re-chinese program via avast

waddler_8

The hosts entries are ok, they're Spybot S&D's immunization.

waddler_8

Everything looks ok, there's a few minor things to clear up (Babylon, Facemoods) but other than that there's nothing of real note.


Download aswMBR and save it to your Desktop.

http://public.avast.com/~gmerek/aswMBR.exe

• Right click aswMBR.exe & choose "Run as Administrator" to run it.
• Click the Scan button.
• Wait till the scan reports "Scan finished successfully"
• Click Save log & save the log to your desktop.
• Click OK
• Two files will be created, aswMBR.txt & a file named MBR.dat
• Click EXIT.
• Copy & Paste the contents of aswMBR.txt into your next reply.

Don't click to fix anything, just post the log

joe134

waddler_8 wrote: »

Everything looks ok, there's a few minor things to clear up (Babylon, Facemoods) but other than that there's nothing of real note.


Download aswMBR and save it to your Desktop.

http://public.avast.com/~gmerek/aswMBR.exe

• Right click aswMBR.exe & choose "Run as Administrator" to run it.
• Click the Scan button.
• Wait till the scan reports "Scan finished successfully"
• Click Save log & save the log to your desktop.
• Click OK
• Two files will be created, aswMBR.txt & a file named MBR.dat
• Click EXIT.
• Copy & Paste the contents of aswMBR.txt into your next reply.

Don't click to fix anything, just post the log

Hi, Had babylon, and facemoods trouble before. can I get rid of OTL first? or leave it ?

waddler_8

Leave it for a while.

joe134

joe134 wrote: »

Hi, Had babylon, and facemoods trouble before. can I get rid of OTL first? or leave it ?

How do I save to desktop.?got aswmbr.exe. usually just run.?

waddler_8

You can save it as normal to the downloads folder. - as with OTL.

joe134

waddler_8 wrote: »

You can save it as normal to the downloads folder. - as with OTL.

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-10 22:07:05

---

22:07:05.950 OS Version: Windows 6.0.6002 Service Pack 2
22:07:05.951 Number of processors: 2 586 0xF0D
22:07:05.952 ComputerName: JOE-PC UserName: joe
22:07:08.749 Initialize success
22:07:09.691 AVAST engine defs: 12111001
22:07:50.858 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
22:07:50.874 Disk 0 Vendor: Hitachi_ BBFO Size: 238475MB BusType: 3
22:07:50.889 Disk 0 MBR read successfully
22:07:50.889 Disk 0 MBR scan
22:07:50.889 Disk 0 unknown MBR code
22:07:50.889 Disk 0 Partition 1 00 12 Compaq diag NTFS 10997 MB offset 63
22:07:50.921 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 113860 MB offset 22523904
22:07:50.936 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 110276 MB offset 255709184
22:07:50.952 Disk 0 Partition 4 00 12 Compaq diag NTFS 3340 MB offset 481554432
22:07:50.967 Disk 0 scanning sectors +488394752
22:07:51.014 Disk 0 scanning C:\Windows\system32\drivers
22:08:00.733 Service scanning
22:08:31.340 Modules scanning
22:08:43.461 Disk 0 trace - called modules:
22:08:43.493 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
22:08:43.493 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87185370]
22:08:43.508 3 CLASSPNP.SYS[899b08b3] -> nt!IofCallDriver -> [0x865e93f8]
22:08:43.508 5 acpi.sys[890946bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x86605028]
22:08:44.101 AVAST engine scan C:\Windows
22:08:46.160 AVAST engine scan C:\Windows\system32
22:10:45.541 AVAST engine scan C:\Windows\system32\drivers
22:11:00.267 AVAST engine scan C:\Users\joe
22:13:05.707 AVAST engine scan C:\ProgramData
22:15:04.063 Scan finished successfully
22:15:44.795 Disk 0 MBR has been saved successfully to "C:\Users\joe\Downloads\MBR.dat"
22:15:44.795 The log file has been saved successfully to "C:\Users\joe\Downloads\aswMBR.txt"


Hope this is ok. only got this one file;

waddler_8

That's all looks ok, further instructions to follow but I've got to nip out. It'll possibly be tomorrow now.

joe134

waddler_8 wrote: »

That's all looks ok, further instructions to follow but I've got to nip out. It'll possibly be tomorrow now.

Ok. Thanks waddler. very much appreciated.:beer:

waddler_8

• Double-click OTL.exe to start the program.
• Allow the UAC prompt
• Copy and Paste all the following code into the textbox. Do not include the word Code

  :otl
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0    
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
  [2012/03/24 11:37:08 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\joe\AppData\Roaming\Mozilla\Firefox\Profiles\earbh9qp.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
  [2012/03/24 14:44:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\joe\AppData\Roaming\Mozilla\Firefox\Profiles\earbh9qp.default\extensions\ffxtlbr@babylon.com
  [2011/09/12 13:37:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\joe\AppData\Roaming\Mozilla\Firefox\Profiles\earbh9qp.default\extensions\ffxtlbr@Facemoods.com
  [2012/06/12 17:00:35 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\joe\AppData\Roaming\Mozilla\Firefox\Profiles\earbh9qp.default\extensions\ffxtlbr@funmoods.com
  
  :commands
  [EMPTYTEMP]
  [CREATERESTOREPOINT]
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Click OK & allow it to do so if asked.
• The report should appear in Notepad after the reboot.
• Copy and Paste that report in your next reply.