Hi,
Please click
Start >>
Control Panel >>
Add/Remove Programs. Find the following item on the list and click
Remove.
Java™ SE Runtime Environment 6 Update 1
Open
Windows Defender.
Click on
Tools, General Settings.
Scroll down and uncheck
Turn on real-time protection (recommended).
After you uncheck this, click on the
Save button and close Windows Defender.
After all of the fixes are complete it is very important that you enable Real-time Protection again.
Please
download OTMoveIt3 by OldTimer.
- Save it to your desktop.
- Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
- Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"=-
"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"=-
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=-
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=-
"{C4069E3A-68F1-403E-B40E-20066696354B}"=-
"{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars]
"{32683183-48a0-441b-a342-7c2a440a9478}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SysWin"=-
[-HKEY_CLASSES_ROOT\{6a950a63-e31f-4794-8ddb-858ab1755a2d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=-
:Commands
[emptytemp]
[Reboot]
- Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
- Click the red Moveit! button.
- Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
- Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose
Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter
*.log and press the Enter key, navigate to the
C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
We need to upload a file to
Jotti
1. Click
HERE to get to Jotti's site.
2. At the top of the Jotti window, use the
Browse button to locate the following file on your system:
C:\WINDOWS\fonts\wfonts.key
3. Once you have located the file, click
SUBMIT and the content of the file will be uploaded by the site and analysed.
4. Please provide me with the results of the analysis.
Download the
GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click
gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
- Click NO
- In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
- Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity. - Click OK.
- GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
- Save it where you can easily find it, such as your desktop.
Post the contents of GMER.txt in your next reply. Please post a new DDS log as well (just DDS.txt).
Thanks.
