[xxmaxixx]

Click on Restore MS Hosts File to restore your Hosts file to its default condition.
There was an error cannot create file.

[Advertisements]

Hm? Defiant little file, isn't it! I have another trick up my sleeve. Let's do it this way.

• Double click on the to open the program. On Vista/Win7/Win8 right click select Run As Administrator to start the program. If prompted by UAC, please allow it.
• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :COMMANDS
  [CREATERESTOREPOINT]
  
  :Files
  C:\WINDOWS\system32\drivers\etc\hosts
  
  :Commands
  [Reboot]
  

• Make sure all other windows are closed.
• Click the Run Fix button at the top
• Let the program run uninterrupted. The computer should reboot when the scan is done. If not, please reboot the computer.
• Post the log that is found in C:\_OTL\Moved Files in your next reply.
• Open OTL again and click the Quick Scan button.

Ni need for the fix log at the moment...


Next:

Please follow these instructions to a "T".

• Right-click on HostsXpert.exe and select Run as Administrator to launch the programme.
• When prompted with:

HOSTS file does not exist, press OK to create HOSTS file, Cancel to quit.

• Select OK.
• Check to see if top button on left hand side says Make Writable?
  
  • If it does. click on it then proceed to next instruction.
  • If not, just proceed to next instruction
• Click on Restore MS Hosts File to restore your Hosts file to its default condition
• When prompted to confirm, click OK.
• Click on the Download button (lower left hand side)
  
  • Click on MVPs Hosts... button.
  • Click on Replace button.
  • Press OK in the box that pops up. (HostsXpert will now download and update your Hosts file. If prompted about DNS, just ignore it click on OK etc)
• When finished.
  • Click on File Handling button.
  • Click on Make Read Only? to secure it against infection.
• Exit the programme.

Next:

• Right click on the and select Run As Administrator to open the program.. If prompted by UAC, please allow it.
• Click ON the Quick Scan button.

Please post the following log in your next reply:

C:\_OTL\Moved Files

[DonnaB]

Hm? Defiant little file, isn't it! I have another trick up my sleeve. Let's do it this way.

• Double click on the to open the program. On Vista/Win7/Win8 right click select Run As Administrator to start the program. If prompted by UAC, please allow it.
• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :COMMANDS
  [CREATERESTOREPOINT]
  
  :Files
  C:\WINDOWS\system32\drivers\etc\hosts
  
  :Commands
  [Reboot]
  

• Make sure all other windows are closed.
• Click the Run Fix button at the top
• Let the program run uninterrupted. The computer should reboot when the scan is done. If not, please reboot the computer.
• Post the log that is found in C:\_OTL\Moved Files in your next reply.
• Open OTL again and click the Quick Scan button.

Ni need for the fix log at the moment...


Next:

Please follow these instructions to a "T".

• Right-click on HostsXpert.exe and select Run as Administrator to launch the programme.
• When prompted with:

HOSTS file does not exist, press OK to create HOSTS file, Cancel to quit.

• Select OK.
• Check to see if top button on left hand side says Make Writable?
  
  • If it does. click on it then proceed to next instruction.
  • If not, just proceed to next instruction
• Click on Restore MS Hosts File to restore your Hosts file to its default condition
• When prompted to confirm, click OK.
• Click on the Download button (lower left hand side)
  
  • Click on MVPs Hosts... button.
  • Click on Replace button.
  • Press OK in the box that pops up. (HostsXpert will now download and update your Hosts file. If prompted about DNS, just ignore it click on OK etc)
• When finished.
  • Click on File Handling button.
  • Click on Make Read Only? to secure it against infection.
• Exit the programme.

Next:

• Right click on the and select Run As Administrator to open the program.. If prompted by UAC, please allow it.
• Click ON the Quick Scan button.

Please post the following log in your next reply:

C:\_OTL\Moved Files

[xxmaxixx]

========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
File move failed. C:\WINDOWS\system32\drivers\etc\hosts scheduled to be moved on reboot.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.69.0 log created on 03212014_110012
Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\system32\drivers\etc\hosts scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

I can't seem to run restore MS hosts. Same issue as before.

Edited by xxmaxixx, 20 March 2014 - 09:23 PM.

[DonnaB]

Ok. Let's see what the MSFixIt will accomplish in this situation:

Click here.

Under Summary click on "Fix it for me". You'll be directed to the MSFixIt and follow the onscreen prompts.

Once complete, make sure to reboot. Please run another Quick Scan of OTL and provide the log in your next post.

[xxmaxixx]

OTL logfile created on: 23/3/2014 9:42:20 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\030114\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

3.00 Gb Total Physical Memory | 1.92 Gb Available Physical Memory | 64.09% Memory free
6.19 Gb Paging File | 5.07 Gb Available in Paging File | 81.89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.23 Gb Total Space | 154.28 Gb Free Space | 69.42% Space Free | Partition Type: NTFS
Drive D: | 10.66 Gb Total Space | 2.25 Gb Free Space | 21.11% Space Free | Partition Type: NTFS

Computer Name: 030114-PC | User Name: 030114 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/03/15 13:23:36 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2014/03/15 13:22:33 | 001,017,424 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2014/03/15 13:22:27 | 000,896,592 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
PRC - [2014/03/15 13:22:26 | 000,689,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2014/03/15 13:22:26 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2014/03/07 10:48:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\030114\Downloads\OTL.exe
PRC - [2014/02/15 10:29:54 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2014/01/03 23:27:25 | 000,431,672 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2014/01/03 23:27:00 | 001,012,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
PRC - [2013/12/19 02:42:32 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2009/04/10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/09/21 03:12:02 | 000,671,744 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files\DigitalPersona\Bin\DpAgent.exe
PRC - [2007/09/21 03:02:58 | 000,299,008 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe
PRC - [2007/09/15 16:29:10 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPStart.exe
PRC - [2007/09/06 05:09:54 | 000,727,592 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2007/07/25 14:02:44 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/07/25 14:02:42 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/03/09 17:50:02 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\WINDOWS\RtHDVCpl.exe
PRC - [2007/01/17 21:34:18 | 000,634,880 | ---- | M] (Motorola Inc.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe


========== Modules (No Company Name) ==========

MOD - [2014/02/15 10:29:54 | 003,578,992 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2014/02/12 20:58:32 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/12 20:58:10 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2007/10/01 11:33:32 | 000,066,856 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\common\MCEMediaStatus.dll
MOD - [2007/09/06 05:03:06 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll
MOD - [2007/09/06 04:52:04 | 000,389,120 | ---- | M] () -- C:\WINDOWS\System32\btwhidcs.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Users\030114\AppData\Local\Temp\000862~1.EXE -- (0008621394465332mcinstcleanup)
SRV - [2014/03/15 14:58:18 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/03/15 13:23:36 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2014/03/15 13:22:33 | 001,017,424 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2014/03/15 13:22:27 | 000,896,592 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2014/03/15 13:22:26 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2014/02/15 10:29:54 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/01/03 23:27:00 | 001,012,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)
SRV - [2013/12/19 02:42:32 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2008/01/18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/21 03:02:58 | 000,299,008 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2007/07/25 14:02:44 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2007/03/06 02:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2014/01/03 23:29:47 | 000,135,648 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2014/01/03 23:29:47 | 000,090,400 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2014/01/03 23:29:47 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2013/03/25 15:44:38 | 000,113,024 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\avfwot.sys -- (avfwot)
DRV - [2013/03/25 15:44:38 | 000,092,448 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\avfwim.sys -- (avfwim)
DRV - [2013/03/25 15:44:01 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/10/03 06:02:06 | 009,905,096 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/10/01 11:34:02 | 000,039,408 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\HP\QuickPlay\000.fcl -- ({22D78859-9CE9-4B77-BF18-AC83E81A9263})
DRV - [2007/09/18 07:17:36 | 000,098,816 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007/08/29 07:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\atswpdrv.sys -- (ATSWPDRV)
DRV - [2007/07/12 02:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
DRV - [2007/06/28 23:09:56 | 002,222,080 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\NETw4v32.sys -- (NETw4v32)
DRV - [2007/06/19 09:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/03/22 14:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/02/25 06:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007/01/24 08:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007/01/17 21:38:52 | 000,983,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\smserial.sys -- (smserial)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...WEcL5rAfHx4GQDQ
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2014/01/05 12:33:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\030114\AppData\Roaming\Mozilla\Extensions
[2014/03/21 11:00:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\030114\AppData\Roaming\Mozilla\Firefox\Profiles\2yay9tml.default-1394173459890\extensions
[2014/02/15 10:29:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/02/15 10:29:55 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_1\
CHR - Extension: Google Wallet = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Gmail = C:\Users\030114\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2006/09/19 05:41:30 | 000,000,761 | R--- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)
O4 - HKLM..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe File not found
O4 - HKLM..\Run: [hpqSRMon] File not found
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {7114683A-020D-4D16-80FD-6ACE384B66DF} https://www.myseagat...ude/FPSPR70.ocx (FarPoint Spread 7.0 (OLEDB))
O16 - DPF: {F5FF8524-A033-4836-8370-5365E38FC516} https://www.myseagat...de/SPR32X35.ocx (FarPoint Spread 3.5)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BC4250E2-C731-4958-A86F-07521E0B6C7D}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\HPRadiance.jpg
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\HPRadiance.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/26 17:03:50 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 23:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/03/23 21:45:25 | 000,000,000 | ---D | C] -- C:\77c97111b3c58b1f093a2fc71cccee1b
[2014/03/11 16:08:11 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/03/11 15:55:56 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014/03/10 23:35:22 | 000,000,000 | ---D | C] -- C:\_OTL
[2014/03/07 14:24:25 | 000,000,000 | ---D | C] -- C:\Users\030114\Desktop\Old Firefox Data
[2014/03/07 14:17:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2014/03/07 14:16:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2014/03/07 14:16:56 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2014/03/07 14:16:56 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2014/03/07 13:09:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2014/03/07 12:49:11 | 000,000,000 | ---D | C] -- C:\Users\030114\Desktop\Avira IS 2014 New Key
[2014/03/07 10:47:06 | 000,000,000 | ---D | C] -- C:\Users\030114\AppData\Roaming\Oracle
[2014/03/07 10:45:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2014/03/07 10:43:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014/03/02 08:45:16 | 000,000,000 | ---D | C] -- C:\Windows\Migration

========== Files - Modified Within 30 Days ==========

[2014/03/23 21:40:08 | 000,000,163 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2014/03/23 21:39:40 | 000,031,966 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2014/03/23 21:39:40 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/03/23 21:39:39 | 000,031,966 | ---- | M] () -- C:\ProgramData\nvModes.001
[2014/03/23 21:39:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/03/23 21:39:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/03/23 21:39:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/03/23 21:39:02 | 3217,502,208 | -HS- | M] () -- C:\hiberfil.sys
[2014/03/23 21:35:15 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2014/03/21 18:58:38 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/03/21 18:58:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/03/19 17:05:00 | 000,001,931 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014/03/12 16:58:38 | 000,391,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2014/03/07 14:17:53 | 000,001,624 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2014/03/07 13:09:43 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2014/03/07 11:28:24 | 000,002,485 | ---- | M] () -- C:\Users\030114\Desktop\HiJackThis.lnk
[2014/03/03 09:52:37 | 000,680,420 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2014/03/03 09:52:37 | 000,136,800 | ---- | M] () -- C:\Windows\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2014/03/07 14:17:53 | 000,001,624 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2014/02/28 07:30:07 | 3217,502,208 | -HS- | C] () -- C:\hiberfil.sys
[2014/02/15 13:39:10 | 000,000,680 | ---- | C] () -- C:\Users\030114\AppData\Local\d3d9caps.dat
[2014/01/19 13:14:55 | 000,000,552 | ---- | C] () -- C:\Users\030114\AppData\Local\d3d8caps.dat
[2014/01/18 17:21:23 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2014/01/18 17:19:38 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2014/01/18 17:19:38 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2014/01/17 16:43:04 | 000,000,005 | ---- | C] () -- C:\Users\030114\AppData\Roaming\mbam.context.scan
[2014/01/17 16:38:52 | 000,000,645 | ---- | C] () -- C:\ProgramData\ProgramData.lnk
[2014/01/04 00:53:02 | 000,031,966 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2014/01/04 00:53:02 | 000,031,966 | ---- | C] () -- C:\ProgramData\nvModes.001
[2014/01/03 23:26:11 | 000,006,144 | ---- | C] () -- C:\Users\030114\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/01/03 23:09:09 | 000,027,430 | ---- | C] () -- C:\Users\030114\AppData\Roaming\nvModes.001
[2014/01/03 23:06:11 | 000,027,430 | ---- | C] () -- C:\Users\030114\AppData\Roaming\nvModes.dat

========== ZeroAccess Check ==========

[2006/11/02 20:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 01:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/10 23:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/10 23:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2014/01/03 21:58:11 | 000,000,000 | ---D | M] -- C:\Users\030114\AppData\Roaming\DigitalPersona
[2014/01/18 15:28:45 | 000,000,000 | ---D | M] -- C:\Users\030114\AppData\Roaming\MRTalk
[2014/03/07 10:47:06 | 000,000,000 | ---D | M] -- C:\Users\030114\AppData\Roaming\Oracle
[2014/01/19 12:08:48 | 000,000,000 | ---D | M] -- C:\Users\030114\AppData\Roaming\rmi

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >

[DonnaB]

Wow! That did not work. I have never had such a hard time resetting a hosts file. Let's see if we can accomplish this in Safe Mode...

Please do the following:

Reboot the computer and as soon as you see the splash screen (manufacturers logo) press and hold your "F8 Key" which should bring up the Windows Advanced Boot Options menu. Navigate to Safe Mode with Networking with you arrow keys and press your Enter key. Continue to advance to your desktop.

• Go to Computer > Local Disk C: and click on HostsXpert folder to open.
• Right-click on HostsXpert.exe and select Run as Administrator to launch the programme.
• When prompted with:

HOSTS file does not exist, press OK to create HOSTS file, Cancel to quit.

• Select OK.
• Check to see if top button on left hand side says Make Writable?
  
  • If it does. click on it then proceed to next instruction.
  • If not, just proceed to next instruction
• Click on Restore MS Hosts File to restore your Hosts file to its default condition
• When prompted to confirm, click OK.
• Click on the Download button (lower left hand side)
  
  • Click on MVPs Hosts... button.
  • Click on Replace button.
  • Press OK in the box that pops up. (HostsXpert will now download and update your Hosts file. If prompted about DNS, just ignore it click on OK etc)
• When finished.
  • Click on File Handling button.
  • Click on Make Read Only? to secure it against infection.
• Exit the programme.

Then, please provide another OTL quick Scan so I can verify the Hosts file has been reset.

I've got my fingers crossed!!

[xxmaxixx]

Now in safe mode. Regret to inform you i stil can't get past Restore MS hosts file.

[DonnaB]

Hm? You are right clicking and selecting Run as Administrator, right?

Is HostsXpert located here? > C:\HostsXpert

For some reason I don't even see it listed under [b]Files/Folders - Created Within 30 Days in the OTL log.

Regret to inform you i stil can't get past Restore MS hosts file.

What error did you receive this time? Same one as before?

Please allow me a moment to discuss this with my associates. I have never encountered the Hosts file causing such a fuss to be reset.

[xxmaxixx]

Hm? You are right clicking and selecting Run as Administrator, right?

Is HostsXpert located here? > C:\HostsXpert

For some reason I don't even see it listed under [b]Files/Folders - Created Within 30 Days in the OTL log.

Regret to inform you i stil can't get past Restore MS hosts file.

What error did you receive this time? Same one as before?

Please allow me a moment to discuss this with my associates. I have never encountered the Hosts file causing such a fuss to be reset.

Yes as admin and HostsXpert at C:/. Same as before. I reformatted based on recovery on D drive due to no more recovery discs.

Edited by xxmaxixx, 23 March 2014 - 09:41 PM.

[DonnaB]

Yes as admin and HostsXpert at C:/. Same as before. I reformatted based on recovery on D drive due to no more recovery discs.

I'm sorry xxmaxixx. When a post is edited, an email notification is not received. Did you restore the computer to factor settings?

Donna

[xxmaxixx]

&amp;nbsp;

Yes as admin and HostsXpert at C:/. Same as before. I reformatted based on recovery on D drive due to no more recovery discs.

I'm sorry xxmaxixx. When a post is edited, an email notification is not received. Did you restore the computer to factor settings?

Donna

&amp;

I think so. I dun mind reformatting again since i only use it for surfing purpose.

Edited by xxmaxixx, 25 March 2014 - 09:35 AM.

[DonnaB]

 

I think so.

Ok. Once you restore back to factory condition, the first thing you should do is to update and install all security patches, which on Vista is quite a few. I found that the easiest and quickest way is to install each Service Pack (SP) instead of just going to Windows Updates and allowing all the updates to install as they are detected.

Here is the link to SP1 > Windows Vista Service Pack 1 Five Language Standalone (KB936330)

And here is the link to SP2 > Windows Server 2008 Service Pac 2 and Windows Vista Service Pack 2 - Five Language Standalone (KB948465)

Once the two SP's are installed the rest of the updates and security patches that were offered should follow.

Don't forget that all the factory installed software will need to be updated. The trial version of AV will need to be removed and replaced properly with your AV of choice by using the appropriate removal tool, unless you choose to keep the trial version that will need to be paid for in due time.

There is an easy way to remove all the pre-installed software that you will not choose to use that takes up space on your hard drive.

If you feel that you will have no problems getting your system as was, please do so, though I will leave this thread open in case you have questions or concerns. Please let me know either way. I'll close this thread when you are satisfied with the system factory restore.

Donna

[xxmaxixx]

Completed installing sp1 followed by sp2. Still updating from windows. Lately i keep having ie cannot display website based on my house cable network. On this labtop alone will encounter ie cannot open site.

Operation aborted.

Edited by xxmaxixx, 27 March 2014 - 03:11 AM.

[DonnaB]

Which version of IE is presently installed? To find out, click on Help in the menu bar at top left of browser. Next, click on About Internet Explorer.

If IE7, please download IE8 from >>here<<

If IE8 (or once IE8 is installed), please download IE9 from >>here<<

In the drop down field to the right, you will want to click on the arrow and select the version Windows Vista 32-bit. Make sure to select the appropriate language.

At this time you may want to change your Windows Updates settings to Download updates but let me choose whether to install them.

If several are downloaded at once, choose to install those that are Recommended first, and a few at a time. Not all at once. Then do the same for those labeled Optional. Continue to check Windows Update till no more are found. This technique may take a bit more time to get the system up to date, though, if you encounter an error along the way, it will be easier to figure out which update caused it.

If any questions or concerns, please do not hesitate to ask.

[xxmaxixx]

Which version of IE is presently installed? To find out, click on Help in the menu bar at top left of browser. Next, click on About Internet Explorer.

If IE7, please download IE8 from >>here<<

If IE8 (or once IE8 is installed), please download IE9 from >>here<<

In the drop down field to the right, you will want to click on the arrow and select the version Windows Vista 32-bit. Make sure to select the appropriate language.

At this time you may want to change your Windows Updates settings to Download updates but let me choose whether to install them.

If several are downloaded at once, choose to install those that are Recommended first, and a few at a time. Not all at once. Then do the same for those labeled Optional. Continue to check Windows Update till no more are found. This technique may take a bit more time to get the system up to date, though, if you encounter an error along the way, it will be easier to figure out which update caused it.

If any questions or concerns, please do not hesitate to ask.

It seems like the issue has been resolved after updating to IE9. Having completed with all of windows' updates, may i suggest that this thread to be closed. Pretty sure i can take it from here. Thanks alot for assistance

Edited by xxmaxixx, 28 March 2014 - 10:19 AM.