I cannot runIE or any .exe files on my laptop

Hi , Hopefully you guys can help me out, As of 02-18-2011 , i can no longer access the internet of any other programs on my computer , every program i click generates a message saying "do you want to run or save this file" , no matter what choice I make either RUN or SAVE I immediatly get the same message again. i cannot run anything on the computer so I cannot do a scan , i cannot download and run HIJACK THIS. Right now I am completely stuck I even tried to run some programs in SAFEMODE and they would also not run , I received the same massage "do you want to run or save this file" again. I was also getting this message when i tried go to a link: "This file does not have a program associated with it for performing this action. Create an associaton in the Set Associations control panel." Please help me with this problem . thank you Sam

Hello babbagene and

My name is JonTom

• Malware Logs can sometimes take a lot of time to research and interpret.
  
• Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  
• Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  
• PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

If you are unable to connect to the internet with the infected machine you will need to find a clean machine to download the requried tools. Once downloaded, transfer them to the infected system by burning them to disk/using a USB thumb drive.

If you choose to use a thumb drive for the transfer, and if the clean system runs on XP, please download and run the following tool first to reduce the chances of cross infection:

• Please download Flash Disinfector
  
  
  
  • Click here to download Flash Disinfector and save the file (called Flash_Disinfector.exe) to your desktop.
  • Double click on the Flash_Disinfector.exe icon to run the program and follow any prompts that may appear.
  • The program may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so if prompted.
  • Wait until Flash disinfector has finished scanning and then exit the program.
  • Reboot your computer.
  
  If the clean system runs on Vista/Win7, use this one:
  
  
• AutoRun Eater
  
  
  
  • Dowlnload Autorun Eater and save it to your desktop.
  • Plug all of your removable storage devices into the machine (USB sticks etc) and run the tool.
  
  Download and transfer the following to the infected machine:
  
  
• rkill
  
  
  
  • Please download rkill (Courtesy of Bleepingcomputer.com).
  • There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
  • Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
  • Note: You only need to get one of the tools to run, not all of them.
  
  
  1. rkill.exe
  2. rkill.com
  3. rkill.scr
  4. WiNlOgOn.exe
  5. uSeRiNiT.exe
  
  Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.
  
  Run rkill repeatedly until it's able to do it's job. This may take a few tries.
  
  You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.
  
• Please perform the following scan
  
  
  
  • Please download DDS from here and save it to your desktop.
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Right click on the DDS icon and select "Run as Administrator" to run the tool (may take up to 3 minutes to run).
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
  • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.
  
  
• Please scan your system with GMER
  
  
  [external image: Posted Image]
  Download GMER Rootkit Scanner from here or here.
  
  • Extract the contents of the zipped file to desktop.
  • Right click on GMER.exe and select "Run as Administrator" to run the program. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please post the DDS logs and GMER log in your next reply. If you have any touble with the scans let me know.

Hi Jon Tom , thank you for your assistance , i will download the programs the cd using a working computer,at that point i need to load them into the infected computer ,correct? i will post when I have completed this step . Thank you so much regards Sam

I have downloaded autoruneater and rkill to my desktop on my windows 7 working computer,i am not clear on what i need to do next, I do NOT hace a usb thumb device , can i just burn the programs onto a cd-rw, if so can you guide me. Thank you Sam PS-I did not run any of the programs on the working computer

Hello babbagene

Autorun Eater is only needed if you are going to use a USB Thumb drive to transfer the required tools to the infected machine.

As you do not have a thumb drive handy you do not need to worry about autorun eater

i am not clear on what i need to do next
can i just burn the programs onto a cd-rw, if so can you guide me.

Burning disks is certainly possible, just a little less convenient than using a thumb drive. Lets give it a try:


Download all of the different versions of rkill to your Win7 desktop, then download DDS and GMER in the same way. Make sure that they are all on your desktop (so you can find them easily).

Once you have downloaded the tools, you need to copy (burn) them to disk (Note: You must have a drive capable of burning information to a CD in order to create the disk).

You may already have software installed that can do this for you (such as nero for example).

Some general information about how to burn a disk can be found here.


If the infected machine runs on vista/XP, it may be better to Choose the Mastered format method rather than the Live File format method for the disk you create (instructions are provided in the link).

Once the required tools have been burned to disk, put the disk in the infected system and copy the programs to the desktop.

Begin with rKill (instructions provided previously), then follow with DDS and GMER.

When the DDS logs and GMER logs are produced make sure you save them. If you are unable to connect to the internet using the infected system you will need to burn the log files and post the back here from your Win7 machine.

If the infected system does not have a CD burner (or if the malware on the machine prevents you from using it) we will need to get hold of a thumb drive.

Give the above a try and let me know how you get on

Hello babbagene

Thank you for the log. Lets see if we can get GMER to run this way:

• GMER
  
  
  
  • If you are having trouble getting GMER to complete a scan, please run it again, but this time uncheck everything EXCEPT "Sections" and "C:\".
  • If GMER does not produce a log please try running it from Safe Mode.
  
  
  • How to use the F8 method to Start Your Computer in Safe Mode
  
  
  • Restart your computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
  • Use the arrow keys to select the Safe mode menu item.
  • Press Enter.
  
  
  • If GMER in safe mode does not work, please try Rootkit Unhooker:
  
  
• Rootkit Unhooker
  
  
  
  • Please Download Rootkit Unhooker and Save it to your desktop.
  • Right click on RKUnhookerLE.exe and select "Run as administrator" to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth. Uncheck the rest, then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
  
  Copy the entire contents of the report and paste it in your next reply here.
  
  Note: You may get the following warning, just click OK and continue.
  
  "Rootkit Unhooker has detected a parasite inside itself!
  It is recommended to remove parasite, okay?"
  
  Please provide the GMER/Rootkit Unhooker log in your next reply. If you are still having trouble, come back and let me know.

I tried as you said , but neither program will run, I cannot run any exe files . As soon as I start my infected computer up it goes thru 17 programs with each one giving the message 'File Download -security Warning: here are the 17 programsthat seem to be trying to open at startup: RtHDVCpl.exe wmpnscfg.exe nmapp.exe HPAdvisor.exe ehtray.exe Qttask.exe kbdStub.exe MSASCui.exe nmctxth.exe hpwuSchd2.exe realsched.exe cdloader2.exe rundll32.exe hpsysdrv.exe AdobeARM.exe reader_sl.exe rundll32.exe Each of the above happen at each startup ,and whethet i choose to RUN or SAVE , it does not matter ,they never load I justy get taken back to the original Security Warning Message. i really cannot seem to rum anything on the infected computer evn in the Safemode option. Regards Sam I recently ran CCCleaner and cleaned registry and then also ran Eusing Free registry Cleaner and cleaned registry (however I did not back it up)DUMB!! However the computer seemed to work aFTER THOSE ACTIONS WERE TAKEN ,But I am not positive.

Hello babbagene

I cannot run any exe files

The malware on your system is interfering with our tools. Lets see of the following helps:

• exeHelper
  
  
  
  • Please download exeHelper by clicking here and save the file (called exeHelper.com) to your desktop.
  • Double click on exeHelper.com to run the fix.
  • A black window should pop up. Press any key to close once the fix is completed.
  • Post the contents of log.txt (it Will be created in the directory where you ran exeHelper.com).
  • NOTE: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).
  
  After running exeHelper, please try to run GMER (.exe file) again. If you are still unable to open any .exe files after trying exeHelper we shall have to try a different scan:
  
  
• Download and run OTL by Oldtimer
  
  
  
  • Please download OTL by Oldtimer by clicking here and save the file (called OTL.scr) to your desktop.
  • Close all open windows on your computer then Double click on the OTL.scr icon to run the program.
  • Check the boxes beside "LOP Check" and "Purity Check".
  • Under Custom Scan paste this in:
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\drivers\*.sys /90
  CREATERESTOREPOINT
  
  
  
  • Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.
  
  
  • When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
  • Note: These logs can be located in the OTL folder on you C:\ drive if they fail to open automatically.
  • Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.

Hello babbagene

Glad you managed to get OTL running

I was still not able to run GMER

It looks as though exeHelper has fixed your damaged file associations……could you clarify something for me please? When you say that GMER would not run, did it open and crash, or were you simply unable to open the program?

• Please open OTL
  
  
  • Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
    
    

    :OTL
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
    O2 - BHO: (IEHlprObj Class) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\Program Files\iWin Games\iWinGamesHookIE.dll (iWin Inc.)
    O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    O2 - BHO: (no name) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
    O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
    O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
    O4 - HKCU..\RunOnce: [Shockwave Updater] File not found
    O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} http://www.vexcast.com/download/vexcast.cab (Reg Error: Key error.)
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll ()
    O33 - MountPoints2\{95c3256d-58b0-11de-8530-002215259706}\Shell\AutoRun\command - "" = K:\autorun.exe
    O33 - MountPoints2\{95c3256d-58b0-11de-8530-002215259706}\Shell\phone\command - "" = K:\autorun.exe
    O33 - MountPoints2\{bf5b52fe-7e09-11de-b990-002215259706}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe WillPolo.vbs
    O33 - MountPoints2\{d1bcce71-5a07-11de-9eae-002215259706}\Shell\AutoRun\command - "" = L:\RUNDLL32.EXE
    O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\autorun.exe
    O33 - MountPoints2\K\Shell\phone\command - "" = K:\autorun.exe
    [2011/02/17 19:14:59 | 000,000,120 | —- | M] () – C:\Users\babbagene\AppData\Local\Hxozuyoya.dat
    [2011/02/17 19:14:59 | 000,000,000 | —- | M] () – C:\Users\babbagene\AppData\Local\Llirahu.bin
    [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
    @Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:71FA8B7F
    @Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:84151293
    @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:50DD4118
    @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:7B125E06
    @Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:FED25C29
    @Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:737160C1
    @Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:0E22C5DB
    @Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:6F0B6A5A
    @Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:D48500F8
    @Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:CA0CE093
    @Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:848CC150
    @Alternate Data Stream - 201 bytes -> C:\ProgramData\TEMP:69AF9D20
    @Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:260575F1
    @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:BF6C81B2
    @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:35FAD15D
    @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:588B60C7
    @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:2495D97A
    @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:61B54B15
    @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:91FFEC32
    @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:B8EB1B99
    @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:32A82570
    @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:F84B8DB5
    @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:F216755A
    @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:96646EC1
    @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:C76CFF82
    @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:A02025CE
    @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:40EE25BB
    @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:A8C08E7E
    @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:0FA1EAA7
    @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:5CE91C67
    @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:206470A5
    @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:D8D58038
    @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:89C6F032
    @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:19C3BC3A
    @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:D563DFD3
    @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A774141A
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E0AE69BE
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:BE40C8A2
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:BDCD8531
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:5AF0DC60
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:268BA8AB
    @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8DED4A5E
    @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:EB42AC3C
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FC2D0F32
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:50636E35
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:29629382
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:0AC32449
    @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:73AFBB96
    @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:02387389
    @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:8776F88E
    @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:68EF6203
    @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D34167E3
    @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:2342AE46
    @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:24FECE50
    @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:D31BE97C
    @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B6FD7157
    @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:38F6DFA8
    @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C10DE48F
    @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:A4BF246C
    @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:726D640A
    @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:E51234A9
    @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:114BD271
    
    :Files
    C:\Program Files\vShare
    
    :Commands
    [purity]
    [emptytemp]
    [emptyflash]
    [start explorer]
    [Reboot]

  • Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
  • Allow the program to run unhindered.
  • Your machine will re-start itself. This is normal.
  • A log will be created after your machine reboots. Please post the contents of the log in your next reply.
  
  Lets check to see if the following program will run:
  
  
• MalwareBytes AntiMalware:
  
  
  
  • I can see that you have MBAM installed.
  • Double click on your MalwareBytes AntiMalware icon to launch the program.
  • Click on the "Update" tab and then on "Check for Updates".
  • The program will now install the latest Malware definition files.
  • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
  • Once the program has scanned your computer, a log file will be created in Notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  
  
  
  • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
  • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
  • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
  • Come back here to this thread and Paste the log in your next reply.
  
  Please post the OTL log and the MBAM log in your next reply.
  
  If MBAM will not open please let me know.

Hi, as far as GMER not being able to run , i mean the program simply would not open ,i think cause it was a ZIp file or because it was an EXE file. i am now continuing with the further streps that you instructed me. Thank you Sam

hi I ran the OTL Scan and was able to get a LOG for you , however after the reboot I was still not able to run any programs. Here is the Logfile: All processes killed ========== OTL ========== No active process named explorer.exe was found! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully. C:\Program Files\vShare\vshare_toolbar.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\ deleted successfully. C:\Program Files\iWin Games\iWinGamesHookIE.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found. File C:\Program Files\vShare\vshare_toolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{9D425283-D487-4337-BAB6-AB8354A81457} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found. File C:\Program Files\vShare\vshare_toolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HP Health Check Scheduler deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater deleted successfully. Starting removal of ActiveX control {D4003189-95B1-4A2F-9A87-F2B03665960D} C:\Windows\Downloaded Program Files\vjocx.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D4003189-95B1-4A2F-9A87-F2B03665960D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D4003189-95B1-4A2F-9A87-F2B03665960D}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\ not found. Starting removal of ActiveX control {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} C:\ProgramData\webex\ieatgpc.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ not found. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. File C:\Program Files\vShare\vshare_toolbar.dll not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome\ deleted successfully. File C:\Program Files\vShare\vshare_toolbar.dll not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{95c3256d-58b0-11de-8530-002215259706}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95c3256d-58b0-11de-8530-002215259706}\ not found. File K:\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{95c3256d-58b0-11de-8530-002215259706}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95c3256d-58b0-11de-8530-002215259706}\ not found. File K:\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf5b52fe-7e09-11de-b990-002215259706}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf5b52fe-7e09-11de-b990-002215259706}\ not found. File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe WillPolo.vbs not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d1bcce71-5a07-11de-9eae-002215259706}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d1bcce71-5a07-11de-9eae-002215259706}\ not found. File L:\RUNDLL32.EXE not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ deleted successfully. File K:\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ not found. File K:\autorun.exe not found. C:\Users\babbagene\AppData\Local\Hxozuyoya.dat moved successfully. C:\Users\babbagene\AppData\Local\Llirahu.bin moved successfully. C:\Windows\System32\SETDB1D.tmp deleted successfully. C:\Windows\System32\SETE235.tmp deleted successfully. C:\Windows\msdownld.tmp folder deleted successfully. ADS C:\ProgramData\TEMP:71FA8B7F deleted successfully. ADS C:\ProgramData\TEMP:84151293 deleted successfully. ADS C:\ProgramData\TEMP:50DD4118 deleted successfully. ADS C:\ProgramData\TEMP:7B125E06 deleted successfully. ADS C:\ProgramData\TEMP:FED25C29 deleted successfully. ADS C:\ProgramData\TEMP:737160C1 deleted successfully. ADS C:\ProgramData\TEMP:0E22C5DB deleted successfully. ADS C:\ProgramData\TEMP:6F0B6A5A deleted successfully. ADS C:\ProgramData\TEMP:D48500F8 deleted successfully. ADS C:\ProgramData\TEMP:CA0CE093 deleted successfully. ADS C:\ProgramData\TEMP:848CC150 deleted successfully. ADS C:\ProgramData\TEMP:69AF9D20 deleted successfully. ADS C:\ProgramData\TEMP:260575F1 deleted successfully. ADS C:\ProgramData\TEMP:BF6C81B2 deleted successfully. ADS C:\ProgramData\TEMP:35FAD15D deleted successfully. ADS C:\ProgramData\TEMP:588B60C7 deleted successfully. ADS C:\ProgramData\TEMP:2495D97A deleted successfully. ADS C:\ProgramData\TEMP:61B54B15 deleted successfully. ADS C:\ProgramData\TEMP:91FFEC32 deleted successfully. ADS C:\ProgramData\TEMP:B8EB1B99 deleted successfully. ADS C:\ProgramData\TEMP:32A82570 deleted successfully. ADS C:\ProgramData\TEMP:F84B8DB5 deleted successfully. ADS C:\ProgramData\TEMP:F216755A deleted successfully. ADS C:\ProgramData\TEMP:96646EC1 deleted successfully. ADS C:\ProgramData\TEMP:C76CFF82 deleted successfully. ADS C:\ProgramData\TEMP:A02025CE deleted successfully. ADS C:\ProgramData\TEMP:40EE25BB deleted successfully. ADS C:\ProgramData\TEMP:A8C08E7E deleted successfully. ADS C:\ProgramData\TEMP:0FA1EAA7 deleted successfully. ADS C:\ProgramData\TEMP:5CE91C67 deleted successfully. ADS C:\ProgramData\TEMP:206470A5 deleted successfully. ADS C:\ProgramData\TEMP:D8D58038 deleted successfully. ADS C:\ProgramData\TEMP:89C6F032 deleted successfully. ADS C:\ProgramData\TEMP:19C3BC3A deleted successfully. ADS C:\ProgramData\TEMP:D563DFD3 deleted successfully. ADS C:\ProgramData\TEMP:A774141A deleted successfully. ADS C:\ProgramData\TEMP:E0AE69BE deleted successfully. ADS C:\ProgramData\TEMP:BE40C8A2 deleted successfully. ADS C:\ProgramData\TEMP:BDCD8531 deleted successfully. ADS C:\ProgramData\TEMP:5AF0DC60 deleted successfully. ADS C:\ProgramData\TEMP:268BA8AB deleted successfully. ADS C:\ProgramData\TEMP:8DED4A5E deleted successfully. ADS C:\ProgramData\TEMP:EB42AC3C deleted successfully. ADS C:\ProgramData\TEMP:FC2D0F32 deleted successfully. ADS C:\ProgramData\TEMP:50636E35 deleted successfully. ADS C:\ProgramData\TEMP:29629382 deleted successfully. ADS C:\ProgramData\TEMP:0AC32449 deleted successfully. ADS C:\ProgramData\TEMP:73AFBB96 deleted successfully. ADS C:\ProgramData\TEMP:02387389 deleted successfully. ADS C:\ProgramData\TEMP:8776F88E deleted successfully. ADS C:\ProgramData\TEMP:68EF6203 deleted successfully. ADS C:\ProgramData\TEMP:D34167E3 deleted successfully. ADS C:\ProgramData\TEMP:2342AE46 deleted successfully. ADS C:\ProgramData\TEMP:24FECE50 deleted successfully. ADS C:\ProgramData\TEMP:D31BE97C deleted successfully. ADS C:\ProgramData\TEMP:B6FD7157 deleted successfully. ADS C:\ProgramData\TEMP:38F6DFA8 deleted successfully. ADS C:\ProgramData\TEMP:C10DE48F deleted successfully. ADS C:\ProgramData\TEMP:A4BF246C deleted successfully. ADS C:\ProgramData\TEMP:726D640A deleted successfully. ADS C:\ProgramData\TEMP:E51234A9 deleted successfully. ADS C:\ProgramData\TEMP:114BD271 deleted successfully. ========== FILES ========== C:\Program Files\vShare\skin folder moved successfully. C:\Program Files\vShare\radio folder moved successfully. C:\Program Files\vShare folder moved successfully. File\Folder :Commands not found. File\Folder [purity] not found. File\Folder [emptytemp] not found. File\Folder [emptyflash] not found. File\Folder [start explorer] not found. File\Folder [Reboot] not found. OTL by OldTimer - Version 3.2.20.6 log created on 02212011_202009 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

Hello babbagene

Thank you for the log.

i think cause it was a ZIp file or because it was an EXE file

Most likely because it is an executable (.exe) file. Lets see if we can reset your file associations:

• SREng
  
  
  
  • Download SREng from here.
  • Extract it to Desktop and double click SREngLdr.EXE to run it (NOTE: you may need to rename it to SREng.com)
  • Select System Repair from the left pane.
  • Click on File Association.
  • Select all entries that have an Error status click [Repair].
  • Refer to this image for an example:
    
    [external image: Posted Image]
  • Close SREng.
  
  If the associations are able to be repaired you will be able to follow with ComboFix:
  
  
• Combofix
  
  
  
  • Download ComboFix from one of the following locations:
    
    Link 1
    Link 2
  
  
  • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
  
  
  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
  • Double click on ComboFix.exe & follow the prompts.
  
  
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
  
  [external image: Posted Image]
  
  
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  [external image: Posted Image]
  
  
  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  • Should there be issues with internet afterward:
    
    In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.
    
    In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.