Solved: last session restore issues

[1niko]

This happened about 2 days ago, i installed and started Malwarebytes Anti-Malware. After scan finished and threats(babylon toolbar and other malware, of which many were more or less; closely connected to internet in general) placed in quarantine, i closed program. Afterwards, "last time session displaying" problem appeared

"show my windows and tabs from last time" change itself back to "show my home page" automatically every time i restart firefox so session restore don't work, i only get my home page on restart.

I've set the options to be "Show windows and tabs from last time" and in the Privacy setting, I have "Firefox will remember history", also i reset browser.sessionstore* preferences as showed in snapshot below... Still every time firefox restart >>tools/options/general/startup/when firefox starts<< changes back to home page.

I'm on Windows XP, firefox 35.0.1, firewall Avast,...

What are my options here?...

 

[blues_harp28]

i installed and started Malwarebytes Anti-Malware. After scan finished and threats(babylon toolbar and other malware, of which many were more or less; closely connected to internet in general) placed in quarantine

Hi, let us have some Pc specifications.
Check and post
TSG System Information Utility - found here.
http://static.techguy.org/download/SysInfo.exe
======
Download Security Check by screen317 from.
http://screen317.spywareinfoforum.org/
Or
http://www.bleepingcomputer.com/download/securitycheck/dl/123/

Save it to your Desktop.
Double click the install icon.
A command Prompt window will open.
Let it scan the Pc - press any key when asked.
It should now open in Notepad.
Copy and Paste the result of the scan in the reply box below.
======
Start Malwarebytes Anti-Malware again.
Click History > Application Logs.
Select the most recent scan log
Click View.
Select Export >Text File.
Name it mbam > then save it on the desktop.
Copy-and-paste its contents in the reply box below.

Depending on what shows up in the log file - we may need the help of one of our Malware Experts

 

[1niko]

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz, x86 Family 15 Model 2 Stepping 7
Processor Count: 1
RAM: 1279 Mb
Graphics Card: MSI MS-StarForce GeForce4 Ti 4200 with 8X (NVIDIA GeForce4 Ti 4200 with AGP8X), 128 Mb
Hard Drives: C: Total - 16002 MB, Free - 6262 MB; E: Total - 38866 MB, Free - 18733 MB;
Motherboard: ASUSTeK Computer INC., P4G8X
Antivirus: avast! Antivirus, Updated: Yes, On-Demand Scanner: Enabled
____________________________________________________________________

Results of screen317's Security Check version 0.99.95
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
Please wait while WMIC is being installed.d
i
s
p
l
a
y
N
a
m
e
ECHO is off.
a
v
a
s
t
!
ECHO is off.
A
n
t
i
v
i
r
u
s
ECHO is off.
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 31
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 16.0.0.287
Adobe Reader 10.1.0 Adobe Reader out of Date!
Mozilla Firefox (35.0.1)
Google Chrome (40.0.2214.91)
Google Chrome (40.0.2214.93)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 7%
````````````````````End of Log``````````````````````

 

[blues_harp28]

We need to see the Malwarebytes log file.
Start Malwarebytes Anti-Malware again.
Click History > Application Logs.
Select the most recent scan log
Click View.
Select Export >Text File.
Name it mbam > then save it on the desktop.
Copy-and-paste its contents in the reply box below.

 

[1niko]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 27.1.2015
Scan Time: 2:31:16
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.21.01
Rootkit Database: v2015.01.14.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: (X)* Classified by user i.e. me

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 296310
Time Elapsed: 18 min, 59 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 1
PUP.Optional.CrossRider.A, HKU\S-1-5-21-1004336348-823518204-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\NEW WINDOWS\ALLOW|*.crossrider.com, CR, Quarantined, [242d639479108aac2f7d6f824bb93ac6]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

[blues_harp28]

Download Superantispyware to your desktop.
Download the Free version.
SuperAntiSpyware

Click on the install icon - allow it to update during the install process.
Select the Quick Scan option.
Click Scan your Computer.
Any infections or problems will be highlighted in red.
After the scan is finished.
Click Continue.
Check that everything is listed.
Click Remove Threats.
Click OK - then click Finish
You may be prompted to restart to finish the removal process.
If Yes - restart your Pc.

Start SuperAntiSpyware again.
Click View Scan Logs.
Highlight the scan log entry.
Click - View Selected Log.
The scan log will appear in Notepad.
Copy and paste in your next post.
======
Download AdwCleaner by Xplode to your desktop.
http://www.bleepingcomputer.com/download/adwcleaner/
Click on the Download Now @BleepingComputer button and save it to your desktop.

NOTE: If using Internet Explorer and you get an alert that stops the program downloading click on Smartscreen Filter > Turn off Smartscreen Filter then click on OK in the box that opens. Then click on the link again.

Close any browsers that may be open - double click on the ADWCleaner icon on your desktop
Click on the Scan button.
Let it scan your Pc - when that is done click on the Report button.
The report will appear on your desktop - Copy and Paste it into your next post.

 

[1niko]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/30/2015 at 00:03 AM

Application Version : 6.0.1170
Database Version : 11730

Scan type : Quick Scan
Total Scan Time : 00:03:06

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 406
Memory threats detected : 0
Registry items scanned : 29420
Registry threats detected : 16
File items scanned : 4327
File threats detected : 64

PUP.BabylonToolbar
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}#AppID
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\InprocServer32
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\InprocServer32#ThreadingModel
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\ProgID
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\Programmable
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\TypeLib
HKCR\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\VersionIndependentProgID
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}#AppID
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\InprocServer32
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\InprocServer32#ThreadingModel
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\ProgID
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\Programmable
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\TypeLib
HKCR\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\VersionIndependentProgID

Adware.Tracking Cookie
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
in.getclicky.com [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.sussex.ac.uk [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.sussex.ac.uk [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.sussex.ac.uk [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.easycounter.com [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
.googleadservices.com [ C:\DOCUMENTS AND SETTINGS\DARKO\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UHNYCCO0.DEFAULT\COOKIES.SQLITE ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /2o7 ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /ad.wsod ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /ad.yieldmanager ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /adbrite ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /ads.p161 ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /ads.pubmatic ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /ads.yahoo ]
.divx.112.2o7.net [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.server.cpmstar.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /adtech ]
.advertising.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.advertising.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smartadserver.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtech.de [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.at.atwola.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atdmt.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.track306.info [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.amazon-adsystem.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.interclick.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.interclick.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.interclick.com [ C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /apmebf ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /atdmt ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /c.atdmt ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /content.yieldmanager ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /doubleclick ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /fastclick ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /interclick ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /msnportal.112.2o7 ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /questionmarket ]
C:\Documents and Settings\darko\Cookies\[email protected][2].txtC:\Documents and Settings\darko\Cookies\[email protected][2].txt [ /ru4 ]
C:\Documents and Settings\darko\Cookies\[email protected][1].txtC:\Documents and Settings\darko\Cookies\[email protected][1].txt [ /server.cpmstar ]

Trojan.Agent/Gen-Obfuscated
C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\X97QDIJ2\TORNTV2PACK[1].EXE

============================
Unwanted Programs Detected
============================
Babylon Toolbar
Generic PUP
Funmoods Toolbar
Delta Toolbar

============
End of Log
============

 

[1niko]

# AdwCleaner v4.109 - Report created 30/01/2015 at 00:58:59
# Updated 24/01/2015 by Xplode
# Database : 2015-01-26.1 [Live]
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : darko - ROBOT
# Running from : C:\Documents and Settings\darko\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\Premium
Folder Deleted : C:\Documents and Settings\All Users\Application Data\SecTaskMan
Folder Deleted : C:\Documents and Settings\All Users\Application Data\codeccheck
Folder Deleted : C:\Documents and Settings\darko\Local Settings\Application Data\PackageAware
Folder Deleted : C:\Documents and Settings\darko\Local Settings\Application Data\SecTaskMan
Folder Deleted : C:\Documents and Settings\darko\Local Settings\Application Data\CrashRpt
File Deleted : C:\WINDOWS\system32\roboot.exe
File Deleted : C:\Documents and Settings\darko\Application Data\Mozilla\Firefox\Profiles\uhnycco0.default\invalidprefs.js
File Deleted : C:\Documents and Settings\darko\Application Data\Mozilla\Firefox\Profiles\uhnycco0.default\user.js

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Documents and Settings\darko\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B6EF6C45-5E8D-4C3B-B580-A5073261A381}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B6EF6C45-5E8D-4C3B-B580-A5073261A381}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\Headlight
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\Tune
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\SupDp
Key Deleted : HKLM\SOFTWARE\systweak
Key Deleted : HKLM\SOFTWARE\Tune
Key Deleted : HKLM\SOFTWARE\Uniblue
Key Deleted : HKLM\SOFTWARE\TornTv Downloader
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftonicAssistant
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


-\\ Google Chrome v40.0.2214.93

[C:\Documents and Settings\darko\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421448391&from=ild&uid=ST380011A_5JV0L0JV&q={searchTerms}
[C:\Documents and Settings\darko\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421448391&from=ild&uid=ST380011A_5JV0L0JV&q={searchTerms}

*************************

AdwCleaner[R0].txt - [5710 octets] - [30/01/2015 00:42:22]
AdwCleaner[S0].txt - [5879 octets] - [30/01/2015 00:58:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5939 octets] ##########

 

[blues_harp28]

Run AdwCleaner again - Scan > Clean and then post the latest log file.
===
Download Junkware Removal Tool
http://www.bleepingcomputer.com/download/junkware-removal-tool/

Temporarily shutdown your anti-virus to avoid any conflicts.
http://www.bleepingcomputer.com/for...nti-virus-firewall-and-anti-malware-programs/
Be sure to enable the anti-virus program after the scan.

Right-mouse click JRT.exe and select Run as administrator (If using XP just double click on the icon to run it.)
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

[1niko]

# AdwCleaner v4.109 - Report created 30/01/2015 at 14:58:59
# Updated 24/01/2015 by Xplode
# Database : 2015-01-26.1 [Live]
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : darko - ROBOT
# Running from : C:\Documents and Settings\darko\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


-\\ Google Chrome v40.0.2214.94


*************************

AdwCleaner[R0].txt - [5710 octets] - [30/01/2015 00:42:22]
AdwCleaner[R1].txt - [920 octets] - [30/01/2015 14:44:18]
AdwCleaner[S0].txt - [6019 octets] - [30/01/2015 00:58:59]
AdwCleaner[S1].txt - [842 octets] - [30/01/2015 14:58:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [901 octets] ##########

 

[1niko]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Microsoft Windows XP x86
Ran by darko on pet 30.01.2015 at 21:04:38,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\darko\Application Data\getrighttogo"





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on pet 30.01.2015 at 21:15:33,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[blues_harp28]

SUPERAntiSpyware Scan Log

Trojan.Agent/Gen-Obfuscated
C:\DOCUMENTS AND SETTINGS\DARKO\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\X97QDIJ2\TORNTV2PACK[1].EXE

http://www.shouldiremoveit.com/TornTV-7061-program.aspx
No need to download the 'Should I Remove it' tool advertised.
======
Post a Hijack this log to see what is running on your Pc.
Hijack this 2.05

• Save HJTInstall.exe to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Also post the Uninstall Log from Hjt log
Start HijackThis.
At the bottom right hand corner under - Others stuff.
Click on Config.
Then Misc.
Then Uninstall Manager.
Save List > paste the list in your next post.

 

[1niko]

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 2:10:42, on 31.1.2015
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

FIREFOX: 35.0.1 (x86 en-US)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\DWL-G122_DWA-110\AirGCFG.exe
C:\WINDOWS\system32\ANIWConnService.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
E:\PROGRAMS\Mozila firefox 4\firefox.exe
C:\Documents and Settings\darko\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless G DWL-G122_DWA-110] C:\Program Files\D-Link\DWL-G122_DWA-110\AirGCFG.exe
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYAMABLAE0AQwAtAEUAOQBWAFUAVwAtAEUAVwAwAFYAQQAtAFUAVQAzAFgATAAtAEYARQBXADkANwA"&"inst=NwA3AC0ANgA0ADQANgAyADIAMQA4ADkALQBGAEwAKwA5AC0AWABPADkAKwAxAC0AWABPADMANgArADEALQBEAEQAVAArADAA"&"prod=90"&"ver=9.0.901
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Wisdom-soft ScreenHunter 5.1 Plus] 0
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: ANIWConn Service (ANIWConnService) - Unknown owner - C:\WINDOWS\system32\ANIWConnService.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5664 bytes

 

[1niko]

Adobe AIR
Adobe AIR
Adobe Flash Player 15 ActiveX
Adobe Flash Player 16 NPAPI
Adobe Reader X (10.1.0)
ANIO Service
ANIWZCS2 Service
Applian FLV and Media Player 3.1.1.12
ASUS Probe V2.19.00
Avance AC'97 Audio
Avast Free Antivirus
Bible Mapper 3
Brain Workshop 4.8.4
Dev-C++
DivX Setup
D-Link Wireless G DWL-G122_DWA-110
Englesko-hrvatski rjecnik
Free File Opener v2011.7.0.1
Google Chrome
Google Update Helper
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Image Inc. 1.2
Intel Application Accelerator
IrfanView (remove only)
Java 8 Update 31
Magic Uneraser 3.1
Malwarebytes Anti-Malware version 2.0.4.1028
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 35.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 8
NVIDIA Windows 2000/XP Display Drivers
RAR Opener version 1.0
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2850851)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
Snappy 1.5.3
SpellForce
SUPERAntiSpyware
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2749655)
Update for Windows XP (KB2904266)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.6195
VLC media player
Windows Internet Explorer 8
Windows Media Format Runtime
WinRAR 5.10 beta 4 (32-bit)

 

[1niko]

I also deleted sessionstore.js from Firefox\Profiles\uhnycco0.default as recommended somewhere else, even considered "Refresh Firefox" option but "However, your extensions and themes will be removed and your preferences will be reset" - was undesirable outcome to me.

Than just now, after last win. restart I noticed that my last session tabs opened automatically just fine. So i think it is solved.
Thank you for your time blues harp28.

But another thing happen, notification area on the taskbar become problematic.
Some icons lost appearance, some stopped showing in taskbar at all, hide/show options changed seemingly random and windows-task-manager lost ability to minimize on notification area, instead when minimized just disappears.

Any thought about what might caused that?