I ran OTL and posted full script in box. It ran completely and indicated it needed a reboot. I clicked to reboot. The computer rebooted, I typed my password in and now have a black screen. The mouse moves. I have sat here for about 20 minutes, it appears to have gone into a screen mode save since the mouse indicator is not visible. I move the mouse, I still have a black screen. I don't think this is part of the plan? Suggestion?
Solved Variant of Win32/Toolbar.Widgi
- Thread starter EvaMick
- Start date
Ok...hard reset...started in safe mode...figured I'd try one more time to restart...and voila...here's the OTL log:
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2723914322-968885618-128485759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2723914322-968885618-128485759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\quickbooks.com\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\intu-help-qb5\ deleted successfully.
File Protocol\Handler\intu-help-qb5 - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\qbwc\ deleted successfully.
File Protocol\Handler\qbwc - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
ADS C:\ProgramData\TEMP:AEC0AC81 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: dcp-elm
->Temp folder emptied: 107632545 bytes
->Temporary Internet Files folder emptied: 3208770458 bytes
->Flash cache emptied: 61740 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 54632 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14168 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 420 bytes
Total Files Cleaned = 3,163.00 mb
[EMPTYJAVA]
User: All Users
User: dcp-elm
User: Default
User: Default User
User: Public
Total Java Files Cleaned = 0.00 mb
[EMPTYFLASH]
User: All Users
User: dcp-elm
->Flash cache emptied: 0 bytes
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 07162013_170504
Files\Folders moved on Reboot...
C:\Users\dcp-elm\AppData\Local\Temp\ExchangePerflog_8484fa310f46b76dcfcccd43.dat moved successfully.
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\fla8F0C.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\fla9C94.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\flaB277.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\flaC3C6.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\flaCDBF.tmp not found!
C:\Users\dcp-elm\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGEEHW4T\xhr[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TE1QECZO\50kb-20111128[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TE1QECZO\proxy[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ97R9JM\xd_dapi_frame_production[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\apprequests[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\variant-of-win32-toolbar-widgi[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\wordswithfriends[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\wwf-fb_zyngawithfriends_com[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AL7MDX5S\12[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AL7MDX5S\sound_iframe[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\1996[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\1996[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\50kb-20111128[4].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\net[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TPWC4BX\odIeERVR1c5[1].mp3 moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79HC839M\50kb-20111128[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79HC839M\like[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7131CQJP\load[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7131CQJP\xd_arbiter[1].htm moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2723914322-968885618-128485759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2723914322-968885618-128485759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\quickbooks.com\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\intu-help-qb5\ deleted successfully.
File Protocol\Handler\intu-help-qb5 - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\qbwc\ deleted successfully.
File Protocol\Handler\qbwc - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
ADS C:\ProgramData\TEMP:AEC0AC81 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: dcp-elm
->Temp folder emptied: 107632545 bytes
->Temporary Internet Files folder emptied: 3208770458 bytes
->Flash cache emptied: 61740 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 54632 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14168 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 420 bytes
Total Files Cleaned = 3,163.00 mb
[EMPTYJAVA]
User: All Users
User: dcp-elm
User: Default
User: Default User
User: Public
Total Java Files Cleaned = 0.00 mb
[EMPTYFLASH]
User: All Users
User: dcp-elm
->Flash cache emptied: 0 bytes
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 07162013_170504
Files\Folders moved on Reboot...
C:\Users\dcp-elm\AppData\Local\Temp\ExchangePerflog_8484fa310f46b76dcfcccd43.dat moved successfully.
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\fla8F0C.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\fla9C94.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\flaB277.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\flaC3C6.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Temp\flaCDBF.tmp not found!
C:\Users\dcp-elm\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGEEHW4T\xhr[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TE1QECZO\50kb-20111128[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TE1QECZO\proxy[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ97R9JM\xd_dapi_frame_production[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\apprequests[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\variant-of-win32-toolbar-widgi[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\wordswithfriends[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMKT89S0\wwf-fb_zyngawithfriends_com[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AL7MDX5S\12[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AL7MDX5S\sound_iframe[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\1996[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\1996[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\50kb-20111128[4].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9YKV4QQJ\net[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TPWC4BX\odIeERVR1c5[1].mp3 moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79HC839M\50kb-20111128[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79HC839M\like[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7131CQJP\load[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7131CQJP\xd_arbiter[1].htm moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
File from SecurityCheck:
Results of screen317's Security Check version 0.99.69
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
ESET Smart Security 4.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````
Results of screen317's Security Check version 0.99.69
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
ESET Smart Security 4.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````
FSS Scan:
Farbar Service Scanner Version: 13-07-2013
Ran by dcp-elm (administrator) on 16-07-2013 at 18:23:53
Running from "C:\Users\dcp-elm\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Farbar Service Scanner Version: 13-07-2013
Ran by dcp-elm (administrator) on 16-07-2013 at 18:23:53
Running from "C:\Users\dcp-elm\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Broni
Posts: 56,041 +516
Your computer is clean
1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:
Run OTL
2. Now, we'll remove all tools, we used during our cleaning process
Clean up with OTL:
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
3. Make sure Windows Updates are current.
4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!
5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)
6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.
8. Run Temporary File Cleaner (TFC) weekly.
9. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.
10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.
11. (Windows XP only) Run defrag at your convenience.
12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.
13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
14. Please, let me know, how your computer is doing.
1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process
Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
3. Make sure Windows Updates are current.
4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!
5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)
6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.
8. Run Temporary File Cleaner (TFC) weekly.
9. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.
10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.
11. (Windows XP only) Run defrag at your convenience.
12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.
13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
14. Please, let me know, how your computer is doing.
OTL Log:
All processes killed
========== OTL ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: dcp-elm
->Temp folder emptied: 56691 bytes
->Temporary Internet Files folder emptied: 29898934 bytes
->Flash cache emptied: 622 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 29.00 mb
[EMPTYFLASH]
User: All Users
User: dcp-elm
->Flash cache emptied: 0 bytes
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
[EMPTYJAVA]
User: All Users
User: dcp-elm
User: Default
User: Default User
User: Public
Total Java Files Cleaned = 0.00 mb
Restore point Set: OTL Restore Point
OTL by OldTimer - Version 3.2.69.0 log created on 07162013_201635
Files\Folders moved on Reboot...
C:\Users\dcp-elm\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\AdDisplayTrackerServlet[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\wwf-fb_zyngawithfriends_com[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\xd_dapi_frame_production[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\xhr[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\50kb-20111128[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\billboard[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\sound_iframe[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\wordswithfriends[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\50kb-20111128[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\AdDisplayTrackerServlet[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\page-2[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\proxy[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\xd_arbiter[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\12[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\50kb-20111128[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\like[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\showad[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
File\Folder C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\fla15A6.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\fla7A1.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\flaDB52.tmp not found!
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
All processes killed
========== OTL ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: dcp-elm
->Temp folder emptied: 56691 bytes
->Temporary Internet Files folder emptied: 29898934 bytes
->Flash cache emptied: 622 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 29.00 mb
[EMPTYFLASH]
User: All Users
User: dcp-elm
->Flash cache emptied: 0 bytes
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
[EMPTYJAVA]
User: All Users
User: dcp-elm
User: Default
User: Default User
User: Public
Total Java Files Cleaned = 0.00 mb
Restore point Set: OTL Restore Point
OTL by OldTimer - Version 3.2.69.0 log created on 07162013_201635
Files\Folders moved on Reboot...
C:\Users\dcp-elm\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\AdDisplayTrackerServlet[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\wwf-fb_zyngawithfriends_com[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\xd_dapi_frame_production[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V12SDZF7\xhr[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\50kb-20111128[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\billboard[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\sound_iframe[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UTR62GOI\wordswithfriends[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\50kb-20111128[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\AdDisplayTrackerServlet[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\page-2[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\proxy[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TIHCGFHV\xd_arbiter[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\12[2].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\50kb-20111128[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\like[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LH1VDOCZ\showad[1].htm moved successfully.
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
File\Folder C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\fla15A6.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\fla7A1.tmp not found!
File\Folder C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\flaDB52.tmp not found!
C:\Users\dcp-elm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Sorry about not getting to No 14, but I haven't gotten through all of the other steps. I've gotten through most everything on the list, except I have a Code 78F and 643 when updating Windows. The download of WOT isn't working and neither is the PSI. Unfortunately, I don't remember what happened....it's been a tough few days. I tried all of these late Tuesday night and then got buried with work. I will try them again tomorrow to see if it works. Otherwise, everything seems to be running pretty dang good!
Similar threads
Latest posts
-
Gamers are renting out GPU power for AI porn generation in return for Fortnite skins- Squid Surprise replied
-
PlayStation 5 Pro will be bigger, faster, and better using the same CPU
- Squid Surprise replied
-
Intel is finally investigating reports of high-end 13th/14th-gen CPUs causing game crashes
- Squid Surprise replied
-
Fallout TV show secures second season after stellar debut- VitalyT replied
-
Amazon denies reports it started a business just to spy on rivals- Lew Zealand replied
-
Russia-backed hacking group suspected of attack on US water system
- axiomatic13 replied
