Hi oldman960,
this is not my day I think
qvo6.com is still there. Coming up as new tab in both the IE and Firefox.
It drives me nu*s
Process went a little different to what you said. There was a reboot forced by OTL at the end of the removing job. However I think that didn't matter.
This is the log file, looking quite successful :
-----------------------
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\S-1-5-21-713427250-3853926042-2103360380-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\""|"C:\Program Files\Mozilla Firefox\firefox.exe" /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\qvo6Software\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\\DoNotAskAgain deleted successfully.
Registry value HKEY_USERS\S-1-5-21-713427250-3853926042-2103360380-1005\Software\Microsoft\Internet Explorer\SearchScopes\\DoNotAskAgain not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\HEF01\Desktop\cmd.bat deleted successfully.
C:\Users\HEF01\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56478 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: HEF01
->Temp folder emptied: 97937172 bytes
->Temporary Internet Files folder emptied: 255021982 bytes
->Java cache emptied: 63490596 bytes
->FireFox cache emptied: 206871897 bytes
->Flash cache emptied: 3194839 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 67224 bytes
Windows Temp folder emptied: 24872645 bytes
RecycleBin emptied: 18733299 bytes
Total Files Cleaned = 639,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 07052013_101106
Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\GacelaLSPService.log scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
...................................................
I couldn't believe the qvo6 is still there and checked the reg file with SystemLook.exe and the search string we had above for qvo6
Result. It's nothing in there any more.
...................................................
SystemLook 30.07.11 by jpshortstuff
Log created at 10:44 on 05/07/2013 by HEF01
Administrator - Elevation successful
========== regfind ==========
Searching for "qvo6"
No data found.
Searching for "qvo6*"
No data found.
-= EOF =-
.............................................
And now ? Hope you have another idea ...
