Not really sure where to start

[fungstonfool]

First of all I like to start by saying that I'm pretty familiar with a comp but occasionally I do hit a wall and cant really figure out what is going on; this is one of them occasions.
My wife's laptop is acting screwy. My 2 teenage boys like to use her laptop and as a result it has started to act totally abruptly. What do I mean?? I'll explain...On her desktop, unlike the other profile on the comp, is showing weird icons (lil white page with explorer "E" on it) and every-time I try to start a program, it will prompt a .ink file window asking to save or open which if I do open it leads to a webpage that goes away anyways...and that's basically it...her profile doesn't do anything. If I go into the start menu, there is an IE icon that allows me to go online but nothing beyond that....one added note...the lil white page with the E on it...well its not the normal size one, this is a much smaller E.....in the properties of any of them it shows it being an INK file....help me rid this...
I think it has to do with the tablet pc part of the comp which I did go into regional settings and saw the english and INK option highlighted but i removed it from there and still it lingers....

 

[Yard Dog]

Malwarebytes Anti-Malware

Download and install MBAM Free from here
Run a full scan and copy and paste the contents of the log into your next post

Hello . can you copy and paste a log please ?

 

[fungstonfool]

Malwarebytes Anti-Malware (Trial) 1.60.0.1800
www.malwarebytes.org
Database version: v2012.01.01.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
wen :: WEN-PC [administrator]
Protection: Enabled
1/2/2012 12:33:22 AM
mbam-log-2012-01-02 (00-51-52).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 228605
Time elapsed: 18 minute(s),
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 7
HKCR\AppID\{11C27351-716B-4052-9361-E3B0A3F8221C} (Adware.ClickPotato) -> No action taken.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
Registry Values Detected: 1
HKLM\SOFTWARE\Mozilla\Firefox\extensions|[email protected] (Adware.ClickPotato) -> Data: C:\Program Files\ClickPotatoLite\bin\10.0.536.0\firefox\extensions -> No action taken.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\uninstall.exe (Trojan.Agent) -> No action taken.
(end)

 

[Yard Dog]

Okay, thanks. do this now for me. run full scan , and post results.

 

[fungstonfool]

Actually I did and when i went to my explorer in ended up in a vicious cycle of literally hundreds of windows opening....but i will say that i didnt see much difference but i will try again....it only took like 3 hours...hah

 

[Yard Dog]

fungstonfool is online now Add to fungstonfool's Reputation Report Post

Re: Not really sure where to start
Malwarebytes Anti-Malware (Trial) 1.60.0.1800
Malwarebytes : Free anti-malware, anti-virus and spyware removal download
Database version: v2012.01.01.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
wen :: WEN-PC [administrator]
Protection: Enabled
1/2/2012 12:33:22 AM
mbam-log-2012-01-02 (00-51-52).txt
Scan type: Quick scan

Scan type: Quick scan Indicates to me a quick scan..
Time elapsed: 18 minute(s),

Not sure where 3 hours went. shows 18 min.. try again please

 

[fungstonfool]

Here you go my helping friend...just got up to check it and here are the results....hope they can help thx


Malwarebytes Anti-Malware (Trial) 1.60.0.1800
www.malwarebytes.org
Database version: v2012.01.01.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
wen :: WEN-PC [administrator]
Protection: Enabled
1/2/2012 1:10:54 AM
mbam-log-2012-01-02 (04-58-54).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 406479
Time elapsed: 2 hour(s), 5 minute(s), 10 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 7
HKCR\AppID\{11C27351-716B-4052-9361-E3B0A3F8221C} (Adware.ClickPotato) -> No action taken.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
Registry Values Detected: 1
HKLM\SOFTWARE\Mozilla\Firefox\extensions|[email protected] (Adware.ClickPotato) -> Data: C:\Program Files\ClickPotatoLite\bin\10.0.536.0\firefox\extensions -> No action taken.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\uninstall.exe (Trojan.Agent) -> No action taken.
(end)

 

[fungstonfool]

so...anyone else have a suggestion????

 

[Yard Dog]

You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so.

Get free version of SuperAntispyware and run full scan, then please post those results. SUPERAntiSpyware.com - Online Scanner
Free is sufficient. no need to buy this. I use free myself.

 

[fungstonfool]

This is the result of the 2nd program....WOW i couldnt believe what i saw....is this something one can keep doing forever???? seems like different malware programs find different stuff....


SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 01/02/2012 at 08:12 PM
Application Version : 5.0.1142
Core Rules Database Version : 8091
Trace Rules Database Version: 5903
Scan type : Complete Scan
Total Scan Time : 01:12:01
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Administrator
Memory items scanned : 894
Memory threats detected : 0
Registry items scanned : 39027
Registry threats detected : 2
File items scanned : 55000
File threats detected : 50
Adware.Tracking Cookie
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\147LNK3M.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\5QKTM9WR.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\G1RXRV1A.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\UJ8HFNDO.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\6Q12E2MA.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\YS1Z97C3.txt [ Cookie:[email protected]/cgi-bin ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\DW0VTA04.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\DEYYU450.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\QSNHQKR1.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\GBPMC4E3.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\U4EYTMQJ.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\FLNZJHAK.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\MF01B1A1.txt [ Cookie:[email protected]/ ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\N369ZT9D.txt [ Cookie:[email protected]/accounts ]
C:\USERS\BOYS\AppData\Roaming\Microsoft\Windows\Cookies\Low\JSXMG9HW.txt [ Cookie:[email protected]/ ]
C:\USERS\GUEST\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt [ Cookie:[email protected]/ ]
C:\USERS\GUEST\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt [ Cookie:[email protected]/assets/video/4-0/includes/ads/ ]
C:\USERS\GUEST\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt [ Cookie:[email protected]/ ]
C:\USERS\LINS NEW PRO\AppData\Roaming\Microsoft\Windows\Cookies\Low\F4ZH1L8L.txt [ Cookie:lins new [email protected]/ ]
C:\USERS\LINS NEW PRO\AppData\Roaming\Microsoft\Windows\Cookies\Low\EWDLU20O.txt [ Cookie:lins new [email protected]/ ]
C:\USERS\LINS NEW PRO\AppData\Roaming\Microsoft\Windows\Cookies\Low\ID8JNVWN.txt [ Cookie:lins new [email protected]/ ]
C:\USERS\LINS NEW PRO\AppData\Roaming\Microsoft\Windows\Cookies\Low\UE61NGK5.txt [ Cookie:lins new [email protected]/ ]
C:\USERS\LINS NEW PRO\AppData\Roaming\Microsoft\Windows\Cookies\Low\GFKEP8FX.txt [ Cookie:lins new [email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\wen@legolas-media[1].txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\3X4IVK5Z.txt [ Cookie:[email protected]/pagead/conversion/1048921873/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZLI5R7OC.txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\XEYMVUJ2.txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\T54SWAFW.txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\GAHTB79S.txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\A0F38D6D.txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\GWBVHYV0.txt [ Cookie:[email protected]/ ]
C:\USERS\WEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z2KW5M14.txt [ Cookie:[email protected]/ ]
ad.insightexpressai.com [ C:\USERS\BOYS\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XHDNYWAD ]
media.jaludo.com [ C:\USERS\BOYS\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XHDNYWAD ]
acvs.mediaonenetwork.net [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
cdn4.specificclick.net [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
core.insightexpressai.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
ia.media-imdb.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
m1.2mdn.net [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
media.ign.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
media.mtvnservices.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
media.socialvibe.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
media.y8.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
media1.break.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
media1.clubpenguin.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
secure-us.imrworldwide.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
serving-sys.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
udn.specificclick.net [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
www.pornhub.com [ C:\USERS\GUEST\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\66E444DG ]
Adware.Zugo
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D425283-D487-4337-BAB6-AB8354A81457}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D425283-D487-4337-BAB6-AB8354A81457}

 

[Yard Dog]

SuperAntiSpyware is a good free program to use along with Malwarebytes. These 2 plus your antivirus should keep you cleaned up , if you visit sites that leave tracking cookies .
Go ahead and have SAS fix these items. Then restart computer and see how you are running now.

 

[fungstonfool]

well my vista mentor....i did everything as you said and made a new profile for my wife, eliminating the need for the other one....little over kill but i think i just might be right where i need to be again....i do have 1 question...i have been using pcpitstop's pc matic for a yr now and previous versions over the years but have never had any issues like this....plus i have norton from comcast on here....i could get comcast or mcafee through the army and i probably should but i guess im open to suggestions....thanks at any case...for your help...

 

[Yard Dog]

Well, those registry programs like pcmatic are not really worth the money they charge. We discourage use of Registry cleaner products. They can do more harm than you would think. As far as antivirus, i have found free of Microsoft Security Essentials is quite amazing free antivirus, in the fact. it is also an anti spyware and an anti malware program. If it were me. i would lose those other programs and install MSE , then use Mbam and SAS once a week or so.
Keep in mind , that when you use uninstall any antivirus program you have to use its very own uninstaller plus Windows uninstaller to get rid of it all.