We have very serious issues there.
Do this on the computer you are posting from:
Copy the text in the codebox below:
Code:
:OTL
SRV - File not found [Auto] -- -- (TuneUp.UtilitiesSvc)
DRV - File not found [Kernel | System] -- -- (xuszjihl)
DRV - File not found [Kernel | System] -- -- (MpKslc9e848df)
DRV - File not found [Kernel | System] -- -- (MpKsl84553c1f)
DRV - File not found [Kernel | System] -- -- (MpKsl53c1ce70)
DRV - File not found [Kernel | System] -- -- (MpKsl22c8c8c2)
O36 - AppCertDlls: mounsol - (C:\WINDOWS\system32\locarate.dll) - C:\WINDOWS\system32\locarate.dll ()
[5 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2012/01/06 01:41:43 | 000,000,296 | ---- | M] () -- C:\Windows\tasks\xhxygufv.job
[2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\Windows\System32\fehuwifa
@Alternate Data Stream - 88 bytes -> C:\Windows\System32\rundll32.exe.exe:SummaryInformation
@Alternate Data Stream - 88 bytes -> C:\Windows\System32\RUNDLL32.EX_:SummaryInformation
@Alternate Data Stream - 88 bytes -> C:\Windows\System32\locarate.dll:SummaryInformation
@Alternate Data Stream - 88 bytes -> C:\Windows\System32\Copy of rundll32.exe.exe:SummaryInformation
@Alternate Data Stream - 88 bytes -> C:\Program Files\wpp.exe:SummaryInformation
@Alternate Data Stream - 768 bytes -> C:\Windows\System32\drivers\teuncohm.sys:changelist
@Alternate Data Stream - 768 bytes -> C:\Windows\System32\drivers\puymlpgc.sys:changelist
@Alternate Data Stream - 610 bytes -> C:\Windows\System32\drivers\qskgltym.sys:changelist
@Alternate Data Stream - 610 bytes -> C:\Windows\System32\drivers\hefwrycu.sys:changelist
@Alternate Data Stream - 522 bytes -> C:\Windows\System32\drivers\uxtiqeky.sys:changelist
@Alternate Data Stream - 384 bytes -> C:\Windows\System32\drivers\ikupexvg.sys:changelist
@Alternate Data Stream - 1110 bytes -> C:\Windows\System32\drivers\cpgpihny.sys:changelist
:Services
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"userinit"="C:\Windows\system32\userinit.exe,"
:Files
:Commands
[purity]
Open Notepad and paste it.
Save the document as Fix.txt on to a USB flash drive
On the infected computer the following...
Run OTLPE
- Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
- (The content of Fix.txt should appear in the box)
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post the log produced (you'll need to transfer it with USB stick)
- Attempt to reboot normally into Windows.
