What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] google redirect

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi -

I have noticed my Google screen change and my computer "slow down" significantly over the past couple of weeks. I also had a "killvirus……something" message that came up on my desktop when I turned on my computer. Was referred to you by my step-mother and we have printed off and followed the instructions for "Are You Infected". Below are the required log files. My step-mother highly recommended you for assistance in rectifying these problems. I am not well versed in computer lingo and hope you can help. Thanks. Heidi

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-12 15:10:34
Windows 5.1.2600 Service Pack 3
Running: yue0oiyi.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\kgndipog.sys


—- Kernel code sections - GMER 1.0.15 —-

? bgho.sys The system cannot find the file specified. !

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001d921b8db9
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001d921b9b7c
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001d921b8db9 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001d921b9b7c (not active ControlSet)

—- EOF - GMER 1.0.15 —-

Malwarebytes' Anti-Malware 1.44
Database version: 3860
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/03/2010 12:16:19 PM
mbam-log-2010-03-12 (12-16-19).txt

Scan type: Quick Scan
Objects scanned: 139938
Time elapsed: 6 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Startpage) -> Bad: (http://goggleonline.blogspot.com/) Good: (http://www.Google.com) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.SearchPage) -> Bad: (http://goggleonline.blogspot.com/) Good: (http://www.Google.com) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\killvirus.vbs) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\V7N19DRZ\ASetup_2024-6[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 15:21:17.37 on 12/03/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.358 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\oopmagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2S1.EXE
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uWindow Title = Microsoft Internet explorer
uStart Page = hxxp://www.Google.com
uSearch Page = hxxp://www.Google.com
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Power2GoExpress] "c:\program files\cyberlink\power2go\Power2GoExpress.exe" /Startup
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [ooquickpdfv7] "c:\windows\system32\oopmagent.exe"
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SMSTray] c:\program files\samsung\samsung media studio 5\SMSTray.exe
mRun: [MAAgent] c:\program files\markany\contentsafer\MAAgent.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QuickFinder Scheduler] "c:\program files\wordperfect office x3\programs\QFSCHD130.EXE"
mRun: [EPSON Stylus C66 Series] c:\windows\system32\spool\drivers\w32x86\3\E_S4I2S1.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\wordperfect office x3\programs\WPLauncher.hta
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1209763109312
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: ShellHook Class: {88485281-8b4b-4f8d-9ede-82e29a064277} - c:\progra~1\markany\conten~1\MACSMA~1.DLL

============= SERVICES / DRIVERS ===============

R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-5-3 39680]
S2 gupdate1c9f3441f12922a;Google Update Service (gupdate1c9f3441f12922a);c:\program files\google\update\GoogleUpdate.exe [2009-6-22 133104]

=============== Created Last 30 ================

2010-03-12 12:00 –d—– c:\docume~1\owner\applic~1\Malwarebytes
2010-03-12 12:00 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-12 12:00 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-03-12 12:00 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-12 12:00 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-03-10 08:05 3,558,912 -c—— c:\windows\system32\dllcache\moviemk.exe
2010-03-08 21:06 –d—– c:\program files\iPod
2010-03-08 21:06 –d—– c:\program files\iTunes
2010-03-08 21:06 –d—– c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-03-08 21:05 –d—– c:\program files\Bonjour
2010-03-08 21:03 2,065,696 a——- c:\windows\system32\usbaaplrc.dll
2010-03-04 18:44 411,368 a——- c:\windows\system32\deploytk.dll
2010-03-04 17:18 –d—– c:\program files\Spybot - Search & Destroy
2010-03-04 17:18 –d—– c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-02-11 08:59 –d—– c:\docume~1\alluse~1\applic~1\Symantec
2010-02-11 08:59 –d—– c:\docume~1\alluse~1\applic~1\Norton
2010-02-11 08:59 –d—– c:\docume~1\alluse~1\applic~1\NortonInstaller
2010-02-10 23:24 –d—– c:\program files\DivX
2010-02-10 23:24 –d—– c:\program files\common files\DivX Shared

==================== Find3M ====================

2010-03-10 10:52 49,664 a——- c:\docume~1\owner\applic~1\wklnhst.dat
2010-01-05 05:00 832,512 a——- c:\windows\system32\wininet.dll
2010-01-05 05:00 78,336 a——- c:\windows\system32\ieencode.dll
2010-01-05 05:00 17,408 ——– c:\windows\system32\corpol.dll
2009-12-16 13:43 343,040 a——- c:\windows\system32\mspaint.exe
2009-12-14 02:08 33,280 a——- c:\windows\system32\csrsrv.dll
2009-04-14 18:36 196,424 a——- c:\docume~1\owner\applic~1\GDIPFONTCACHEV1.DAT
2008-09-10 22:11 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091020080911\index.dat

============= FINISH: 15:21:53.42 ===============

Attachments:

Post #2
Hello heidiho and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back as soon as possible with instructions.
Post #3
heidi,

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (Limewire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. Malware authors use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

I don't see any malware in your logs, but let's run this online scan to be sure nothing is hiding in there:

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]
  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
🖼Click to load external image (Posted Image) Install an anti-virus program. I don't see any anti-virus software running on your computer. Choose one, (but no more) reputable AV program. If you need help chosing one, this site has good information. Avast, AVG, Avira and Microsoft all offer free AV products.

Please include the following in your next post:
  • Kaspersky log
  • What problems are you still having with the computer?
Post #4
Hello again - I have run the Kaspersky Scan and removed Limewire from the computer. I have installed the AVG anti-virus. The "killvirus" that was on the desktop screen when I turned on the computer is now gone. I have Spybot installed. Is it okay to have AVG and Spybot running at the same time. Below is the Kaspersky log. Thanks - Heidiho ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, March 13, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, March 12, 2010 22:48:45 Records in database: 3783152 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 83968 Threats found: 3 Infected objects found: 8 Suspicious objects found: 0 Scan duration: 01:42:41 File name / Threat / Threats count C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\07 Children of the Revolution T-Rex.wma Infected: Trojan-Downloader.WMA.Wimad.v 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\i song kevin rudolf MTV.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\K-OS ft. Sam Roberts - Dirty Water.wma Infected: Trojan-Downloader.WMA.Wimad.v 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\MSTRKRFT - work on you.wma Infected: Trojan-Downloader.WMA.Wimad.y 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\Passion Pit - Sleepyhead.wma Infected: Trojan-Downloader.WMA.Wimad.v 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\T.Rex - Ride A White Swan.wma Infected: Trojan-Downloader.WMA.Wimad.v 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\The Postal Service - Grow Old with Me.wma Infected: Trojan-Downloader.WMA.Wimad.y 1 C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\transcenders MTV.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1 Selected area has been scanned.
Post #5
Heidi,

Let's clean up those infected Limewire downloads, then I have some important cleanup and housekeeping work for you to do:

🖼Click to load external image (Posted Image) Please download OTM
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :files
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\07 Children of the Revolution T-Rex.wma
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\i song kevin rudolf MTV.mp3
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\K-OS ft. Sam Roberts - Dirty Water.wma
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\MSTRKRFT - work on you.wma
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\Passion Pit - Sleepyhead.wma
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\T.Rex - Ride A White Swan.wma
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\The Postal Service - Grow Old with Me.wma
C:\Documents and Settings\Owner\My Documents\LimeWire\Saved\transcenders MTV.mp3
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • When the fix completes, close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 18. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
🖼Click to load external image (Posted Image) Cleanup with OTM
  • Double-click OTM.exe to start the program.
  • Close all other programs apart from OTM as this step will require a reboot
  • On the OTM main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
  • Manually delete any remaining tools or logs from our work
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Avoid using P2P programs! Refer back to my earlier post for more information.
  • Consider running in a limited user account. See this post for more information.
  • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #6
Hello again - Thanks for the last reply. I have done everything you advised. One last question……….I have spybot running and have now downloaded AVG. Can these two be run successfully together? My step-mother has been coming along for the ride with us and is now on her way out the door, so it has been perfect timing. Thanks. Heidiho

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI