Do this on the computer you are posting from:
Copy the text in the codebox below:
Code:
:OTL
IE - HKU\Deshra_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
O4 - HKU\Deshra_ON_C..\Run: [WMPNSCFG] File not found
O4 - HKU\Deshra_ON_C..\Run: [yBlqxAdBNPjQ.exe] C:\ProgramData\yBlqxAdBNPjQ.exe ()
[2012/01/05 14:25:42 | 000,000,000 | ---D | C] -- C:\Users\Deshra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
[2012/01/05 14:25:46 | 000,000,272 | -H-- | M] () -- C:\ProgramData\~vcAvNjbO90gt57
[2012/01/05 14:25:46 | 000,000,160 | -H-- | M] () -- C:\ProgramData\~vcAvNjbO90gt57r
[2012/01/05 14:25:42 | 000,000,637 | ---- | M] () -- C:\Users\Deshra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2012/01/05 14:25:42 | 000,000,613 | ---- | M] () -- C:\Users\Deshra\Desktop\System Check.lnk
[2012/01/05 14:25:37 | 000,000,336 | -H-- | M] () -- C:\ProgramData\vcAvNjbO90gt57
[2012/01/05 14:21:38 | 000,358,178 | -H-- | M] () -- C:\ProgramData\vcAvNjbO90gt57.exe
[2012/01/05 14:15:34 | 000,444,194 | -H-- | M] () -- C:\ProgramData\yBlqxAdBNPjQ.exe
[2011/12/06 04:26:19 | 000,003,776 | -HS- | C] () -- C:\Users\Deshra\AppData\Local\x0ym23x1be4ukx
[2011/12/06 04:26:19 | 000,003,776 | -HS- | C] () -- C:\ProgramData\x0ym23x1be4ukx
[2011/12/05 05:44:51 | 000,010,570 | -HS- | C] () -- C:\Users\Deshra\AppData\Local\6a55ol2s67a224
[2011/12/05 05:44:51 | 000,010,570 | -HS- | C] () -- C:\ProgramData\6a55ol2s67a224
[2011/07/13 07:27:11 | 000,008,380 | -HS- | C] () -- C:\Users\Deshra\AppData\Local\b6bo46lu10ri1w645385mo7j0w0
[2011/07/13 07:27:11 | 000,008,380 | -HS- | C] () -- C:\ProgramData\b6bo46lu10ri1w645385mo7j0w0
[2011/10/12 22:41:36 | 000,000,000 | ---D | M] -- C:\Users\Deshra\AppData\Roaming\BAC7E
[2011/10/12 18:56:49 | 000,000,000 | ---D | M] -- C:\Users\Deshra\AppData\Roaming\BD9BA
[2011/10/09 16:19:53 | 000,000,000 | ---D | M] -- C:\Users\Deshra\AppData\Roaming\h99ggTZZqjYw
[2011/10/09 22:08:23 | 000,000,000 | ---D | M] -- C:\Users\Deshra\AppData\Roaming\j11iibD33o
[2011/10/09 16:20:00 | 000,000,000 | ---D | M] -- C:\Users\Deshra\AppData\Roaming\TEEEK88fRZ9h
@Alternate Data Stream - 160 bytes -> C:\ProgramData\TEMP:FB1B13D8
:Services
:Reg
:Files
:Commands
[purity]
Open Notepad and paste it.
Save the document as Fix.txt on to a USB flash drive
On the infected computer the following...
Run OTLPE
- Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
- (The content of Fix.txt should appear in the box)
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post the log produced (you'll need to transfer it with USB stick)
- Attempt to reboot normally into Windows.
