-8C7A-2CA89A2ADB1}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68417b56-3d7a-429a-a598-f595d8165fe2}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{769ba6fc-2ff3-4508-a278-bde6e70db05d}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEAB6BEC-4762-40AA-8A65-CF86E7F9ED6}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CD7616DA-858-41D1-AA1D-A85854C4F11C}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cefcec6f-064b-4e4a-9099-8925f8efbfa2}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DEDFAB7E-4B9-4695-8DF7-AE35772F9EB0}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F122AE0D-E4F4-4185-921D-692FE0C748DA}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F59B62D4-F56D-4298-B81F-5133112910C9}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA86571B-5756-4D09-8F63-B278A636B8C2}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbacdb05-e575-4e90-b2ef-92212246ce7a}] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Classes\.torrent] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\TheTorntv V10] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000\Software\Classes\TornTvDownloader.File] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000_Classes\.torrent] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\TheTorntv V10] [-HKEY_USERS\S-1-5-21-1620838597-635671493-4020915475-1000_Classes\TornTvDownloader.File] [-HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\TheTorntv V10] EmptyTemp: CMD: ipconfig /flushdns
- Save it next to FRST.exe on your Desktop as filename fixlist.txt
- NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are saved in the same location or the fix will not work.
- Right-click FRST.exe and select " Run as administrator " to run it.
- Press the Fix button just once. Then wait.
- When finished, it will create a Fixlog.txt log on your Desktop.
- Please post the content of the Fixlog.txt in your next reply.