Adware.SwiftBrowse.CH(B) on Windows10

[[email protected] 0]

Please Help me get rid of this Adware.SwiftBrowse, let me know If there is anything else you need from me thank you.

FRST.txt

Addition.txt

Scan_150930-231251.txt

[Kevin Zoll 309]

Do the following:

Download AdwCleaner and save it on your desktop.

• Close all open programs and Internet browsers (you may want to print our or write down these instructions first).
• Double click on adwcleaner.exe to run the tool.
• Click on the Scan button.
• After the scan has finished, click on the Clean button.
• Confirm each time with OK.
• You will be prompted to restart your computer. A text file will open in Notepad after the restart (this is the log of what was removed), which you can save on your desktop.
• Attach that log file to your reply by clicking the More Reply Options button to the lower-right of where you type in your reply.

  NOTE: If you lose that log file for any reason, you can find it at C:\AdwCleaner on your computer.

Download Junkware Removal Tool and save it on your desktop.

• Run the tool by double-clicking it.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log is saved to your desktop and will automatically open.
• Attach the JRT log file to a reply by clicking the More Reply Options button to the lower-right of where you type in your reply.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

() C:\Program Files\daugava\Upbgbeie.exe
() C:\Program Files (x86)\snipsmart\bin\utilsnipsmart.exe
() C:\Program Files (x86)\snipsmart\updatesnipsmart.exe
() C:\Program Files (x86)\snipsmart\bin\snipsmart.PurBrowse64.exe
() C:\Program Files\daugava\Ejemidvlf64.exe
() C:\Program Files (x86)\snipsmart\bin\snipsmart.BrowserAdapter.exe
() C:\Program Files (x86)\snipsmart\bin\snipsmart.BrowserAdapter64.exe
HKLM\...\Run: [daugava64] => C:\Program Files\daugava\Ejemidvlf64.exe [463520 2015-07-22] ()
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
ProxyServer: [S-1-5-21-4175486189-1688849152-359601375-1001] => http=127.0.0.1:49180;https=127.0.0.1:49180
Hosts: 54.235.90.58	hiekeoginmmnpgbpafghcfbdmfpomaje
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4175486189-1688849152-359601375-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mysearchresults.com/?c=9001&t=03
SearchScopes: HKLM -> {589B893E-773C-4941-88C2-0DCC718E621C} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={3DA2CC2C-A886-11E2-83AB-50E5499DE23D}
SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={3DA2CC2C-A886-11E2-83AB-50E5499DE23D}
SearchScopes: HKU\S-1-5-21-4175486189-1688849152-359601375-1001 -> DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://start.sweetpacks.com?src=6&q={searchTerms}&barid=&crg=3.5000006.10042&st=23&st=23
SearchScopes: HKU\S-1-5-21-4175486189-1688849152-359601375-1001 -> {1E1751A2-AB6E-41C4-BECA-AB14DCD168A1} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3283894&SearchSource=45&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4175486189-1688849152-359601375-1001 -> {4008F254-8EBE-482E-ADB8-CCE6563A0AA8} URL = hxxp://www.mysearchresults.com/search?&c=3562&t=01&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4175486189-1688849152-359601375-1001 -> {589B893E-773C-4941-88C2-0DCC718E621C} URL = hxxp://start.sweetpacks.com?src=6&q={searchTerms}&barid=&crg=3.5000006.10042&st=23&st=23
SearchScopes: HKU\S-1-5-21-4175486189-1688849152-359601375-1001 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://start.sweetpacks.com?src=6&q={searchTerms}&barid=&crg=3.5000006.10042&st=23&st=23
Toolbar: HKLM-x32 - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Toolbar: HKU\S-1-5-21-4175486189-1688849152-359601375-1001 -> No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox => not found
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By SweetPacks\Firefox => not found
R2 65f825de-0adc-4791-a1e5-209aa6f7ea76; C:\Program Files\daugava\Upbgbeie.exe [284320 2015-07-22] () [File not signed]
R2 Update snipsmart; C:\Program Files (x86)\snipsmart\updatesnipsmart.exe [466632 2015-09-30] ()
R2 Util snipsmart; C:\Program Files (x86)\snipsmart\bin\utilsnipsmart.exe [466632 2015-09-30] ()
R1 {632f6d44-7348-49cf-a62d-8be1f536f088}Gw64; C:\Windows\System32\drivers\{632f6d44-7348-49cf-a62d-8be1f536f088}Gw64.sys [48744 2015-09-29] (StdLib)
2015-09-29 23:15 - 2015-09-29 15:33 - 00048744 _____ (StdLib) C:\WINDOWS\system32\Drivers\{632f6d44-7348-49cf-a62d-8be1f536f088}Gw64.sys
2015-09-30 22:51 - 2014-12-15 20:24 - 00000000 ____D C:\Program Files (x86)\snipsmart
2015-09-30 19:24 - 2014-09-03 20:42 - 00000000 ____D C:\ProgramData\69B6DBD2-8E05-476F-B662-CF8D235FD499
2015-09-29 20:34 - 2015-08-05 20:56 - 00000000 ____D C:\Program Files\daugava
2015-09-18 15:07 - 2014-02-22 12:02 - 00003336 _____ C:\WINDOWS\System32\Tasks\{644CEA08-DF58-4E51-89E4-8B63BD3545D7}
2015-09-18 15:07 - 2014-02-21 03:03 - 00004194 _____ C:\WINDOWS\System32\Tasks\SparkTrust PC Cleaner Plus_sch_439F91E0-9AC6-11E3-840F-50E5499DE23D
2015-09-18 15:07 - 2014-01-10 22:34 - 00003946 _____ C:\WINDOWS\System32\Tasks\DTReg
2015-09-18 15:07 - 2013-04-18 20:15 - 00003874 _____ C:\WINDOWS\System32\Tasks\Updater19962.exe
2015-09-18 15:07 - 2013-03-27 12:25 - 00003188 _____ C:\WINDOWS\System32\Tasks\{7C7A5EEA-61BE-4529-8D1E-4EB6DDB6306C}
2015-09-18 14:57 - 2014-06-11 19:55 - 00000000 ____D C:\WINDOWS\SysWOW64\jmdp
2015-09-18 14:57 - 2014-06-11 19:55 - 00000000 ____D C:\WINDOWS\system32\ljkb
C:\Users\Andrew\gosetup.exe
Task: {0205E6C0-0102-40CF-997B-221FC8D922CF} - System32\Tasks\bench-S-1-5-21-4175486189-1688849152-359601375-1001 => C:\Program Files (x86)\Bench\Updater\updater.exe [2014-01-31] () <==== ATTENTION
Task: {08F26356-4CB8-4D7C-B4F2-C461433F5E1E} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files (x86)\Search Extensions\Client.exe" /Preferred=true <==== ATTENTION
Task: {098F8700-9E94-4EBA-A996-81F8AD699E28} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {0E28E804-3EBA-47DB-B0A8-5F6438C04D67} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2014-01-31] () <==== ATTENTION
Task: {15E12962-FC79-42CC-A38D-985B36AEBDE1} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {1D89F15E-2835-4670-A1A7-37AEF5B1AB04} - System32\Tasks\Cawlez => C:\Program Files\daugava\Irosioe.bat [2015-07-22] ()
Task: {2EDD9AC9-9374-49A5-8AAA-A170F2C5AC82} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {43065CBF-7C4B-46BB-B10C-D078B7F28A01} - System32\Tasks\{644CEA08-DF58-4E51-89E4-8B63BD3545D7} => pcalua.exe -a "C:\Users\Andrew\AppData\Local\Temp\Temp1_Sculptris-Alpha6-Windows.zip\Sculptris Alpha 6.exe"
Task: {48D1111E-FF96-4C3C-8063-7573F250F4B4} - System32\Tasks\{7C7A5EEA-61BE-4529-8D1E-4EB6DDB6306C} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {596B0366-49E6-48DC-B238-A5A913BC4B58} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {5D7E202E-08EC-4062-9050-7C23DCC7DC17} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {65ED0164-BEFA-4243-9723-795796E187B3} - System32\Tasks\DTReg => C:\Users\Andrew\AppData\Roaming\DefaultTab\DefaultTab\DTReg.exe <==== ATTENTION
Task: {78ABA6BC-F3CC-45B3-9F99-598AF6CF62D4} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {84447B95-92BE-4C5A-9EF2-FE8585010369} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\Search Extensions\uninstall.exe <==== ATTENTION
Task: {A7505802-B2BC-49FB-B90E-DE1A4B802893} - System32\Tasks\Updater19962.exe => C:\Users\Andrew\AppData\Local\Updater19962\Updater19962.exe <==== ATTENTION
Task: {AAD1FEF4-5639-4340-A232-6554CBFCB0B8} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {B8677605-A21D-4546-86F8-FD8DD3134617} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {BDFE0A6E-E49C-4E7A-9959-C29F0275D14E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {C6669EBA-54C4-409D-B2B7-C2298822932D} - System32\Tasks\SparkTrust PC Cleaner Plus_sch_439F91E0-9AC6-11E3-840F-50E5499DE23D => C:\Program Files (x86)\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe <==== ATTENTION
Task: {CA74FD5A-F63A-4BCF-9BE2-0A12A6BBA77A} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe <==== ATTENTION
Task: {DC801686-EC76-4422-BD91-30B2AB0376E7} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {DDFAF1BC-637B-41CD-BF26-613D2C793A02} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {DFEF78D8-90B6-4E42-85F2-186225AFE51B} - System32\Tasks\SparkTrust Update Version3 Startup Task => C:\Program Files (x86)\Common Files\SparkTrust\UUS3\Update3.exe [2013-06-20] (SparkTrust Systems) <==== ATTENTION
Task: {EA7F32F8-DB34-4049-ABD1-DD5866B1620E} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {F4CC4C5F-F0A1-411D-A264-89861FE65FE9} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\bench-S-1-5-21-4175486189-1688849152-359601375-1001.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\SparkTrust PC Cleaner Plus_sch_439F91E0-9AC6-11E3-840F-50E5499DE23D.job => C:\Program Files (x86)\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\SparkTrust Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\SparkTrust\UUS3\Update3.exe <==== ATTENTION
2014-07-15 17:23 - 2014-07-15 17:23 - 00110592 _____ () C:\Program Files (x86)\Bench\BService\1.1\bhelper64.dll
2015-08-05 20:56 - 2015-07-22 17:55 - 00296608 _____ () C:\Program Files\daugava\Esrqqdf64.DLL
2015-08-05 20:56 - 2015-07-22 17:55 - 00463520 ____N () C:\Program Files\daugava\Ejemidvlf64.exe
2015-08-05 20:56 - 2015-07-22 17:55 - 00276640 _____ () C:\Program Files\daugava\Wqzaon64.DLL
2015-09-30 22:51 - 2015-09-30 18:31 - 00108232 _____ () C:\Program Files (x86)\snipsmart\bin\snipsmart.BrowserAdapter.exe
2014-12-15 20:33 - 2015-09-30 18:31 - 00126152 _____ () C:\Program Files (x86)\snipsmart\bin\snipsmart.BrowserAdapter64.exe
2014-07-15 17:23 - 2014-07-15 17:23 - 00110592 _____ () C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe
C:\Program Files (x86)\Bench

Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

[[email protected] 0]

Thankyou here are the results

JRT.txt

FRST.txt

AdwCleanerC1.txt

fixlist.txt

[[email protected] 0]

Bad news I'm still getting the adware on my browser, I deleted my browsing history and checked "do not track" in Chrome browser settings, and restarted my computer and ran the same trouble shooting method that was perscribed. Unfortunatly I still have the adware and the adwcleaner and Junkware Removal tell me that I have no adware on my machine. I will be out of town this  Friday-Monday, so I could please have this case still opened untill I get back? Thanks.

JRT2.txt

AdwCleanerS2.txt

fixlist.txt

FRST.txt

[Kevin Zoll 309]

You did not clean what AdwCleaner found. After completing a scan with AdwCleaner you are to click the Clean button to remove what AdwCleaner found.

[Kevin Zoll 309]

Thread Closed

Reason: Lack of Response

PM either Kevin, Elise, or Arthur to have this thread reopened.

The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread.