MyCleanPC Registry Cleaner & no web access

OK this is going to die - nothing beats me if I can help it

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

On the first tab select all elements down to Computer and then select start scan
Once it has finished select report and post that.

[external image: Posted Image]

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan

Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

[external image: Posted Image]

Just a quick update… I am 32 minutes into Kapersky. Thanks!

since taking the pic i am at 12% and have to leave again at 12:30. *Sigh* Hopefully I won't have to take up your day again.

For me time is not a problem and teatime doubly so

Well, 1:55 in (61%) and still going. I have to run out and will be back around 3:30. I will give an update then.

TA DA!!!!

OK that found it -

• Re-run AVPTool
• Select the Manual Disinfection tab
• Where it states Step 3 paste in the following disinfection script and press execute
  
  

  begin
  SetAVZPMStatus(True);
  SearchRootkit(true, true);
  SetAVZGuardStatus(True);
   DelBHO('{ac417ce4-146b-4c18-a1ca-a2f609af2f9e}');
   DeleteService('Tosrfcom');
   SetServiceStart('Tosrfcom', 4);
   StopService('Tosrfcom');
   BC_DeleteFile('C:\Program Files\Winferno\PC Confidential\PCCL.DLL');
   DeleteFile('C:\Program Files\Winferno\PC Confidential\PCCL.DLL');
   DeleteFile('Tosrfcom.sys');
   BC_DeleteFile('Tosrfcom.sys');
   DeleteFile('C:\Program Files\CyberDefender\Registry Scanner\CDregclean.exe');
   BC_DeleteFile('C:\Program Files\CyberDefender\Registry Scanner\CDregclean.exe');
  BC_ImportDeletedList;
  ExecuteSysClean;
  BC_Activate;
  RebootWindows(true);
  end.

• Your system will reboot on completion, if it does not please do so yourself
• On completion please run another analysis scan and attach the zip file

[external image: Posted Image]

On it like i'm usually on a plate of fresh bakes cookies!

Save one for me. Could you also add a fresh OTL log to the mix please.. Just select all users and run scan

Kaspersky says, unable to start tasks???

DER!!! Nevermind.

OK lets try OTL first - if that fails we will use Combofix


Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Services
  Tosrfcom
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  C:\Program Files\Winferno
  C:\Program Files\CyberDefender
  C:\Users\lorraine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MyCleanPC Registry Scanner.lnk
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Ooops cross posted - I gather AVP is now running ?

I got it to run with Kapersky… and rebooted, but the dang pop ups are still there Sooooo, we are now running the 3 hour long autoscan process with Kapersky again…. AFTER running the scrip you gave me. About ready to wipe this dang thing! LOL!

Nope lets now use Combofix to kill it

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\Users\lorraine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MyCleanPC Registry Scanner.lnk

Folder::
C:\Program Files\Winferno
C:\Program Files\CyberDefender

Driver::
Tosrfcom

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new OTListit log.