August 17th, 2010, 08:15 PM
#61
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 08:35 PM
#62
Please, always paste all logs into your reply. If it doesn't fit, split it between couple of posts.Combofix :Start > Run [Vista users, go Start>"Start search"]Combofix /Uninstall Note the space between the "Combofix" and the "/Uninstall" OTL Custom Scan box paste this in:Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt . These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy ) the contents of these files, one at a time, and post them back here.
August 17th, 2010, 09:23 PM
#63
========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== www.yahoo.com ========== FireFox ========== [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 09:24 PM
#64
OTL logfile created on: 8/17/2010 10:56:38 PM - Run 2========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== www.yahoo.com ========== FireFox ========== [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 09:32 PM
#65
========== Internet Explorer ========== www.yahoo.com ========== FireFox ========== [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 09:34 PM
#66
I know I kind of butchered that up, but as you are well aware by now I'm not exactly a whiz at this...
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 09:38 PM
#67
Please, attach the file and I'll post it for you
August 17th, 2010, 09:40 PM
#68
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 09:44 PM
#69
No worries ========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== www.yahoo.com ========== FireFox ========== [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
August 17th, 2010, 09:45 PM
#70
O1 HOSTS File: ([2010/08/17 20:22:02 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostswww.update] http in Trusted sites)http://download.microsoft.com/downlo...eckControl.cab (Windows Genuine Advantage Validation Tool)http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)http://download.bitdefender.com/reso...an8/oscan8.cab (BDSCANONLINE Control)http://www.nero.com/doc/NeroVersionCheckerControl.cab (NeroVersionCheckerControl Control)http://www.acclaim.com/cabs/acclaim_v5.cab (GameLauncher Control)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_11)http://cdn.digitalcity.com/radio/amp...1.11_en_dl.cab (IWinAmpActiveX Class)http://www.cvsphoto.com/upload/activ...eX_Control.cab (Photo Upload Plugin Class)http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Java Plug-in 1.5.0)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_07)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_11)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_11)http://fpdownload2.macromedia.com/ge...nt/swflash.cab (Shockwave Flash Object)
August 17th, 2010, 09:46 PM
#71
Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)========== Files/Folders - Created Within 90 Days ========== ========== Files - Modified Within 90 Days ==========
August 17th, 2010, 09:46 PM
#72
========== Files Created - No Company Name ========== ========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < > < > < > < %SYSTEMDRIVE%\*.* > < %systemroot%\system32\Spool\prtprocs\w32x86\*.dll > < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > < %systemroot%\Fonts\*.dll > < %systemroot%\system32\spool\prtprocs\w32x86\*.tmp > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll< %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\user32.dll /md5 > < %systemroot%\system32\ws2_32.dll /md5 > < %systemroot%\system32\ws2help.dll /md5 > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > ========== Alternate Data Streams ==========
August 17th, 2010, 09:52 PM
#73
Uninstall Uniblue Registry Booster http://miekiemoes.blogspot.com/2008/...eaking_13.html Java version here: http://www.java.com/en/download/installed.jsp Note 1 : UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.Note 2 : The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.JavaRa Run JavaRa.exe (Vista users! Right click on JavaRa.exe , click Run As Administrator ), pick the language of your choice and click Select. Then click Remove Older Versions . Accept any prompts. Under the Custom Scans/Fixes
Code:
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
O2 - BHO: (TBSB05974 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Search Toolbar\tbcore3.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
O4 - HKCU..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe (Uniblue Systems Limited)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O33 - MountPoints2\{0aa8d410-c8ec-11dd-bceb-001e90bea03a}\Shell\AutoRun\command - "" = E:\StartPortableApps.exe -- File not found
O33 - MountPoints2\{611668f8-e266-11de-8aa7-001e90bea03a}\Shell - "" = AutoRun
O33 - MountPoints2\{611668f8-e266-11de-8aa7-001e90bea03a}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{611668f8-e266-11de-8aa7-001e90bea03a}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{a1cf75d5-0ab4-11de-89e5-001e90bea03a}\Shell - "" = AutoRun
O33 - MountPoints2\{a1cf75d5-0ab4-11de-89e5-001e90bea03a}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a1cf75d5-0ab4-11de-89e5-001e90bea03a}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
[2010/07/01 12:23:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2010/06/29 21:41:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\usxkdalio
[2010/02/13 19:42:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Tim\Application Data\Uniblue
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Tim\My Documents\My Music:Roxio EMC Stream
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FB1B13D8
:Services
:Reg
:Files
C:\Program Files\Uniblue
:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the Run Fix Let the program run unhindered, reboot the PC when it is done You will get a log that shows the results of the fix. Please post it. Security Check from HERE , and save it to your Desktop .Double-click SecurityCheck.exe Follow the onscreen instructions inside of the black box. A Notepad document should open automatically called checkup.txt ; please post the contents of that document. Temp File Cleaner (TFC) Double click on TFC.exe to run the program. Click on Start button to begin cleaning process. TFC will close all running programs, and it may ask you to restart computer. Kaspersky website and perform an online antivirus scan.Disable your active antivirus program. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run . When the downloads have finished, click on Settings . Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan . Once the scan is complete, it will display the results. Click on View Scan Report . You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
Last edited by Broni; August 17th, 2010 at 10:15 PM .
August 17th, 2010, 09:59 PM
#74
Windows 7 Ultimate, Service Pack 1
August 17th, 2010, 10:16 PM
#75
I just edited OTL script, so Registry Booster will be removed automatically.
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
Forum Rules
Reply With Quote
