Open HJT, run a system scan only and place a check mark next to these lines
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O20 - Winlogon Notify: jkkjigg - jkkjigg.dll (file missing)
If you have a desktop popup that you don’t want check the following line also. IF it’s something you want then just leave it.
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/ENDUSE~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg
close all browsers/windows and click fix. close HJT
Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.
Copy and paste all the text in the quote box below into Notepad.
Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.
File::
C:\WINDOWS\system32\qtutv.bak1
C:\WINDOWS\system32\qtutv.bak2
C:\WINDOWS\system32\qtutv.ini2
This will start ComboFix again.Close all browser/windows first.
After reboot, (in case it asks to reboot), rename combofix.exe to somthing else, whaterever you want. Run it and post that log. (example andrew.exe)
Everything is well hidden, except for a bit of vundo.
