Rootkit issues / Google redirection

[Cwluc]

Hello I'm having some issues with a computer of mine, mostly I noticed that random sites were opening without my knowledge. Someone suggest malwarebytes which I installed, ran, did a quick and full scan, cleaned whatever it found what's left was a slew of IPs were trying to accessed the net on a regular basis. I started trying to remove/clean this infection and now it seems it's a rootkit at play. Followed the guide. Here is the information you have requested. I appreciate any help you could provide. Thank you for your time. ark.zip

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Cwluc at 18:12:23.46 on Tue 05/03/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.374 [GMT -4:00]

.

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINXP\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINXP\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINXP\system32\spoolsv.exe

C:\WINXP\Explorer.EXE

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\WINXP\SYSTEM32\USRmlnkA.exe

C:\WINXP\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Cyberlink\Shared Files\brs.exe

C:\WINXP\system32\taskswitch.exe

C:\WINXP\system32\fast.exe

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\WINXP\SYSTEM32\USRshutA.exe

C:\WINXP\SYSTEM32\USRmlnkA.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINXP\system32\svchost.exe -k hpdevmgmt

C:\WINXP\system32\svchost.exe -k HPService

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe

C:\WINXP\System32\svchost.exe -k HPZ12

C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

C:\WINXP\System32\svchost.exe -k HPZ12

C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe

C:\WINXP\system32\svchost.exe -k imgsvc

C:\WINXP\system32\Fast.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINXP\system32\wscntfy.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Cwluc\Desktop\dds.scr

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [uSRpdA] c:\winxp\system32\usrmlnka.exe runservices \device\3cpipe-USRpdA

mRun: [igfxTray] c:\winxp\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\winxp\system32\hkcmd.exe

mRun: [Persistence] c:\winxp\system32\igfxpers.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [WD Anywhere Backup] c:\program files\wd\wd anywhere backup\MemeoLauncher2.exe --silent

mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"

mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"

mRun: [bDRegion] c:\program files\cyberlink\shared files\brs.exe

mRun: [CoolSwitch] c:\winxp\system32\taskswitch.exe

mRun: [FastUser] c:\winxp\system32\fast.exe

mRun: [HTC Sync Loader] "c:\program files\htc\htc sync 3.0\htcUPCTLoader.exe" -startup

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime alternative\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

TCP: {1E31E7ED-57F5-4BDC-93D5-DA556D84F3BD} = 192.168.0.1

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} -

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} -

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winxp\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\cwluc\applic~1\mozilla\firefox\profiles\23czhzwi.default\

FF - prefs.js: browser.search.selectedEngine - IMDB

FF - prefs.js: browser.startup.homepage - hxxp://www.imdb.com/

FF - plugin: c:\documents and settings\cwluc\application data\mozilla\firefox\profiles\23czhzwi.default\extensions\{1bc9ba34-1eed-42ca-a505-6d2f1a935bbb}\plugins\npietab2.dll

FF - plugin: c:\documents and settings\cwluc\local settings\application data\unity\webplayer\loader\npUnity3D32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;c:\winxp\system32\drivers\aswSnx.sys [2011-5-3 441176]

R1 aswSP;aswSP;c:\winxp\system32\drivers\aswSP.sys [2011-5-3 307288]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\cyberlink\powerdvd8\000.fcl [2008-5-15 61424]

R2 aswFsBlk;aswFsBlk;c:\winxp\system32\drivers\aswFsBlk.sys [2011-5-3 19544]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-5-3 42184]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-5-3 363344]

R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\wd\wd anywhere backup\MemeoBackgroundService.exe [2008-11-7 25824]

R2 PassThru Service;Internet Pass-Through Service;c:\program files\htc\internet pass-through\PassThruSvr.exe [2010-9-16 80896]

R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatch10.exe [2007-8-24 166384]

R3 MBAMProtector;MBAMProtector;c:\winxp\system32\drivers\mbam.sys [2011-5-3 20952]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\winxp\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\roxio\digital home 10\RoxioUpnpService10.exe [2007-8-24 362992]

S2 RoxLiveShare10;LiveShare P2P Server 10;"c:\program files\common files\roxio shared\10.0\sharedcom\roxliveshare10.exe" --> c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [?]

S3 HTCAND32;HTC Device Driver;c:\winxp\system32\drivers\ANDROIDUSB.sys [2011-2-16 24576]

S3 htcnprot;HTC NDIS Protocol Driver;c:\winxp\system32\drivers\htcnprot.sys [2010-6-22 21248]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\winxp\system32\drivers\netaapl.sys [2010-11-25 18432]

S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\roxio\digital home 10\RoxioUPnPRenderer10.exe [2007-8-24 72176]

S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2007-8-24 1083888]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\winxp\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S4 d347bus;d347bus;c:\winxp\system32\drivers\d347bus.sys [2010-10-25 155136]

S4 d347prt;d347prt;c:\winxp\system32\drivers\d347prt.sys [2010-10-25 5248]

.

=============== Created Last 30 ================

.

2011-05-03 16:04:00 -------- d-sha-r- C:\cmdcons

2011-05-03 15:57:48 98816 ----a-w- c:\winxp\sed.exe

2011-05-03 15:57:48 89088 ----a-w- c:\winxp\MBR.exe

2011-05-03 15:57:48 256512 ----a-w- c:\winxp\PEV.exe

2011-05-03 15:57:48 161792 ----a-w- c:\winxp\SWREG.exe

2011-05-03 05:55:16 38224 ----a-w- c:\winxp\system32\drivers\mbamswissarmy.sys

2011-05-03 05:55:12 20952 ----a-w- c:\winxp\system32\drivers\mbam.sys

2011-05-03 05:55:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-05-03 05:50:39 441176 ----a-w- c:\winxp\system32\drivers\aswSnx.sys

2011-05-03 05:50:09 40112 ----a-w- c:\winxp\avastSS.scr

2011-05-03 05:27:17 -------- d-----w- c:\docume~1\cwluc\locals~1\applic~1\ESET

2011-05-03 05:27:17 -------- d-----w- c:\docume~1\cwluc\applic~1\ESET

2011-05-03 01:27:54 -------- d-----w- c:\docume~1\cwluc\applic~1\Malwarebytes

2011-05-03 01:27:35 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2011-05-02 21:24:15 -------- d-----w- C:\temp

2011-05-02 20:45:04 -------- d-----w- c:\docume~1\cwluc\locals~1\applic~1\Trend Micro

2011-05-02 20:40:01 -------- d-----w- c:\docume~1\alluse~1\applic~1\Trend Micro

2011-05-02 17:06:18 76696 ----a-w- c:\winxp\system32\drivers\pxrts.sys

2011-05-02 17:06:10 -------- d-----w- c:\docume~1\alluse~1\applic~1\PrevxCSI

2011-04-30 01:18:39 -------- d-----w- c:\program files\AVAST Software

2011-04-30 01:18:39 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVAST Software

2011-04-30 00:56:03 221184 ----a-w- c:\winxp\system32\wmpns.dll

2011-04-21 22:25:00 -------- d-----w- c:\winxp\Hewlett-Packard

2011-04-21 20:32:16 5504 -c--a-w- c:\winxp\system32\dllcache\mstee.sys

2011-04-21 20:32:16 5504 ----a-w- c:\winxp\system32\drivers\MSTEE.sys

2011-04-21 20:32:08 10880 -c--a-w- c:\winxp\system32\dllcache\ndisip.sys

2011-04-21 20:32:08 10880 ----a-w- c:\winxp\system32\drivers\NdisIP.sys

2011-04-21 20:32:03 16384 ----a-w- c:\winxp\system32\ipsink.ax

2011-04-21 20:32:03 15232 -c--a-w- c:\winxp\system32\dllcache\streamip.sys

2011-04-21 20:32:03 15232 ----a-w- c:\winxp\system32\drivers\StreamIP.sys

2011-04-21 20:32:00 11136 -c--a-w- c:\winxp\system32\dllcache\slip.sys

2011-04-21 20:32:00 11136 ----a-w- c:\winxp\system32\drivers\SLIP.sys

2011-04-21 20:31:56 19200 -c--a-w- c:\winxp\system32\dllcache\wstcodec.sys

2011-04-21 20:31:56 19200 ----a-w- c:\winxp\system32\drivers\WSTCODEC.SYS

2011-04-21 20:31:52 85248 -c--a-w- c:\winxp\system32\dllcache\nabtsfec.sys

2011-04-21 20:31:52 85248 ----a-w- c:\winxp\system32\drivers\NABTSFEC.sys

2011-04-21 20:31:48 17024 -c--a-w- c:\winxp\system32\dllcache\ccdecode.sys

2011-04-21 20:31:48 17024 ----a-w- c:\winxp\system32\drivers\CCDECODE.sys

2011-04-21 20:23:58 91136 ----a-w- c:\winxp\system32\kswdmcap.ax

2011-04-21 20:23:58 53760 -c--a-w- c:\winxp\system32\dllcache\vfwwdm32.dll

2011-04-21 20:23:58 53760 ----a-w- c:\winxp\system32\vfwwdm32.dll

2011-04-21 20:23:58 43008 ----a-w- c:\winxp\system32\ksxbar.ax

2011-04-21 20:23:58 28672 ----a-w- c:\winxp\system32\vidcap.ax

2011-04-21 20:23:56 61952 ----a-w- c:\winxp\system32\kstvtune.ax

2011-04-21 06:14:32 -------- d-----w- c:\docume~1\cwluc\locals~1\applic~1\Temp

2011-04-21 04:49:24 -------- d-----w- c:\program files\common files\Macrovision Shared

2011-04-21 04:48:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Rosetta Stone

2011-04-21 04:48:45 -------- d-----w- c:\program files\Rosetta Stone

2011-04-21 04:43:33 60032 -c--a-w- c:\winxp\system32\dllcache\usbaudio.sys

2011-04-21 04:43:33 60032 ----a-w- c:\winxp\system32\drivers\USBAUDIO.sys

2011-04-19 03:58:41 -------- d-----w- c:\program files\Mr QuestionMan

2011-04-19 03:55:24 -------- d-----w- c:\program files\Audio Identifier

2011-04-18 04:12:14 -------- d-----w- c:\program files\Amazon

2011-04-17 17:56:57 -------- d-----w- c:\program files\iPod

2011-04-17 17:56:45 -------- d-----w- c:\program files\iTunes

2011-04-17 17:47:24 -------- d-----w- c:\program files\Bonjour

2011-04-15 17:14:40 457472 -c----w- c:\winxp\system32\dllcache\mrxsmb.sys

2011-04-15 14:01:53 -------- d-----w- c:\docume~1\cwluc\applic~1\Dropbox

2011-04-14 22:21:51 -------- d-----w- c:\docume~1\alluse~1\applic~1\Juniper Networks

2011-04-14 04:24:37 -------- d-----w- c:\docume~1\cwluc\applic~1\DiskAid

2011-04-14 04:23:11 -------- d-----w- c:\program files\DigiDNA

2011-04-09 02:56:09 -------- d-----w- c:\docume~1\cwluc\locals~1\applic~1\AVG Security Toolbar

.

==================== Find3M ====================

.

2011-03-07 05:31:47 692736 ----a-w- c:\winxp\system32\inetcomm.dll

2011-03-04 06:35:38 420864 ----a-w- c:\winxp\system32\vbscript.dll

2011-03-03 13:27:43 1866880 ----a-w- c:\winxp\system32\win32k.sys

2011-02-22 23:27:04 919552 ----a-w- c:\winxp\system32\wininet.dll

2011-02-22 23:27:04 43520 ----a-w- c:\winxp\system32\licmgr10.dll

2011-02-22 23:27:04 1469440 ----a-w- c:\winxp\system32\inetcpl.cpl

2011-02-18 20:36:58 4184352 ----a-w- c:\winxp\system32\usbaaplrc.dll

2011-02-18 12:08:32 385024 ----a-w- c:\winxp\system32\html.iec

2011-02-17 12:32:12 5120 ----a-w- c:\winxp\system32\xpsp4res.dll

2011-02-15 13:05:45 290432 ----a-w- c:\winxp\system32\atmfd.dll

2011-02-09 13:53:52 270848 ----a-w- c:\winxp\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\winxp\system32\encdec.dll

2011-02-08 13:32:40 978944 ----a-w- c:\winxp\system32\mfc42.dll

2011-02-08 13:32:40 974848 ----a-w- c:\winxp\system32\mfc42u.dll

2011-02-03 02:40:23 472808 ----a-w- c:\winxp\system32\deployJava1.dll

2011-02-03 00:19:39 73728 ----a-w- c:\winxp\system32\javacpl.cpl

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: WDC_WD3200AAJB-00WGA0 rev.00.02C01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x863234F0]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x863297d0]; MOV EAX, [0x8632984c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8637FAB8]

3 CLASSPNP[0xF7506FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x86369030]

\Driver\atapi[0x863D1438] -> IRP_MJ_CREATE -> 0x863234F0

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x8632333B

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 18:14:02.89 ===============

[LDTate]

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!