Browsers won't open [Solved]

• Malware Logs can sometimes take a lot of time to research and interpret.
  
• Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  
• Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  
• PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

• Please perform the following scan
  
  
  
  • Please download DDS from here and save it to your desktop.
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
  • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.
  
  
• aswMBR
  
  
  
  • Download aswMBR.exe to your desktop.
  • Double click the aswMBR.exe to run it.
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click the "Scan" button to start scan.
  
  [external image: Posted Image]
  
  
  • On completion of the scan click save log, save it to your desktop and post in your next reply.
  
  [external image: Posted Image]
  
  Please post both DDS logs and the aswMBR log in your next reply.

• P2P Programs:
  
  
  
  • P2P programs are a major source of Malware infections.
  • From your log I see you have µTorrent. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
  • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
  • If you wish to keep the program(s), please do not use them until your computer is cleaned.
  • Information regarding the risk of using these programs can be found from here and here.
  • It is strongly recommend that you uninstall any P2P programs you have on your system.
  • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
  • A list of currently installed programs will be displayed.
  • Find the "µTorrent" program, click on it once and then click on the "Remove" button.
  • If you are prompted to re-boot your computer to complete the uninstall please do so.
    
    
    PLEASE NOTE:
  • Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.
  
  
• Please un-install the following
  
  
  
  • Click on "Start" then on "Control Panel" and then on "Add or remove programs".
  • Click on "remove a program". A list of currently installed programs will be displayed.
  • Find the "Dealio Toolbar v6.2" program, click on it once and then click on the "uninstall" button.
  • If you are prompted to re-boot your computer to complete the uninstall please do so.
  • Repeat this process for the following:
    
    1ClickDownloader
    Ask Toolbar
    Ask and Record Toolbar
    SweetPacks Toolbar for Internet Explorer 4.5
    Windows iLivid Toolbar
    Yontoo Layers 1.10.01
  
  
• Please scan the following files
  
  
  
  • Please go to VirusTotal
  
  
  
  • On the page you'll find a "Choose File" button.
  • Click on the Choose File button.
  • In the File Upload window which opens, copy and paste this into the File Name box.
  
  
  C:\Documents and Settings\Goofy\My Documents\Downloads\Phil Collins - In The Air Tonight (CD Single)\WinAFV32.exe
  
  
  
  • Next, click the Open button.
  • Then click the "Send File" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.
  
  
• Combofix
  
  
  
  • Download ComboFix from one of the following locations:
    
    Link 1
    Link 2
  
  
  • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
  
  
  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
  • Double click on ComboFix.exe & follow the prompts.
  
  
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
  
  [external image: Posted Image]
  
  
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  [external image: Posted Image]
  
  
  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  • Should there be issues with internet afterward:
    
    In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.
    
    In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.
  
  Do you purposefully have you home page set to search.gboxapp.com?
  
  Please let me know, and post the link to the Virus Total results page and the Combofix log in your next reply.

what can I do to rerun it?

• Reboot Your System in Safe Mode
  
  
  
  • Restart your computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
  • Use the arrow keys to select the Safe mode menu item.
  • Press Enter.
  
  
  Once in Safe Mode try Combofix again. If it is prevented from running, reboot back into Normal Mode and run the following scan instead:
  
  
• Download and run OTL by Oldtimer
  
  
  
  • Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop.
  • Close all open windows on your computer then Double click on the OTL.exe icon to run the program.
  • Check the boxes beside "LOP Check" and "Purity Check".
  • Under Custom Scan paste this in:
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\drivers\*.sys /90
  CREATERESTOREPOINT
  
  
  
  • Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.
  
  
  • When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
  • Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.
  
  If Combofix completes its run post the log created in your next reply.
  
  If it is prevented from running post the OTL logs for me to review.

• Please download SystemLook by JPShortstuff
  
  
  
• Please download SystemLook by JPShortstuff by clicking here or here and save the file (called SystemLook.exe) to your desktop.
• Double click SystemLook.exe to run the program.
• Copy the content of the following codebox into the main textfield:

:filefind
*21697*

:service
21697

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
• Note: The log can also be found on your Desktop entitled SystemLook.txt

• Please work through the following steps
  
  
  
  • Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
  • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
  • Copy and Paste the text in the quotebox below into the open Notepad window:
    
    

    File::
    C:\WINDOWS\system32\drivers\21697
    C:\Documents and Settings\Goofy\My Documents\Downloads\Phil Collins - In The Air Tonight (CD Single)\WinAFV32.exe
    
    DDS::
    uStart Page = hxxp://search.gboxapp.com/
    mStart Page = hxxp://search.gboxapp.com/
    
    Driver::
    21697
    
    NetSvc::
    21697
    
    ClearJavaCache::

  • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
  • Close any open browsers.
  • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Refering to the picture below, drag CFScript.txt into ComboFix.exe
    
    [external image: Posted Image]
    
  • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
  • Once the log is produced, re-engage your resident anti virus.
  
  
• Temporary File Cleaner
  
  
  
  • Download TFC to your desktop.
  • Close any open windows.
  • Double click the TFC icon to run the program.
  • TFC will close all open programs itself in order to run.
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish.
  • Once complete it should automatically reboot your machine.
  • If your machine does not reboot automatically, manually reboot to ensure a complete clean.
  • Note: After running TFC your machine may take slightly longer to boot the first time. This is normal.
  
  
• Please perform the following scan:
  
  
  
  • Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
  
  
  • Double click on the mbam-setup.exe icon to install the program.
  • Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
  • Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
  • Click on the "Update" tab and then on "Check for Updates".
  • The program will now install the latest Malware definition files.
  • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
  • Once the program has scanned your computer, a log file will be created in Notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  
  
  
  • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
  • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
  • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
  • Come back here to this thread and Paste the log in your next reply.
  
  Please post the Combofix log and the MBAM log in your next reply.

• Please scan the following files
  
  
  
• Please go to VirusTotal

• On the page you'll find a "Choose File" button.
• Click on the Choose File button.
• In the File Upload window which opens, copy and paste this into the File Name box.

• Next, click the Open button.
• Then click the "Send File" button just below.
• This will scan the file. Please be patient.
• If you get a message saying File has already been analyzed: click Reanalyze file now.
• Once scanned, copy and paste the link to the results page in your next reply.