Okay, lets kill this all at once.
Please post the OTMoveIt log.
............................................................................................
Site Admin / Security Administrator
Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
- Open HijackThis
- Choose "Do a system scan only"
- Check the boxes in front of these lines:
O4 - HKCU\..\Run: [qr5v6k46i8bdy] C:\DOCUME~1\orville\LOCALS~1\Temp\jc3dj9oqleln.exe
O18 - Filter hijack: text/html - {cc6e3e31-2bd8-48c7-86fb-7f5302833add} - C:\WINDOWS\system32\mst122.dll - Press "Fix Checked"
- Close Hijack This.
- Please double-click OTMoveIt3.exe to run it.
- Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
:files
c:\windows\system32\tmwtsrno.ini
c:\windows\system32\oyiimiuc.ini
c:\windows\system32\qknpocao.ini
c:\windows\system32\eqiyhkpu.ini
c:\windows\efeyiqopacajuhi.dll
c:\windows\system32\ykjesidk.ini
c:\windows\system32\jfvlwsds.ini
c:\windows\system32\wlnmfxkf.ini
c:\windows\system32\evvfbyik.ini
c:\windows\system32\vfoebn.dll
c:\windows\system32\cxqnnbbu.dll
C:\WINDOWS\system32\mst122.dll
:commands
[emptytemp]
[reboot] - Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
- Click the red Moveit! button.
- Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
- Close OTMoveIt3
Please post the OTMoveIt log.
Site Admin / Security Administrator
Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.