Windows Explorer Won't Open AT ALL!!!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by totalconfusion, Aug 17, 2007.

  1. totalconfusion

    totalconfusion Private E-2

    When I start my computer all that I get is the background. No icons, no start menu and I can't run anything that requires Windows Explorer, so I can't do most of what is in the "Read & Run Me First" guide. I am at a complete loss so I am going to start by posting my HijackThis log.

    Thanks for any help in advance!
     

    Attached Files:

  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Welcome to MajorGeeks.com, please follow our standard cleaning procedures:

    Please try Safe Mode w/ Networking if you have a broadband connection.

    [​IMG] Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

    • Make sure you check version numbers and get all updates.
    [​IMG] Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

    [​IMG]After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

    [​IMG] Downloading, Installing, and Running HijackThis
    • Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..
    [​IMG]When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
    • CounterSpy Log - only for Windows XP, 2K, & NT users
    • AVG Antispyware Log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
    • Bitdefender Log - from step 6
    • Panda Scan Log - from step 6
    • runkeys.txt - the log from GetRunKey.bat
    • newfiles.txt - the log from ShowNew.bat
    • HijackThis Log
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
  3. totalconfusion

    totalconfusion Private E-2

    :eek: So sorry that I didn't do a good enough job the first time around. Here we go again:

    I don't know what is wrong with my computer, as I said before, when I start my computer all that I get is the background. No icons, no start menu and I can't run anything that requires Windows Explorer.

    Following the “READ & RUN ME FIRST” guide, here is the detail of what I was able to do on this computer:

    I looked at the “special removal procedures”, but since I don’t know what is wrong I didn’t find anything helpful.

    I began in safe mode (network) logged in as administrator. There is no desktop at all in safe mode.

    0:

    ADD/REMOVE I went through add/remove programs and didn’t find anything on that list to remove.

    MSCONFIG I returned this to normal startup in the general tab.

    1:

    Emptied AVG quarantine files.

    Downloaded and installed CCleaner.

    2:

    Could not access hidden files.

    3:

    As far as I can tell I am not running multiple antivirus or firewalls.

    4:

    Downloaded GetRunKey and ShowNew, but could not extract either program.

    Downloaded, installed and updated SpyBot. Then ran spybot.

    Downloaded CounterSpy. When I tried to install I got a message that said the system administrator has set policies to prevent this installation.
    Opened AVG Anti-Spyware and applied all actions as directed in your guide (including “generate report after every scan”). AVG did not generate a report, but deleted everything that it found. I ran AVG a 2nd time, got a report this time.

    5:

    Rebooted into safe mode with no internet connection.

    Ran Ccleaner from each account.

    Ran SpyBot. It found DriveCleaner 2006 – 2 entries and could not fix. The message said that the reason could be that the associated files are running. I also activated the immunize feature.

    COULD NOT FIND CounterSpy on my computer. Reconnected to internet and went back online. Downloaded again, it would not install. Rebooted in normal mode and installed. Rebooted in safe mode. Could NOT find program! It should have installed to:
    C:\Program Files\Sunbelt Software\ CounterSpy
    I did a test and downloaded it on anther computer and found it easily.

    Ran AVG Anti-Spyware, nothing found. Saved report.

    6A:

    Could not find old versions of Java to delete, began to download recommended version but it did not work. Rebooted and downloaded in normal mode.

    Rebooted to safe mode.

    Ran bitdefender, would not work in safe mode. Rebooted to normal and ran bitdefender online and saved report.

    Ran PandaActive scan online. It did not finish. Saved report but could not find it. Ran PandaActive scan a 2nd time. Saved report.

    6B:

    Downloaded GetRunKey.zip and ShowNew.zip. Neither file will open and extract files. Was not able to complete this operation.

    7:

    Ran HijackThis and saved log per instructions titled “Downloading, Installing, and Running HijackThis”.

    Attaching first 3 reports to this posting:
    AVG Anti-Spyware
    AVG Anti-Spyware
    Bitdefender

    The rest will follow.
     

    Attached Files:

  4. totalconfusion

    totalconfusion Private E-2

    These are the other 2 reports.
    Panda
    HijackThis

    I really appreciate any help that you can offer. Thanks so much!
     

    Attached Files:

  5. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

  6. totalconfusion

    totalconfusion Private E-2

    I have to use Windows Task Manager to do anything on that computer. I have downloaded both of those programs, but the computer will not extract the files. The first time it started to extract and then just closed, after that when I try to open it, nothing happens. So I could never run the programs.

    Do you have any suggestions for me?
     
  7. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Can you do this in Safe Mode?

    Also, do you have the Windows disc?

    Does Windows load at all?
     
  8. totalconfusion

    totalconfusion Private E-2

    Yes, Windows does load, it is Windows Explorer that will not work, and there is no desktop, no icons, no start button. I have to Ctrl-Alt-Del opening the task manager to access anything on the computer.

    No, I don't have the Windows disc.

    I just tried it again in both normal and safe modes. These are the results:

    IN NORMAL MODE
    I just restarted the computer in normal mode. I CLICKED ON THE GetRunKey.zip file (CLICKED RIGHT ON IT!) and got the following message:

    Windows cannot find "C:\Documents and Settings\Owner\Desktop\Stuff\GetRunKey.zip". Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

    Next, (in the Windows Task Manager) I clicked on ShowNew.zip to open it. A window came up and I could see that there were 4 files in it and then it disappeared.

    In Windows Task Manager it does not show any applications running.

    SAFE MODE
    I just rebooted into safe mode. Tried to open GetRunKey.zip. A window started to open for a fraction of a second but closed.

    Next I tried to open ShowNew.zip it did the same thing.

    I tried 3 times for each one of these and got the same thing each time.
     
  9. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, rename HijackThis some "analyzethis.exe", due the newer infections this must be done. Attach the new logs once complete.

    Restart the computer, try to login normally, when nothing comes up, bring up task manager. Try typing in "explorer.exe" with the quotations and press enter. What happens?
     
  10. totalconfusion

    totalconfusion Private E-2

    Oops! I thought that I did rename it, but I renamed the folder that it is in. I just renamed it and rebooted before I did the scan but when it ran it showed up on task manager as HijackThis. Is that what should happen?

    When I typed "explorer.exe" the whole (normal) background came up for about a second, then disappeared again.
     

    Attached Files:

  11. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    I am going to post a fix based on what logs you have, however you will have to download the utilities needed on a CD or USB drive and run them from task manager to perform the steps below.

    Now scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=pavili on&pf=laptop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    O2 - BHO: (no name) - {963EE095-1347-4D8E-B04B-72FA4588D284} - C:\WINDOWS\system32\geebc.dll
    O2 - BHO: (no name) - {C84D8A0A-E708-42B6-90CA-9C30956A87C6} - C:\WINDOWS\system32\ssqpqqq.dll

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - Startup: MP3 Rocket (silent).lnk = C:\Program Files\MP3 Rocket\MP3Rocket_on_startup.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O20 - Winlogon Notify: geebc - C:\WINDOWS\system32\geebc.dll
    O20 - Winlogon Notify: ssqpqqq - C:\WINDOWS\SYSTEM32\ssqpqqq.dll

    Again, make sure ALL browser windows are closed when you click FIX.

    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt

    After you have rebooted from running Avenger please procede.

    Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main ATF Cleaner menu to close the program.

    After you complete this post, reboot again and attach a fresh HJT log.
     
  12. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Once you have completed my previous post, try again to login normally. Let me know what happens.
     
  13. totalconfusion

    totalconfusion Private E-2

    Scanned with HijackThis and could not find the following entry:

    O2 - BHO: (no name) - {963EE095-1347-4D8E-B04B-72FA4588D284} - C:\WINDOWS\system32\geebc.dll

    Fixed all other entries that you listed.

    Downloaded next two utilities on a CD from another computer.

    Opened Avenger from CD using task manager.

    Avenger:

    Followed all steps listed. When I clicked on the traffic light icon and "ok" I got these error messages:
    Fatal error: Could not create new script file.
    Could not log error---aborting now!

    I tried again and got the reboot message.:)

    When it rebooted the Avenger report came up. I saved it to the desktop because I could not find it where you said it would be.

    I also got 2 error messages:
    The application or DLL C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll is nto a valid Windows image. Please check this against your installation diskette.

    C:\WINDOWS\Microsoft.NET\fRAMEWORK\V1.1.4322\mscorwks.dll could not be loaded

    ALSO HAVE THE FULL DESKTOP BACK! :D

    Ran ATF Cleaner online and rebooted.

    Still got the two above error messages and still have the desktop back!

    Ran HijackThis and attached report.
     
  14. totalconfusion

    totalconfusion Private E-2

    What should I do now? :confused
     
  15. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    If you have your desktop back try to run CounterSpy from the READ ME.

    Also, can you attach logs from GetRunKey and ShowNew?
     
  16. totalconfusion

    totalconfusion Private E-2

    I ran CounterSpy, GetRunKey and ShowNew and have attached all logs.
     
  17. totalconfusion

    totalconfusion Private E-2

    Ok, NOW I have attached the logs.
     

    Attached Files:

  18. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Attach a fresh HJT log, be sure it's renamed to "analyzethis.exe" so it will display the Vundo infection you have.
     
  19. totalconfusion

    totalconfusion Private E-2

    I did rename it to analyzethis.exe. On the computer I see the icon and under the icon it says "analyzethis.exe" and under that it says "HijackThis". I checked the properties and the description is "HijackThis" and there are no options for me to change that. Soooo when I pull up the program at the top of the little screen it says HijackThis-v1.99.1.

    And now the computer is saying that it cannot find any wireless networks in range! UGH!!!

    Please let me know what to do about renaming HijackThis, and I will work at getting it back online.

    By the way....we are not able to go online through our own ISP right now...have to search for another wireless connection in the area. Is it possible that we are having trouble with our connection because of the vundo infection?

    I just need to let you know that I think you are AWESOME...thanks so much for all your help! :drool
     
  20. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    On the executable file for HijackThis, select it and press F2, type analyzethis and press enter.

    After you do this, run the program and attach a new log.
     
  21. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Anything is possible but in this case no I do not believe this is your problem with the wireless.
     
  22. totalconfusion

    totalconfusion Private E-2

    Here is the new HJT log.
     

    Attached Files:

  23. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

    Pre-Instructions:
    Please print out these instructions so that you can operate with All Browser Windows CLOSED.


    Step 1:
    Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

    Step 2:
    Now scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    Again, make sure ALL browser windows are closed when you click FIX.

    Step 3:
    Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.
    Step 4:
    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt

    Step 5: Begin here after rebooting from Step 4!
    Next Reset Web Settings & Default Security Settings

    Note for IE 6 users:
    To Reset Web Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

    To Default Security Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

    Note for IE 7 users:
    Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


    Step 6:
    Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main ATF Cleaner menu to close the program.


    Step 7:
    After you have completed ALL of the above in the correct order, please attach the following logs.
    • HijackThis Log
    • ShowNew Log
    • GetRunKey Log
    • Avenger Log
    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.
     
  24. totalconfusion

    totalconfusion Private E-2

    Disabled antivirus and antispy programs.

    Removed J2SE Runtime Environment 5.0 Update 6 and Java(TM) SE Runtime Environment 6 Update 1

    Ran HJT

    Could not find any of the following:

    R1 -
    HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=pavilion&pf=laptop


    O2 - BHO: (no name) -
    {E2D97287-6787-4F73-9CDC-8BA6FC295E96} -
    C:\WINDOWS\system32\geebc.dll
    I found one that was close (but did not fix):
    O2 - BHO: (no name) - {116C4007-E89B46C5-B807-C179BF01FD4} -
    C:\WINDOWS\system32\geebc.dll (file missing)


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
    Files\QuickTime\qttask.exe" –atboottime
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common
    Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common
    Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program
    Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program
    Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
    Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    Made the fixme.reg file and added to registry.

    Ran Avenger and rebooted. Got an error message: Cannot find the avenger.txt file. Do you want to create a new file?

    Deleted and reinstalled Avenger, ran Avenger, rebooted and got the same error message. I could not find a log.

    Reset settings and deleted cookies and files on Internet Explorer.

    Reset security settings on Internet Explorer.

    Ran ATF Cleaner.

    Rebooted and got the following 2 error msgs:

    Hpqthb08.exe – Bad Image
    The application or DLL C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll is nto a valid Windows image. Please check this against your installation diskette.

    .NET Framework Initialization Error
    C:\WINDOWS\Microsoft.NET\fRAMEWORK\V1.1.4322\mscorwks.dll could not be loaded

    Attaching requested logs except Avenger because I could not get it to work.
     

    Attached Files:

  25. totalconfusion

    totalconfusion Private E-2

    I was wondering...now that I have the desktop back should I do the "read me first" all over again?
     
  26. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, have HJT fix the below entry..

    Now, we need to run Avenger once more...
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt

    Once you complete the above, reboot and attach the Avenger log along with a fresh HJT log.

    Also, how are things running now?
     
  27. totalconfusion

    totalconfusion Private E-2

    Had HJT fix the entry.

    Ran Avenger.

    Ran HJT again.

    Attaching logs.

    The computer seems to be running fine, but on reboot I still got the two error messages.
     

    Attached Files:

  28. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Which two errors?
     
  29. totalconfusion

    totalconfusion Private E-2

    I still get these two errors when I boot the computer:

    Hpqthb08.exe – Bad Image
    The application or DLL C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll is nto a valid Windows image. Please check this against your installation diskette.

    .NET Framework Initialization Error
    C:\WINDOWS\Microsoft.NET\fRAMEWORK\V1.1.4322\mscorwks.dll could not be loaded
     
  30. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Okay! Because those are not malware related I am going to suggest posting those in the Software Forum.
     
  31. totalconfusion

    totalconfusion Private E-2

    So everything else is ok now?
     
  32. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Yes! Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, and the C:\combofix.txt log that was created.
    3. If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger, the log (avenger.txt) and C:\avenger.
    8. If we had you download any registry patches like fixme.reg, fixme1.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    10. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds