Do this on the computer you are posting from:
Copy the text in the codebox below:
Code:
:OTL
DRV - [2012/01/05 04:03:45 | 000,044,928 | ---- | M] () [Kernel | Boot] -- F:\windows\System32\Drivers\f1fd89874c5dc9ed.sys -- (f1fd89874c5dc9ed)
[2012/01/05 04:03:45 | 000,044,928 | ---- | M] () -- F:\windows\System32\drivers\f1fd89874c5dc9ed.sys
DRV - File not found [Kernel | Boot] -- -- (yduowol)
O1 - Hosts: 94.63.240.131 www.google.com
O1 - Hosts: 94.63.240.132 www.bing.com
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [FtJthnNSvuydIr.exe] File not found
O4 - HKU\.DEFAULT..\Run: [7968a239e6bfab4.exe] File not found
O4 - HKU\.DEFAULT..\Run: [dplaysvr] File not found
O4 - HKU\.DEFAULT..\Run: [winupd] F:\windows\TEMP:winupd.exe File not found
O4 - HKU\Rebecca_ON_F..\Run: [AdobeBridge] File not found
O20 - Winlogon\Notify\klartew: DllName - C:\windows\system32\config\systemprofile\AppData\Local\klartew.dll - F:\Windows\System32\config\systemprofile\AppData\Local\klartew.dll ()
O37 - HKLM\...exe [@ = E7] -- "C:\windows\system32\config\systemprofile\AppData\Local\llc.exe" -a "%1" %* ()
O37 - HKU\.DEFAULT\...exe [@ = E7] -- "C:\windows\system32\config\systemprofile\AppData\Local\llc.exe" -a "%1" %* ()
[2012/01/06 12:30:31 | 000,011,608 | -HS- | M] () -- F:\ProgramData\5cy6y87mwm3h12vmoqo7786hy170odc37b4y
[2011/12/27 03:21:16 | 000,009,556 | -HS- | M] () -- F:\ProgramData\ob67akwv7ou5114we4760jn1oi7nx4o7
[2011/05/24 02:13:58 | 000,009,130 | -HS- | C] () -- F:\Users\Rebecca\AppData\Local\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/24 02:13:58 | 000,009,130 | -HS- | C] () -- F:\ProgramData\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/13 22:52:53 | 000,002,224 | -HS- | C] () -- F:\Users\Rebecca\AppData\Local\1c20t7270a6n4k50rdqh04
[2011/05/13 22:52:53 | 000,002,224 | -HS- | C] () -- F:\ProgramData\1c20t7270a6n4k50rdqh04
[2011/04/20 18:24:15 | 000,012,234 | -HS- | C] () -- F:\Users\Rebecca\AppData\Local\e1jfwcf2fw3u872lgs54ld248yfgrue122
[2011/04/20 18:24:15 | 000,012,234 | -HS- | C] () -- F:\ProgramData\e1jfwcf2fw3u872lgs54ld248yfgrue122
@Alternate Data Stream - 244736 bytes -> F:\windows\Temp:winupd.exe
:Services
:Reg
:Files
F:\windows\tasks\At*.job
:Commands
[purity]
Open Notepad and paste it.
Save the document as Fix.txt on to a USB flash drive
On the infected computer the following...
Run OTLPE
- Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
- (The content of Fix.txt should appear in the box)
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post the log produced (you'll need to transfer it with USB stick)
- Attempt to reboot normally into Windows.
See if you can run aswMBR and Combofix now.
