[ Solved ] HELP. router hacked

[bob12a]

Thank you

 

All processes killed

========== OTL ==========

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Clip Image\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Clip selection\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Clip this page\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Clip URL\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Customize Menu\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save Forms\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Show RoboForm Toolbar\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk\ deleted successfully.

C:\Windows\pss\Bluetooth.lnk.CommonStartup moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Obrona Block Ads\ deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

 

User: All Users

 

User: BF2010

->Temp folder emptied: 15321960 bytes

->Temporary Internet Files folder emptied: 2293035 bytes

->Java cache emptied: 385164 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 0 bytes

->Apple Safari cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: bob02

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Google Chrome cache emptied: 819568 bytes

->Flash cache emptied: 0 bytes

 

User: bob2

->Temp folder emptied: 157590 bytes

->Temporary Internet Files folder emptied: 6283809 bytes

->Google Chrome cache emptied: 15752053 bytes

->Flash cache emptied: 0 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Guest

 

User: HomeGroupUser$

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 21668 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 639222640 bytes

 

Total Files Cleaned = 649.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 04082015_080229

 

 

Files\Folders moved on Reboot...

File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

File\Folder C:\Windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KRP0ITYI\desktop.ini not found!

File\Folder C:\Windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FJSQGNE0\desktop.ini not found!

File\Folder C:\Windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CTIFX8BD\desktop.ini not found!

File\Folder C:\Windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\BNDER8B1\desktop.ini not found!

 

 

PendingFileRenameOperations files...

 

 

Registry entries deleted on Reboot...

[Starbuck]

Hi Bob,

 

That's cleaned up the remaining orphan entries.

If the system is running fine now we can finish off.

Ok?

[bob12a]

Hi Bob,

 

That's cleaned up the remaining orphan entries.

If the system is running fine now we can finish off.

Ok?

 

MY PC is now running fine thanks to you is there anything else you want be to do.

If not I will ask for your help on my mates laptop.

Thanks again

[Starbuck]

Hi Bob,

 

Let's finish the cleaning process and remove the tools we have used.

We'll also set you a fresh restore point.

 

Once this is done, we can start on your mates laptop.

 

Step 1

Restart MBAM.

Click on the History tab >> Quarantine

Tick to select all items (if any there ) and then click the Delete button.

Close MBAM.

 

 

Step 2

Download Delfix and save it to your desktop.

• Ensure Remove disinfection tools is checked.
  
• Also place a checkmark next to:
  
• Create registry backup
  
• Purge system restore
   
  http://img.photobucket.com/albums/v708/starbuck50/delf_zpsb39a5ff3.png
  .
  
• Click the Run button.
  

When the tool has finished, a log will open in notepad.... but i don't actually need this report

 

Glad I was able to help.

 

Safe surfing. http://fc08.deviantart.net/fs71/f/2010/033/b/3/Computer_addict__by_Sinister_Starfeesh.gif

[bob12a]

Will do that tomorrow good night and thanks

[bob12a]

Hi Bob,

 

Let's finish the cleaning process and remove the tools we have used.

We'll also set you a fresh restore point.

 

Once this is done, we can start on your mates laptop.

 

Step 1

Restart MBAM.

Click on the History tab >> Quarantine

Tick to select all items (if any there ) and then click the Delete button.

Close MBAM.

 

 

Step 2

Download Delfix and save it to your desktop.

• Ensure Remove disinfection tools is checked.
  
• Also place a checkmark next to:
  
• Create registry backup
  
• Purge system restore
   
  http://img.photobucket.com/albums/v708/starbuck50/delf_zpsb39a5ff3.png
  .
  
• Click the Run button.
  

When the tool has finished, a log will open in notepad.... but i don't actually need this report

 

Glad I was able to help.

 

Safe surfing. http://fc08.deviantart.net/fs71/f/2010/033/b/3/Computer_addict__by_Sinister_Starfeesh.gif

 

Done and dusted and a BIG THANK YOU for your time. All seems ok on testing

[Starbuck]

All seems ok on testing

That's always good to hear.