Do this on the computer you are posting from:
Copy the text in the codebox below:
Code:
:OTL
DRV - File not found [Kernel | Boot] -- -- (xbdtm)
DRV - File not found [Kernel | System] -- -- (rlzvlbkq)
DRV - File not found [Kernel | System] -- -- (kgvthoff)
DRV - File not found [File_System | Boot] -- -- (87439480)
DRV - File not found [File_System | Boot] -- -- (39788838)
DRV - File not found [Kernel | On_Demand] -- -- (.smb)
DRV - File not found [Kernel | On_Demand] -- -- (.afd)
IE - HKU\Jonathan_ON_C\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No CLSID value found.
O3 - HKU\Jonathan_ON_C\..\Toolbar\WebBrowser: (no name) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - No CLSID value found.
[2012/02/24 21:18:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012/02/29 14:32:02 | 000,000,000 | -HS- | M] () -- C:\Windows\System32\dds_trash_log.cmd
[2012/02/27 18:22:36 | 000,083,136 | ---- | M] () -- C:\ProgramData\ojMY0N0T.exe_
[2012/02/27 18:22:36 | 000,083,136 | ---- | M] () -- C:\ProgramData\ojMY0N0T.exe
[2012/02/27 18:22:36 | 000,083,136 | ---- | M] () -- C:\Windows\System32\eE0cm.com_
[2012/02/27 18:22:36 | 000,083,136 | ---- | M] () -- C:\Windows\System32\eE0cm.com
[2012/02/27 18:22:36 | 000,000,112 | ---- | M] () -- C:\ProgramData\fStYmXb30.dat
[2012/02/29 15:34:03 | 000,000,001 | ---- | C] () -- C:\ProgramData\ojMY0N0T.exe_.b
[2012/02/29 15:34:03 | 000,000,001 | ---- | C] () -- C:\ProgramData\ojMY0N0T.exe.b
[2008/12/05 22:56:59 | 000,000,000 | -HSD | M] -- C:\Users\Jonathan\AppData\Roaming\.#
[2010/05/04 09:03:10 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Uniblue
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:88050731
:Services
:Reg
:Files
C:\Windows\system32\drivers\afd.sys|C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys /replace
C:\Windows\Tasks\At*.job
:Commands
[purity]
Open Notepad and paste it.
Save the document as Fix.txt on to a USB flash drive
On the infected computer the following...
Run OTLPE
- Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
- (The content of Fix.txt should appear in the box)
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post the log produced (you'll need to transfer it with USB stick)
- Remove the CD and shut down computer manually.
- Attempt to reboot normally into Windows.
