Hi Downset,
That's great to hear and we're nearly done, but there's a final cleaning step we need to do before we finish up:
Backup Your Registry:
- Download ERUNT to your Desktop (right-click the link, select Save Target As..., select your Desktop and press Save)
- Right-click erunt.zip, choose Extract All... and follow the prompts to unzip the program
- Open the erunt folder on your Desktop and double-click ERUNT.exe to start the program
- OK all the prompts to back up your registry to the default location.
Note: if it is necessary to restore the registry, open the backup folder and start
ERDNT.exe
Open Notepad: press
Start->Run, type
notepad into the box and press
OK
Select
Format from the top menu and make sure
Word Wrap is NOT checked.
Then, copy/paste the contents of the following code box into Notepad:
@echo off
reg add HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa /v "Notification Packages" /t REG_MULTI_SZ /d scecli\0 /f
regedit /a "%userprofile%\desktop\look.txt" "HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa"
del runme.bat
Select
File and
Save as
Save it to your Desktop as
"runme.bat" (you MUST type the quotes)
Locate
runme.bat on your Desktop and double-click it.
A black box should open and close after a short time, this is normal.
Another text file should appear on your Desktop called
look.txt,
do not open it until the black box has closed.
Once complete, please post the
look.txt output along with a new HijackThis log.