Unable to Upgrade Windows after Malware Removal

I've gone through the whole process of removing malware.
I was having particular problem with "Guard Online".
The malware is not appearing as a frequent pop up like it was before -
no sign of it. But now I can't upgrade windows.

 

There are still traces of malware in your logs.

Please also attach the logs from running MalwareByte's Anti-Malware and SUPERAntiSpyware.

 

Part two of my post with the other log files.
I could not find the SASlog, so I ran it again.
Then I found both logs. You can see the more recent SASlog is clean.

 

From Programs and Features (via Control Panel), please uninstall the below:

• Coupon Printer for Windows
• CouponBar
• Free_TV_Bar Toolbar
• Java(TM) 6 Update 3
• Norton 360 <- Is this still functioning? If not, uninstall. You have MSE installed already.

Run C:\MGtools\analyse.exe by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Shut down your protection software now to avoid possible conflicts.
Note: This is actually Trend Micro HiJackThis - v2.0.4
Choose Do a system scan only and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]File::[/COLOR]
C:\Users\Mimi\desktop\CouponPrinter.exe
C:\Users\Mimi\desktop\Guard Online .lnk
C:\Program Files\Internet Explorer\15B1.tmp
C:\Program Files\Internet Explorer\32F1.tmp
C:\Program Files\Internet Explorer\33BC.tmp
C:\Program Files\Internet Explorer\48B2.tmp
C:\Program Files\Internet Explorer\4A0A.tmp
C:\Program Files\Internet Explorer\531E.tmp
C:\Program Files\Internet Explorer\9CBB.tmp
C:\Program Files\Internet Explorer\A811.tmp
C:\Program Files\Internet Explorer\E88A.tmp
c:\users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crss.exe
C:\Windows\Temp\SPL9F2B.tmp
C:\Windows\Temp\SPLF7A7.tmp
C:\Windows\Temp\TMP000000054A564477882D2933
C:\Windows\Temp\TMP00000031B04CFE1605EC47CF
C:\Windows\Temp\TMP00000002D98DAC85FD373E6B
C:\Users\Mimi\AppData\Local\Temp\B5D6.tmp
C:\Users\Mimi\AppData\Local\Temp\C0AF.tmp
C:\Users\Mimi\AppData\Local\Temp\CVR22CB.tmp
C:\Users\Mimi\AppData\Local\Temp\DX99AF.tmp
C:\Users\Mimi\AppData\Local\Temp\DX99AF.tmp.exe
C:\Users\Mimi\AppData\Local\Temp\EF8B.tmp
C:\Users\Mimi\AppData\Local\Temp\scs230A.tmp
C:\Users\Mimi\AppData\Local\Temp\scs2359.tmp
C:\Users\Mimi\AppData\Local\Temp\{3BAFBB0F-1A8F-4C74-A361-FD444DCD1C94}.tmp
C:\Users\Mimi\AppData\Local\Temp\{8B48170E-1905-4F3C-A7B2-3D5B5B428544}.tmp
C:\Users\Mimi\AppData\Local\Temp\{F2C06EE3-9872-46E0-A095-EE04C233FFF3}.tmp
[COLOR="DarkRed"]Folder::[/COLOR]
c:\windows\$NtUninstallKB8676$
c:\users\Mimi\AppData\Roaming\lsQJ7dEK8R9YwUe
c:\users\Mimi\AppData\Roaming\T2onF4pmH
c:\users\Mimi\AppData\Roaming\kiivvD2nFpHsJK
c:\users\Mimi\AppData\Roaming\DkUUVVelOBtz0yA
c:\users\Mimi\AppData\Roaming\q6ssWJ77fE8ZhYw
c:\users\Mimi\AppData\Roaming\mUUVVrlOBt
c:\users\Mimi\AppData\Roaming\zxS2ibF3pG
c:\users\Mimi\AppData\Roaming\m3pmG5aQJdKfLTq
c:\users\Mimi\AppData\Roaming\Hv48hXkUVelBtyv
c:\users\Mimi\AppData\Roaming\iYxnH7ETwr
c:\users\Mimi\AppData\Roaming\ATjerN0Sbp4HWLT
c:\users\Mimi\AppData\Roaming\djerN0Sbp4HWLTY
c:\users\Mimi\AppData\Roaming\pIAo5E9Cz1baKey
c:\users\Mimi\AppData\Roaming\XKZI04LwP3WZOis
c:\users\Mimi\AppData\Roaming\ipppnGG4aH6sK7E
c:\users\Mimi\AppData\Roaming\Qs6d8lrN12GJdKf
c:\users\Mimi\AppData\Roaming\E9ggTTZqjYCwIVl
c:\users\Mimi\AppData\Roaming\SbbbD3p4aH6sK7E
c:\users\Mimi\AppData\Roaming\UzOONyxA0uvSiF
C:\Windows\Temp\IE92867.tmp
C:\Users\Mimi\AppData\Local\Temp\870A.dir
C:\Users\Mimi\AppData\Local\Temp\g2m3062.tmp
C:\Users\Mimi\AppData\Local\Temp\is-4L1Q1.tmp
C:\Users\Mimi\AppData\Local\Temp\is-P5EM1.tmp
C:\Users\Mimi\AppData\Local\Temp\is-S367K.tmp
C:\Users\Mimi\AppData\Local\Temp\is-TJRN1.tmp
C:\Users\Mimi\AppData\Local\Temp\{021D0D69-D4BE-40F8-A37C-351D15C94DA2}
C:\Users\Mimi\AppData\Local\Temp\{0922254C-D2B1-45B2-9B74-C5D75773E1F7}
C:\Users\Mimi\AppData\Local\Temp\{18857B3B-0E9C-4E1B-A6EE-959823B29807}
C:\Users\Mimi\AppData\Local\Temp\{41693214-2591-4653-BD4B-B296EE64A639}
C:\Users\Mimi\AppData\Local\Temp\{4CA95860-312B-48DA-8A25-F0F6257C6EDA}
C:\Users\Mimi\AppData\Local\Temp\{7087CA30-A12F-44F1-90F9-3C693A8487B2}
C:\Users\Mimi\AppData\Local\Temp\{72AF4270-5BF5-469E-8495-6E9650F21681}
C:\Users\Mimi\AppData\Local\Temp\{777F27E9-C231-4ADF-8CFB-7AD7FACA3DDC}
C:\Users\Mimi\AppData\Local\Temp\{80AF8A54-354F-49E7-BD50-C630DD938C90}
C:\Users\Mimi\AppData\Local\Temp\{A284C62D-8F56-4BE6-81E9-60586455B729}
C:\Users\Mimi\AppData\Local\Temp\{C52C0579-C4DA-41A2-AAE9-B6F052780011}
C:\Users\Mimi\AppData\Local\Temp\{C6D2F466-B1DE-496B-BF91-1BBA4D8A852A}
C:\Users\Mimi\AppData\Local\Temp\{CCDF55FA-E96B-4202-843E-E91CA49ED208}
C:\Users\Mimi\AppData\Local\Temp\{fb66a111-44d3-4307-b961-db0cad92a322}
C:\Users\Mimi\AppData\Local\Temp\{FE0F66B0-210C-4731-8F02-146739BE7C49}
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\.dfsc]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}]
[-HKEY_CLASSES_ROOT\clsid\{a0729639-d831-46c9-811b-9b0aa79fb45a}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a0729639-d831-46c9-811b-9b0aa79fb45a}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a0729639-d831-46c9-811b-9b0aa79fb45a}"=-

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)


Please download MBRCheck by GeeksToGo to your desktop.
See the download links under this icon

• Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (How to attach items to your post)

Please download Win32kDiag to the root of your C:\ drive. It must be saved here or the below will not work!

• Now press and hold the Windows key on your keyboard, then press the letter r on your keyboard.
• This opens the Run dialog box.
• Then copy the below bold text and paste it into the Open: text-field and press ENTER.
  C:\win32kdiag.exe -f -r
  
• When it's finished, there will be a log called Win32kDiag.txt on your desktop.
• Attach this log to your next message. (How to attach items to your post)

Now we need to scan the system with this special tool.

• Please download Junction.zip and save it to your root folder (C:\Junction.zip)
• Unzip it and put junction.exe in the root folder (C:\junction.exe)
• Now click Start => Run... => Copy and paste the following command in the run box and click OK:
  
  cmd /c junction -s c:\ >C:\log.txt
  ​
• A command prompt window opens and also a license agreement from SysInternals will appear.
• Accept the license agreement and the scan will begin.
• Wait until a log file opens. Attach this C:\log.txt when it finishes (the command prompt window will close when it finishes). (How to attach items to your post)
• NOTE: It scans your whole hard disk so if can take a long time. Be patient and don't do anything else while it is scanning.

Now install the current version of Sun Java from: Sun Java Runtime Environment

Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​

 

The computer is running better, but still shows signs of infection.
Combofix appeared to hang up every time I tried to run it....I waited for an hour.
Juntion.exe also appeared to fail, so no log.txt.

 

Please download OTL by Old Timer to your desktop.

• See the download links under this icon:
• Double-click OTL.exe to run (Vista and Win7 right click and select Run as administrator)
• When OTL opens, copy the text in the code box below and paste it into the text-field.
  
  Code:

  [COLOR="DarkRed"]:processes[/COLOR]
  killallprocesses
  [COLOR="DarkRed"]:otl[/COLOR]
  [COLOR="DarkRed"]:services [/COLOR]
  [COLOR="DarkRed"]:files[/COLOR]
  C:\ComboFix
  C:\Program Files\3F2F4
  C:\Program Files\Internet Explorer\41BF
  C:\Program Files\Internet Explorer\E08E.tmp
  C:\Program Files\Internet Explorer\E455.tmp
  C:\Program Files\Internet Explorer\EC12.tmp
  C:\Program Files\Internet Explorer\F0F3.tmp
  C:\Users\Mimi\Desktop\ComboFix.exe
  C:\Users\Mimi\AppData\Roaming\F713F
  C:\Users\Mimi\desktop\CouponPrinter.exe
  C:\Users\Mimi\desktop\Guard Online .lnk
  C:\Program Files\Internet Explorer\15B1.tmp
  C:\Program Files\Internet Explorer\32F1.tmp
  C:\Program Files\Internet Explorer\33BC.tmp
  C:\Program Files\Internet Explorer\48B2.tmp
  C:\Program Files\Internet Explorer\4A0A.tmp
  C:\Program Files\Internet Explorer\531E.tmp
  C:\Program Files\Internet Explorer\9CBB.tmp
  C:\Program Files\Internet Explorer\A811.tmp
  C:\Program Files\Internet Explorer\E88A.tmp
  c:\users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crss.exe
  C:\Windows\Temp\SPL9F2B.tmp
  C:\Windows\Temp\SPLF7A7.tmp
  C:\Windows\Temp\TMP000000054A564477882D2933
  C:\Windows\Temp\TMP00000031B04CFE1605EC47CF
  C:\Windows\Temp\TMP00000002D98DAC85FD373E6B
  C:\Users\Mimi\AppData\Local\Temp\B5D6.tmp
  C:\Users\Mimi\AppData\Local\Temp\C0AF.tmp
  C:\Users\Mimi\AppData\Local\Temp\CVR22CB.tmp
  C:\Users\Mimi\AppData\Local\Temp\DX99AF.tmp
  C:\Users\Mimi\AppData\Local\Temp\DX99AF.tmp.exe
  C:\Users\Mimi\AppData\Local\Temp\EF8B.tmp
  C:\Users\Mimi\AppData\Local\Temp\scs230A.tmp
  C:\Users\Mimi\AppData\Local\Temp\scs2359.tmp
  C:\Users\Mimi\AppData\Local\Temp\{3BAFBB0F-1A8F-4C74-A361-FD444DCD1C94}.tmp
  C:\Users\Mimi\AppData\Local\Temp\{8B48170E-1905-4F3C-A7B2-3D5B5B428544}.tmp
  C:\Users\Mimi\AppData\Local\Temp\{F2C06EE3-9872-46E0-A095-EE04C233FFF3}.tmp
  c:\windows\$NtUninstallKB8676$
  c:\users\Mimi\AppData\Roaming\lsQJ7dEK8R9YwUe
  c:\users\Mimi\AppData\Roaming\T2onF4pmH
  c:\users\Mimi\AppData\Roaming\kiivvD2nFpHsJK
  c:\users\Mimi\AppData\Roaming\DkUUVVelOBtz0yA
  c:\users\Mimi\AppData\Roaming\q6ssWJ77fE8ZhYw
  c:\users\Mimi\AppData\Roaming\mUUVVrlOBt
  c:\users\Mimi\AppData\Roaming\zxS2ibF3pG
  c:\users\Mimi\AppData\Roaming\m3pmG5aQJdKfLTq
  c:\users\Mimi\AppData\Roaming\Hv48hXkUVelBtyv
  c:\users\Mimi\AppData\Roaming\iYxnH7ETwr
  c:\users\Mimi\AppData\Roaming\ATjerN0Sbp4HWLT
  c:\users\Mimi\AppData\Roaming\djerN0Sbp4HWLTY
  c:\users\Mimi\AppData\Roaming\pIAo5E9Cz1baKey
  c:\users\Mimi\AppData\Roaming\XKZI04LwP3WZOis
  c:\users\Mimi\AppData\Roaming\ipppnGG4aH6sK7E
  c:\users\Mimi\AppData\Roaming\Qs6d8lrN12GJdKf
  c:\users\Mimi\AppData\Roaming\E9ggTTZqjYCwIVl
  c:\users\Mimi\AppData\Roaming\SbbbD3p4aH6sK7E
  c:\users\Mimi\AppData\Roaming\UzOONyxA0uvSiF
  C:\Windows\Temp\IE92867.tmp
  C:\Users\Mimi\AppData\Local\Temp\870A.dir
  C:\Users\Mimi\AppData\Local\Temp\g2m3062.tmp
  C:\Users\Mimi\AppData\Local\Temp\is-4L1Q1.tmp
  C:\Users\Mimi\AppData\Local\Temp\is-P5EM1.tmp
  C:\Users\Mimi\AppData\Local\Temp\is-S367K.tmp
  C:\Users\Mimi\AppData\Local\Temp\is-TJRN1.tmp
  C:\Users\Mimi\AppData\Local\Temp\{021D0D69-D4BE-40F8-A37C-351D15C94DA2}
  C:\Users\Mimi\AppData\Local\Temp\{0922254C-D2B1-45B2-9B74-C5D75773E1F7}
  C:\Users\Mimi\AppData\Local\Temp\{18857B3B-0E9C-4E1B-A6EE-959823B29807}
  C:\Users\Mimi\AppData\Local\Temp\{41693214-2591-4653-BD4B-B296EE64A639}
  C:\Users\Mimi\AppData\Local\Temp\{4CA95860-312B-48DA-8A25-F0F6257C6EDA}
  C:\Users\Mimi\AppData\Local\Temp\{7087CA30-A12F-44F1-90F9-3C693A8487B2}
  C:\Users\Mimi\AppData\Local\Temp\{72AF4270-5BF5-469E-8495-6E9650F21681}
  C:\Users\Mimi\AppData\Local\Temp\{777F27E9-C231-4ADF-8CFB-7AD7FACA3DDC}
  C:\Users\Mimi\AppData\Local\Temp\{80AF8A54-354F-49E7-BD50-C630DD938C90}
  C:\Users\Mimi\AppData\Local\Temp\{A284C62D-8F56-4BE6-81E9-60586455B729}
  C:\Users\Mimi\AppData\Local\Temp\{C52C0579-C4DA-41A2-AAE9-B6F052780011}
  C:\Users\Mimi\AppData\Local\Temp\{C6D2F466-B1DE-496B-BF91-1BBA4D8A852A}
  C:\Users\Mimi\AppData\Local\Temp\{CCDF55FA-E96B-4202-843E-E91CA49ED208}
  C:\Users\Mimi\AppData\Local\Temp\{fb66a111-44d3-4307-b961-db0cad92a322}
  C:\Users\Mimi\AppData\Local\Temp\{FE0F66B0-210C-4731-8F02-146739BE7C49}
  xcopy %temp%\smtmp\1 "%programdata%\start menu" /s /i /h /y /c
  xcopy %temp%\smtmp\2 "%appdata%\microsoft\internet explorer\quick launch" /s /i /h /y /c
  xcopy %temp%\smtmp\3 "%appdata%\microsoft\internet explorer\quick launch\user pinned\taskbar" /s /i /h /y /c
  xcopy %temp%\smtmp\4 "%programdata%\desktop" /s /i /h /y /c
  [COLOR="DarkRed"]:reg[/COLOR]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}]
  [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
  [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}]
  [-HKEY_CLASSES_ROOT\clsid\{a0729639-d831-46c9-811b-9b0aa79fb45a}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a0729639-d831-46c9-811b-9b0aa79fb45a}]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{a0729639-d831-46c9-811b-9b0aa79fb45a}"=-
  [COLOR="DarkRed"]:commands[/COLOR]
  [purity]
  [emptytemp]
  [emptyflash]
  

• Now click the button.
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• When complete, Notepad will open.
• Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (How to attach items to your post)

• Now open OTL again and click the button
  Note: This automatically updates the OTL.txt log on your desktop.
• Attach OTL.txt to your next message. (How to attach items to your post)

Norton 360 is still in your logs, is it functioning? I see you have MSE installed as well. Please choose one to keep and then uninstall the other.

Please download a new ComboFix.exe to your desktop and try run it (without using any script). If it does not work in Normal Mode, try Safe Mode. Then attach its latest log. (How to attach items to your post)

Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

 

Seems like we are making progress.
No external signs of malware popping up.
Logs are attached.
I have not yet turned off and turned on the system restore.
Should I do that yet?
Finally, the Norton Software is NOT functioning as best as I can tell - it does not show up in programgs list, there is no task bar icon, and I cannot uninstall it via the control panel.

Thanks

 

Not yet. I will let you know.

You're right it doesn't look like it's functioning. Just some traces of it in your logs is all. Please download and run the following: Norton Removal Tool
See the download links under this icon:

Did you skip this step entirely or just forgot to attach the updated OTL.txt log? I would like to review it to make sure you are clean before giving you final clean-up steps. However, the rest of your logs are looking very good

 

Ran Norton Removal Tool.
Ran OTL
Log attached.
I did run OTL before, but must have forgotten to add log file.

 

Very good.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Thanks so much!!!
Not sure how you provide this phenomenal service for free.
I recommend you to everyone!!
I did purchase the two software programs that you recommended if that helps.

 

You're welcome. Surf safely!