This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Certain files attempting to change my regitsry

7 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

This thread's last reply is from January 23, 2014, 11:22 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Helloeveryone
Thought i should mention that COMODO firewall tells me that idle-threads.exe is the parent application of the bcdboots file.
nunped MRU Honors Grad Emeritus
Hi HelloEveryone,

I can't find clear evidence that those files are malware related. They appear to be part of Microsoft .Net Framework.
When you say that they try to access the registry, what is the specific message you see?
Do you have any other issues?

Meanwhile, let's clean a few entries with OTL:
Step 1 - OTL fix
  • Right click OTL.exe and select "Run as Administrator" to launch the program.
  • Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.

Do not include the words "Code: Select all". Press "Select all" to automatically select all the text on the box.

:commands
[createrestorepoint]

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.shareware.pro/?lang=en
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.shareware.pro/?lang=en
O2 - BHO: (no name) - {A66AA08A-9BF0-4e87-99E6-6972731D6B99} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKU\S-1-5-21-2874987175-3563903751-1789994896-1003..\Run: [uTorrent] C:\Users\[redacted]\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
O15 - HKU\S-1-5-21-2874987175-3563903751-1789994896-1003\..Trusted Domains: dell.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-2874987175-3563903751-1789994896-1003\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-2874987175-3563903751-1789994896-1003\..Trusted Ranges: GD ([http] in Local intranet)
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D1B5B4F1

:files
ipconfig /flushdns /c

:commands
[emptytemp]

  • Click the Run Fix button.
  • OTL will now process the instructions.
  • When finished a box will open asking you to open the fix log, click OK.
  • The fix log will open.
  • Copy/Paste the log in your next reply please.


Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.

Step 2 - Uninstall Programs
  • Click on Start
  • Copy and paste the value below, into the Start Search entry box:
    appwiz.cpl
      Depending on your current view setting ...
    • Double click on Programs and Features.
    • Under Programs, click on Uninstall a program.
  • Locate the following programs:
    Java(TM) 6 Update 31
    Java(TM) 6 Update 5
    Adobe Reader 8.1.0

    Note: outdated versions of Java and Adobe Reader are vulnerable. You can install the most recent version of Reader when we're done cleaning.
  • Select the program and click on Uninstall to uninstall it.
  • Repeat steps 3 - 4 for each program in the list.
  • Reboot your computer after this.
Cypher Admin/Teacher
a lack of response,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.