What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Fraud.Internet Security 2011 Infection [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I don't know how I missed it… anyway, here is the scan result txt file and log C:\Program Files\OurBabyMaker_27EI\Installr\1.bin\27EZSETP.dll probably a variant of Win32/FunWeb.AA application ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=b06897c5bf669b4d84db3b7bba5ef6f7 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-12-28 08:11:05 # local_time=2011-12-28 03:11:05 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 7821259 7821259 0 0 # compatibility_mode=8192 67108863 100 0 8441061 8441061 0 0 # scanned=91059 # found=1 # cleaned=0 # scan_time=15725 C:\Program Files\OurBabyMaker_27EI\Installr\1.bin\27EZSETP.dll probably a variant of Win32/FunWeb.AA application (unable to clean) 00000000000000000000000000000000 I # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=b06897c5bf669b4d84db3b7bba5ef6f7 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-12-29 02:43:50 # local_time=2011-12-28 09:43:50 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 7843160 7843160 0 0 # compatibility_mode=8192 67108863 100 0 8462962 8462962 0 0 # scanned=91366 # found=1 # cleaned=0 # scan_time=17401 C:\Program Files\OurBabyMaker_27EI\Installr\1.bin\27EZSETP.dll probably a variant of Win32/FunWeb.AA application (unable to clean) 00000000000000000000000000000000 I
Post #17
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Files
C:\Program Files\OurBabyMaker_27EI\Installr\1.bin\27EZSETP.dll

:Commands
[EMPTYFLASH]
[EMPTYTEMP]
[REBOOT]
[RESETHOSTS]
[CREATERESTOREPOINT]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post Fix OTL log as well as a new OTL log by rerunning it after reboot without custom scans script.
Post #18
All processes killed
========== FILES ==========
C:\Program Files\OurBabyMaker_27EI\Installr\1.bin\27EZSETP.dll moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 56468 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 9285 bytes

User: Owner
->Flash cache emptied: 16667 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 3065 bytes
->Flash cache emptied: 0 bytes

User: Owner
->Temp folder emptied: 1008972 bytes
->Temporary Internet Files folder emptied: 13753736 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 14.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.31.0 log created on 12292011_091449

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 3 for gmer.zip\gmer.exe not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 2 for gmer.zip\gmer.exe not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 1 for gmer.zip\gmer.exe not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF238.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF290.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF335.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF34F.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF458.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF469.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KMX9ADJD\iframe[3].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\E1DA3WZW\index[2].htm moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_2a8.dat moved successfully.

Registry entries deleted on Reboot…




OTL logfile created on: 12/29/2011 10:02:17 AM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.10 Mb Total Physical Memory | 17.56 Mb Available Physical Memory | 3.94% Memory free
1.03 Gb Paging File | 0.70 Gb Available in Paging File | 68.27% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 38.10 Gb Free Space | 68.18% Space Free | Partition Type: NTFS

Computer Name: TOSHIBA-USER | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\TOSHIBA\Windows Utilities\Hotkey.exe (TOSHIBA Inc.)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe (CANON INC.)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\WINDOWS\system32\sbe.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\msjetoledb40.dll ()
MOD - C:\WINDOWS\system32\acs.exe ()
MOD - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
MOD - C:\WINDOWS\system32\LXPRMON.DLL ()


========== Win32 Services (SafeList) ==========

SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (p2pgasvc) – C:\WINDOWS\system32\p2pgasvc.dll (Microsoft Corporation)
SRV - (Iprip) – C:\WINDOWS\system32\iprip.dll (Microsoft Corporation)
SRV - (EpsonBidirectionalService) – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (SEIKO EPSON CORPORATION)
SRV - (TODDSrv) – C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (lxcg_device) – C:\WINDOWS\System32\lxcgcoms.exe ( )
SRV - (Swupdtmr) – c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
SRV - (CFSvcs) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Driver Services (SafeList) ==========

DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (tdudf) – C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (tdcmdpst) – C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (qkbfiltr) – C:\WINDOWS\system32\drivers\qkbfiltr.sys (Quanta Computer, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (tbiosdrv) – C:\WINDOWS\system32\drivers\tbiosdrv.sys ()
DRV - (BoiHwsetup) – C:\WINDOWS\system32\drivers\BoiHwSetup.sys (Quanta Computer Corp)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (qmofiltr) – C:\WINDOWS\system32\drivers\qmofiltr.sys (Quanta Computer, Inc.)
DRV - (KR10N) – C:\WINDOWS\system32\drivers\KR10N.sys (TOSHIBA CORPORATION)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (Ser2pl) – C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F2 1C 9B 8F 09 7B CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\CNNSI, = search.sportsillustrated.cnn.com/pages/search.jsp?query=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Dictionary, = dictionary.reference.com/search?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Google, = google.com/search?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleGroups, = groups-beta.google.com/groups?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleImages, = images.google.com/images?hl=en&lr=&q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleNews, = news.google.com/news?tab=gn&hl=en&ie=UTF-8&q=%s&btnG=Search+News
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\KB, = support.microsoft.com/search/default.aspx?query=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\KBDLL, = support.microsoft.com/dllhelp/default.aspx?dlltype=file&l=55&alpha=%s&S=1
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Movies, = fandango.com/my_box_office.asp?searchby=2&txtCityZip=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\MSN, = search.msn.com/results.asp?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Thesaurus, = thesaurus.reference.com/search?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Weather, = weather.com/weather/local/%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Yahoo, = search.yahoo.com/search?p=%s
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.81\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.81\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2011/12/29 09:15:52 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [LXCGCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.DLL ()
O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PDUiP6600DMon] C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe (CANON INC.)
O4 - HKLM..\Run: [Toshiba Hotkey Utility] c:\Program Files\Toshiba\Windows Utilities\Hotkey.exe (TOSHIBA Inc.)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMovingBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarsOnTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63EABCA9-5C75-4110-B1E6-63F5F039CA0C}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/10/19 00:24:01 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/29 09:15:52 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/29 09:14:49 | 000,000,000 | —D | C] – C:\_OTL
[2011/12/27 12:35:30 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/12/27 12:35:30 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/12/27 12:35:30 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/12/27 12:35:30 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/12/27 12:34:39 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/27 12:33:23 | 004,353,794 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/24 08:45:52 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
[2011/12/23 22:50:33 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/08/02 13:44:21 | 001,183,744 | —- | C] ( ) – C:\WINDOWS\System32\lxcgserv.dll
[2010/08/02 13:44:21 | 001,134,592 | —- | C] ( ) – C:\WINDOWS\System32\lxcgusb1.dll
[2010/08/02 13:44:21 | 000,372,736 | —- | C] ( ) – C:\WINDOWS\System32\lxcgih.exe
[2010/08/02 13:44:21 | 000,155,648 | —- | C] ( ) – C:\WINDOWS\System32\lxcgprox.dll
[2010/08/02 13:44:21 | 000,114,688 | —- | C] ( ) – C:\WINDOWS\System32\lxcgpplc.dll
[2010/08/02 13:44:20 | 000,704,512 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomc.dll
[2010/08/02 13:44:20 | 000,491,520 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcoms.exe
[2010/08/02 13:44:20 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\lxcglmpm.dll
[2010/08/02 13:44:20 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomm.dll

========== Files - Modified Within 30 Days ==========

[2011/12/29 09:51:54 | 000,000,374 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.ics
[2011/12/29 09:48:46 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/29 09:47:55 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/29 09:17:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/29 09:15:52 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/12/27 12:33:40 | 004,353,794 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/24 08:48:14 | 000,625,664 | —- | M] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/12/24 08:46:05 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
[2011/12/23 22:50:35 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/12/16 17:50:28 | 000,015,872 | —- | M] () – C:\Documents and Settings\Owner\My Documents\goodbye400.wps
[2011/12/16 17:50:28 | 000,003,386 | —- | M] () – C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2011/12/14 05:30:32 | 000,191,384 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/14 03:13:45 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/12 20:16:11 | 000,243,712 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Wallkill Together Wins.wps
[2011/12/11 16:37:41 | 000,005,120 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2011/12/27 12:35:30 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/12/27 12:35:30 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/12/27 12:35:30 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/12/27 12:35:30 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/12/27 12:35:30 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/12/24 08:48:10 | 000,625,664 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/12/15 23:00:09 | 000,015,872 | —- | C] () – C:\Documents and Settings\Owner\My Documents\goodbye400.wps
[2011/12/12 20:16:10 | 000,243,712 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Wallkill Together Wins.wps
[2011/10/09 17:00:37 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2011/10/09 17:00:34 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2011/10/09 16:57:22 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2011/10/09 16:57:21 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2011/10/09 16:57:15 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2011/10/09 16:57:00 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2011/09/17 21:16:07 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2011/06/05 20:11:33 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2011/04/25 16:46:07 | 000,870,128 | —- | C] () – C:\Documents and Settings\Owner\Application Data\mcs.rma
[2011/02/09 03:08:51 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2011/02/02 18:40:03 | 000,073,220 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2011/02/02 18:40:03 | 000,031,053 | —- | C] () – C:\WINDOWS\System32\EPPICPattern131.dat
[2011/02/02 18:40:03 | 000,029,114 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2011/02/02 18:40:03 | 000,027,417 | —- | C] () – C:\WINDOWS\System32\EPPICPattern121.dat
[2011/02/02 18:40:03 | 000,021,021 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2011/02/02 18:40:03 | 000,015,670 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2011/02/02 18:40:03 | 000,013,280 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2011/02/02 18:40:03 | 000,010,673 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2011/02/02 18:40:03 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2011/02/02 18:40:03 | 000,001,140 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2011/02/02 18:40:03 | 000,001,140 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2011/02/02 18:40:03 | 000,001,137 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2011/02/02 18:40:03 | 000,001,130 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2011/02/02 18:40:03 | 000,001,130 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2011/02/02 18:40:03 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2011/02/02 18:40:03 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2011/02/02 18:38:00 | 000,000,079 | —- | C] () – C:\WINDOWS\EWF325.ini
[2011/02/02 07:01:04 | 000,005,120 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/07 19:01:41 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\CNMVS7D.DLL
[2010/08/02 13:47:54 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXPRMON.DLL
[2010/08/02 13:47:54 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXPMONUI.DLL
[2010/08/02 13:44:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxcgvs.dll
[2010/07/26 06:56:10 | 046,249,416 | —- | C] () – C:\WINDOWS\System32\MRT.exe
[2009/12/05 23:06:54 | 000,000,004 | —- | C] () – C:\Documents and Settings\Owner\Application Data\AAAFDD
[2006/12/03 14:28:54 | 000,003,386 | —- | C] () – C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2006/12/03 14:12:48 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2006/12/03 14:01:33 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/12/03 09:52:46 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2006/12/03 09:51:46 | 000,245,760 | —- | C] () – C:\WINDOWS\System32\ControlWZCS.exe
[2006/12/03 09:51:43 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\acs.exe
[2006/12/03 09:51:39 | 000,311,296 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2006/12/03 09:51:25 | 000,270,336 | —- | C] () – C:\WINDOWS\System32\PlugPlayPCIDevice.exe
[2006/10/19 04:13:54 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/10/19 01:53:50 | 000,011,122 | —- | C] () – C:\WINDOWS\HWSetupStr.ini
[2006/10/19 01:53:50 | 000,002,036 | —- | C] () – C:\WINDOWS\SVPW32Str.ini
[2006/10/19 01:36:26 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2006/10/19 00:30:22 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/19 00:26:54 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2006/10/19 00:19:27 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2006/10/18 23:57:16 | 000,000,341 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/10/18 23:53:10 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2006/10/18 23:53:05 | 000,524,256 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2006/10/18 23:53:05 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2006/10/18 23:53:05 | 000,102,924 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2006/10/18 23:53:05 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2006/10/18 23:53:03 | 000,004,688 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2006/10/18 23:53:01 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2006/10/18 23:52:58 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2006/10/18 23:52:49 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2006/10/18 23:52:49 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2006/10/18 23:52:35 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2006/10/18 23:52:22 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2006/10/18 17:13:47 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/10/18 17:12:57 | 000,191,384 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2006/09/09 11:36:25 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2006/09/09 11:36:25 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2006/09/09 11:36:25 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2006/09/09 11:36:25 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2006/09/09 11:36:25 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2006/09/09 11:36:25 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2006/09/09 11:35:33 | 000,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2006/09/09 11:35:33 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2006/09/09 11:35:33 | 000,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2006/09/09 11:35:33 | 000,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2006/09/09 11:32:31 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2006/09/09 11:32:31 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2006/08/22 10:01:46 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/08/01 12:56:40 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\TPeculiarity.dll
[2005/12/08 20:01:06 | 000,112,421 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2005/12/08 13:56:50 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\tsbwls.dll
[2005/08/24 17:20:28 | 000,009,472 | —- | C] () – C:\WINDOWS\System32\drivers\tbiosdrv.sys
[2005/08/05 16:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/01/07 17:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2011/11/22 06:32:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/12/07 19:01:30 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2006/10/19 02:00:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2011/02/02 18:42:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2011/02/02 18:46:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UDL
[2007/07/06 08:33:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/12/03 14:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2009/12/05 22:16:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\YAHOO
[2011/05/18 10:39:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Epson
[2006/08/24 18:30:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2007/05/29 20:11:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2010/08/29 20:53:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/12/05 13:10:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\StreamTorrent
[2006/12/03 14:29:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template
[2006/10/19 01:45:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\toshiba
[2011/03/13 18:00:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Uniblue
[2007/07/06 08:33:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Viewpoint
[2006/12/03 14:38:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WildTangent

========== Purity Check ==========



< End of report >
Post #21 last edited
Very well.

I'm pleased to let you know that your log is clean! :thumbup:

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

Follow these steps to uninstall Combofix
  • Click START then RUN
  • Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
Combofix /Uninstall
[external image: Posted Image]

===================================================

Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
===================================================
MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.


Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.


SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
  • How Did I Get Infected In The First Place? by TonyKlein
  • How to Prevent Malware by miekiemoes
  • PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop

WOT has an add-on available for both Firefox and IE.

  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.
Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved and close this topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI