19

Well it does look better. I see one new file avast picked up, along with the renamed file, which avast also got.

So we know at least one of the commands from within the recovery console worked.

We’ll have a look at that autorun, then try to unload the last driver.

From this link http://cid-32d8666f4048075b.skydrive.live.com/browse.aspx/Malware%20files

download, save to your desktop, and run this program

QueryMountPoints

after you download it, double click it to run, please post the results.

Now we see how successful we where in disabling the evil driver. We’ll use use avenger again. Follow the previous Avenger operating instructions, but with the following script

Drivers to unload: dueavlel

Files to delete:
C:\WINDOWS\System32\datacle.dll
C:\WINDOWS\system32\drivers\ikuracjg.dat

Please post the avenger results along with the querymountpoint results, a new combofix log and a new HJT log.