Windows 7 Enterprise x64
So I made a mistake and ran a dubious executable program downloaded from the internet. I was making a dvd and I didn't know how to download videos from funnyordie.com, so I went out on a limb and tried Wondershare Allmytube. It did what I wanted but it seemed really sketchy and it made my laptop start working so hard that my fan kicked on without any user input, so I turned off the wifi and uninstalled it right away and now I'm paranoid that I'm a part of some botnet or someone's got my saved chrome passwords.
Even after I uninstalled it, there were still files in C:/Program Files (x86)/Common Files/Wondershare, C:/Program Files/Common Files/Wondershare, C:/ProgramData/Wondershare, and there was a .exe on my desktop. I found someone with the same problem on this forum: http://www.smartestcomputing.us.com/topic/71056-wondershare-helper-compact/
The only problem is their solution was specific to that user's machine, and I can't download the fixlist.txt supplied by the admin in this thread to see what he did. However, I did run the Farbar Recovery Scan Tool as this person did, and I found some references to Wondershare in the FRST.txt file.
Under the heading Registry (Whitelisted), I found these lines:
HKLM-x32...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32...\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\AllMyTube\DelayPluginI.exe
Under the heading Internet (Whitelisted), I found this line:
BHO-x32: Wondershare AllMyTube 4.2.0 -> {067DF9EC-26B7-40DC-8DB8-CD8BE85AE367} -> C:\ProgramData\Wondershare\AllMyTube\WSBrowserAppMgr.dll No File
Under the heading Firefox, I found this line:
FF HKLM-x32...\Firefox\Extensions: [[email protected]] - C:\ProgramData\Wondershare\AllMyTube\[email protected]
How do I take all references to Wondershare off of whitelists? It seems like that's a security threat and I'm trying to patch it. (I have also run malwarebytes, and it detected and removed several threats.) Am I looking at this problem the right way?