[cybertech]

Download OTS.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTS on your desktop.

1. Close any open browsers.
2. If your Real protection or Antivirus intervenes with OTS, allow it to run.
3. Open the OTS folder and double-click on OTS.exe to start the program.
4. In Additional Scans section put a check in Disabled MS Config Items and EventViewer logs
5. Now click the Run Scan button on the toolbar.
6. The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
7. When the scan is complete Notepad will open with the report file loaded in it.
8. Save that notepad file

Use the Reply button, scroll down to the attachments section and attach the notepad file here.

NOTE: The only people who can see attachments in the HJT forum are: the thread starter, Admins & Mods, and HJT Helpers & Trainees.

[Kelya]

Here is the log, sorry it took so long. It was hard to find time to do the scan without running any other programs. Another thing I noticed is that if I have my Logitech Momo racing wheel plugged in the force-feedback light will start flashing with windows media player's starting and stopping. Anyways, here is the log.

[cybertech]

I'm not sure what to tell you on the game hardware. Post that in the Game forum.


Start OTScanIt. Copy/Paste the information in the Code box below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Kill Explorer]
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> WebBrowser\\"{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "" -> []
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YN -> "C:\Program Files\BitTorrent\bittorrent.exe" -> C:\Program Files\BitTorrent\bittorrent.exe [C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent]
[Files/Folders - Created Within 30 Days]
NY -> 2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp
[Files/Folders - Modified Within 30 Days]
NY -> 3 C:\Windows\*.tmp files -> C:\Windows\*.tmp
NY -> 31 C:\Users\Adam\AppData\Local\Temp\*.tmp files -> C:\Users\Adam\AppData\Local\Temp\*.tmp
[Empty Temp Folders]
[Start Explorer]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTScanIt scan.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

[Kelya]

Yea, just wondered if it may somehow be connected to the problem.

Anyways, heres the log file after the fix:

All Processes Killed
No active process named Explorer.EXE was found!
[Registry - Safe List]
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\BitTorrent\bittorrent.exe deleted successfully.
[Files/Folders - Created Within 30 Days]
[Files/Folders - Modified Within 30 Days]
C:\Windows\7104189AC5924A56AC9E7C0CA135DA3C.TMP folder deleted successfully.
C:\Windows\85EBB28365AF4C539EBE7C0A232762F7.TMP folder deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
C:\Users\Adam\AppData\Local\Temp\ins1.tmp folder deleted successfully.
[Empty Temp Folders]


User: Adam
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 55296896 bytes
->Java cache emptied: 39043299 bytes

User: All Users

User: Default
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\JET61CE.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied: 292339 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 90.28 mb

< End of fix log >
OTS by OldTimer - Version 3.0.9.0 fix logfile created on 07022009_115524
Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.
File\Folder C:\Windows\temp\JET61CE.tmp not found!
Registry entries deleted on Reboot...

And the log after the scan is attached. It seems to be doing the same thing though . Also, I seem to have all these clearish icons all over my folders and the desktop. They only appeared after the fix. Did it enable seeing hidden files or something? How do I get rid of them?

[cybertech]

I'm not sure what you mean on the icons. The items we fixed with OTS should have gone to a folder c:\_ots

[cybertech]

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure the following is checked.
  • Spyware, Adware, Dialers, and other potentially dangerous programs
  • Archives
  • Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

Upgrading Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 14.
• Click the "Download" button to the right.
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
• Click on Continue.
• Click on the link to download Windows Offline Installation (jre-6u14-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u14-windows-i586-p.exe and select "Run as an Administrator".)

[Kelya]

Heres the log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, July 3, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, July 03, 2009 21:29:36
Records in database: 2422099
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
Scan statistics:
Files scanned: 329863
Threat name: 1
Infected objects: 1
Suspicious objects: 0
Duration of the scan: 04:58:03

File name / Threat name / Threats count
C:\Program Files\Mozilla Firefox\plugins\NPMySrch.dll Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.i 1
The selected area was scanned.

[cybertech]

Please download the OTM by OldTimer.

• Save it to your desktop.
• Please double-click OTM.exe to run it.
• Copy all the lines in the quote box below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Files
  C:\Program Files\Mozilla Firefox\plugins\NPMySrch.dll
  

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post with a new Hijackthis log. Also let me know if you are having any problems.

[Kelya]

Heres the log:

========== FILES ==========
DllUnregisterServer procedure not found in C:\Program Files\Mozilla Firefox\plugins\NPMySrch.dll
C:\Program Files\Mozilla Firefox\plugins\NPMySrch.dll NOT unregistered.
C:\Program Files\Mozilla Firefox\plugins\NPMySrch.dll moved successfully.

OTM by OldTimer - Version 3.0.0.4 log created on 07052009_105422

I dont remember installing firefox and it dosent appear under add or remove programs. Is it ok if I delete the program files folder to save disc space? As for the problem, it was happening when I used the fix and was still happening after I used it. I restarted and it was still there .

[cybertech]

Run HijackThis and click on "Config" and then on the "Misc Tools" button.
If you're viewing HijackThis from the Main Menu then click on "Open the Misc Tools Section".
Click on the "Open Uninstall Manager" button.
Click the "Save List" button.
Copy and paste that list here.

[Kelya]

Heres the list:

2002 FIFA World Cup TM
3 Stars of Destiny
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 2.1
Adobe Photoshop Elements 5.0
Adobe Reader 8.1.0
Adobe Shockwave Player 11
Age of Empires II - The Conquerors - 1.0e Patch FINAL
Age of Empires III Trial
AGEIA PhysX v7.07.09
America's Army
AppCore
Apple Software Update
Audacity 1.3.4 (Unicode)
Aveyond
Aveyond 2
Aveyond 2
Aveyond 2 Free Trial
Aveyond: Lord of Twilight
Babarosa Gif Animator 3.6 (Remove only)
Backup
Big Fish Games Client
Blender (remove only)
BT-XT-Control Panel
Bus Driver 1.0
CABAL Online
Caligari trueSpace3.2
Call of Duty(R) 2 Demo
Call of Duty(R) 4 - Modern Warfare(TM) Demo
CamSpace
Carmen Sandiego's ThinkQuick Challenge
ccCommon
Choice Guard
Civilization III
Claw
Claw
Combat Arms
Corel Painter Essentials 3
Corel Painter Essentials 3
CyberLink DVD Suite Deluxe
Devastation Zone Troopers
Disney-Pixar WALL-E Demo
DJ Music Mixer
D-Link DBT-122 Bluetooth Software
EA Download Manager
EA.com Matchup
EA.com Update
Empire Earth III Public Demo
Enhanced Multimedia Keyboard Solution
Fiesta
FIFA 09 Demo
Fraps
Free Mp3 Wma Converter V 1.7.2
Game Maker 7.0
GearDrvs
GearDrvs
GetRight
GIMP 2.4.4
Google Earth
Hardware Diagnostic Tools
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Frontend
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential 2.5
HP Picasso Media Center Add-In
HP Product Detection
HP Total Care Advisor
HP Update
IGZ Lobby System
Imperium Romanum Demo 1.01
Intel(R) Matrix Storage Manager
ITWorx Prayer Times Gadget
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
Kung Fu Panda(TM) Demo
LabelPrint
LEGO MINDSTORMS NXT Driver
LEGO MINDSTORMS NXT Dynamic Block Update
LEGO® MINDSTORMS® NXT - English Language Pack
LEGO® MINDSTORMS® NXT Software v1.0
LightScribe System Software 1.10.16.1
LightScribe Template Labeler
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
Lock On: Modern Air Combat
Logitech Desktop Messenger
Logitech Gaming Software 5.02
Logitech Motion Detector Gadget
Logitech QuickCam
Logitech QuickCam Driver Package
Logitech Updater
Malwarebytes' Anti-Malware
Mario Forever 4.0
Mavis Beacon Teaches Typing 15
Medal of Honor Airborne Demo
Media Downloader
Messenger Plus! Live
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB929729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Age of Empires II
Microsoft Age of Empires II Trial Version
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Flight Simulator X
Microsoft Flight Simulator X: Acceleration
Microsoft Flight Simulator X: Acceleration
Microsoft MSDN 2005 Express Edition - ENU
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C# 2005 Express Edition - ENU
Microsoft Visual C# 2005 Express Edition - ENU
Microsoft Visual C# 2005 Express Edition - ENU Service Pack 1 (KB926749)
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Motorola MP3 Loader
Mount&Blade
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
muvee autoProducer 6.1
My DSC
My DSC
My HP Games
National Instruments Software
Need For Speed Hot Pursuit 2
Need for Speed™ Carbon Demo
Need for Speed™ Most Wanted PC Demo
NI EULA Depot
NI MDF Support
nik Color Efex Pro 2.0 GE
Norton 360
Norton 360
Norton 360
Norton 360 (Symantec Corporation)
Norton 360 HTMLHelp
Norton Confidential Core
NVIDIA Drivers
OnBrick
OpenAL
Outspark Sharp Launcher
Pando Media Booster
Plant Tycoon
Plant Tycoon 1.0
Power2Go
PowerDirector
PrntScrn.NET
Python 2.5
Python 2.5.2
QuickTime
RealPlayer
Realtek High Definition Audio Driver
Robot Arena 2
Roll
Saitek SST Programming Software
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Silkroad
Snapfish Picture Mover
Soft Data Fax Modem with SmartCP
SPBBC 32bit
SPORE™
Star Wars Republic Commando Demo
Symantec Real Time Storage Protection Component
Symantec Technical Support Controls
System Requirements Lab
TeamSpeak 2 RC2
The Lord of the Rings Online™: Shadows of Angmar™ v01.07.00.811
TI Connect 1.6
TmNationsForever
Toxic Biohazard
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Visual C# 2005 Express Edition - ENU (KB932232)
Ventrilo Client
Virtual Villagers - The Secret City 1.0
WeatherBug Gadget
Winamp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker Beta
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Wings 3D 0.99.04a
WinRAR archiver
Wisdom-soft ScreenHunter 5.0 Free
Xfire (remove only)

[cybertech]

Upgrading Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 14.
• Click the "Download" button to the right.
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
• Click on Continue.
• Click on the link to download Windows Offline Installation (jre-6u14-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u14-windows-i586-p.exe and select "Run as an Administrator".)

Now go to add/remove programs and remove:
Java(TM) SE Runtime Environment 6 Update 1
WeatherBug Gadget

[Kelya]

Ok, I went to Add/Remove programs and I found one item with Java Runtime Enviroment in its name, which was what I had just installed. The only other Java item there was Java(TM) 6 update 14 which I did not uninstall. As soon as I restarted my computer windows media player started doing its thing again. =(

[cybertech]

Have you tried removing media player?

[Kelya]

I tried looking for a way and apparently its not possible.