Malware Removal logs here....

Hi & welcome.

Yes, let's cover all bases and have you run these procedures.

READ & RUN ME FIRST - Malware Removal Guide

 

Good afternoon. Yes I checked out your YT vid, got a fresh coffee, and am about to review your logs.

 

Uninstall the below using Revo Uninstaller.

• Yontoo 1.10.02
  [*]BabylonObjectInstaller

Re run Hitman and having it delete the "Malware" "Malware Remnants" and "Potential Unwanted Programs"




Download and run OTM.


Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the area. Do not include the word Code.

Code:

:Files
C:\Documents and Settings\Owner\Local Settings\Application Data\MixiDJ_V37
C:\Documents and Settings\Owner\Local Settings\Application Data\Conduit
C:\Documents and Settings\Owner\Local Settings\Application Data\CRE
C:\Documents and Settings\Owner\Local Settings\Application Data\Search_Spin
C:\Documents and Settings\Owner\85ec~1        
C:\Documents and Settings\Owner\3a20~1
C:\Documents and Settings\Owner\3a20~2       
C:\Documents and Settings\Owner\4530~1       
C:\Documents and Settings\Owner\0081~1        
C:\Documents and Settings\Owner\3a26~1        
C:\Documents and Settings\Owner\618c~1        
C:\Documents and Settings\Owner\382e~1        
C:\Documents and Settings\Owner\0a2c~1        
C:\Documents and Settings\Owner\af60~1        
C:\Documents and Settings\Owner\2a28~1
C:\Documents and Settings\Owner\Application Data\SearchProtect
C:\Documents and Settings\All Users\Application Data\Conduit
C:\Documents and Settings\All Users\Application Data\TorchCrashHandler
C:\Documents and Settings\Owner\Local Settings\Application Data\store-pp.jbs
C:\Documents and Settings\Owner\Local Settings\Application Data\{A1307266-A0BF-40A5-B134-02C252AE661B}
C:\Documents and Settings\All Users\Application Data\Conduit
C:\Documents and Settings\All Users\Application Data\TorchCrashHandler
C:\Documents and Settings\Owner\Start Menu\Programs\Torch.lnk
C:\Program Files\MixiDJ_V37
C:\Program Files\MyPC Backup
C:\Program Files\SearchProtect
C:\Program Files\Search_Spin

:reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4EDEDE12-9310-4BCB-A357-D993D9BA385B}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AA71CE57-D357-44EB-B196-1F992E94069E}]

:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.




Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

• R3 - URLSearchHook: Search Spin Toolbar - {fe02a3ef-6cd5-4dc6-8cf4-f3bcac60bc7c} - C:\Program Files\Search_Spin\prxtbSear.dll
• R3 - URLSearchHook: MixiDJ V37 Toolbar - {eef3855c-fc2d-41e6-8d91-d368f51b3055} - C:\Program Files\MixiDJ_V37\prxtbMixi.dll
• O2 - BHO: KMP Media Toolbar - {daf5b34c-1aa3-4c33-ae24-766a370635d2} - C:\Program Files\kmpmediatoolbar\searchresultsDx.dll
• O2 - BHO: MixiDJ V37 - {eef3855c-fc2d-41e6-8d91-d368f51b3055} - C:\Program Files\MixiDJ_V37\prxtbMixi.dll
• O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll
• O2 - BHO: Search Spin - {fe02a3ef-6cd5-4dc6-8cf4-f3bcac60bc7c} - C:\Program Files\Search_Spin\prxtbSear.dll
• O3 - Toolbar: KMP Media Toolbar - {daf5b34c-1aa3-4c33-ae24-766a370635d2} - C:\Program Files\kmpmediatoolbar\searchresultsDx.dll
• O3 - Toolbar: Search Spin Toolbar - {fe02a3ef-6cd5-4dc6-8cf4-f3bcac60bc7c} - C:\Program Files\Search_Spin\prxtbSear.dll
• O3 - Toolbar: MixiDJ V37 Toolbar - {eef3855c-fc2d-41e6-8d91-d368f51b3055} - C:\Program Files\MixiDJ_V37\prxtbMixi.dll
• O4 - Startup: kill.bat
• O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

After clicking Fix exit HJT.



Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Re run both RogueKiller and Hitman and attach the logs.



Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

 

Hi there.

I'm sorry that your sound still isn't fixed. I may have to refer you onto the guys and gals in the software forum where they can further assist you.

However, I would like to ask a couple things.

• When did this (the sound issues) first start occurring?
• Do you remember what you had been doing at the time?
• Had a windows update taken place at all?

Also, I would like for you to re run RogueKiller and have it fix the Host File entry. Then rescan with it again and attach the log.

Also, these did NOT delete, and other stuff got missed too.

 

Continue with the below after the RogueKiller step.

Uninstall >>> KMP Media Toolbar


Download The Avenger by Swandog469, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Any change with the sound?

 

OK thanks for answering my questions.

Please do continue with my instructions, just in case any of that garbage is causing it.

 

You are most welcome. I'm ever so sorry what we did here did not help your sound, but indeed, you can now continue to post in software about it, rest assured that malware is not the cause.

Just delete these:

C:\Documents and Settings\NetworkService\Local Settings\Application Data\MixiDJ_V37
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Search_Spin

 

I posted something.