We are now going to run ComboFix a different way so that we can replace the bad files.
I shall give some closing advice when we are done and I can assure you a registry cleaner is not required to keep your system running smoothly, if it were there would be one built in to Windows.
As with the first Combofix scan, disconnect from the internet and disable script blocking and all your security software.
Open Notepad by clicking![]()
and in the search box type: Notepad.exe and hit Enter
Then copy and paste everything in the code box below into it.
-- Note: Make sure Word Wrap is unchecked in Notepad by clicking on Format in the top menu.
I shall give some closing advice when we are done and I can assure you a registry cleaner is not required to keep your system running smoothly, if it were there would be one built in to Windows.
As with the first Combofix scan, disconnect from the internet and disable script blocking and all your security software.
Open Notepad by clicking
and in the search box type: Notepad.exe and hit EnterThen copy and paste everything in the code box below into it.
-- Note: Make sure Word Wrap is unchecked in Notepad by clicking on Format in the top menu.
Code:
FCopy::
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll | c:\windows\system32\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll | c:\windows\SysWOW64\mshtml.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e757 80\wininet.dll | c:\windows\system32\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e757 80\wininet.dll | c:\windows\SysWOW64\wininet.dll
File::
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d 4b\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc2739352 23\wininet.dll
C:\Users\Home PC\Downloads\Express_Installer.exe
Reboot::- Save the file as CFScript.txt by choosing Save As... in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
- Close your browser and disconnect from the Internet.
- Now use your mouse to drag, then drop the CFScript.txt file on top of ComboFix.exe as seen in the image below.
![]()
This will start ComboFix again and launch the script. - ComboFix may reboot your system when it finishes. This is normal.
- A log with be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of ComboFix.txt in your next reply.
- Be sure to re-enable your anti-virus and other security programs after the scan is complete.
