Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\2.exe
C:\DOCUME~1\Personal\APPLIC~1\Cuckoo
C:\WINDOWS\system32\dnnimq.dll
C:\WINDOWS\lpdwzn.exe
C:\WINDOWS\system32\lxyrjn.dll
C:\WINDOWS\csmsmt.exe
C:\WINDOWS\jttlsm.exe
C:\WINDOWS\czbpnz.exe
C:\WINDOWS\system32\zwwtvs.dll
C:\WINDOWS\zfdfds.exe
C:\WINDOWS\system32\ztinetzt.dll
C:\WINDOWS\nujdxh.exe
C:\WINDOWS\system32\Deleteme.bat
C:\WINDOWS\wazuxr.exe
C:\WINDOWS\system32\drivers\gsrypjdt.sys
C:\WINDOWS\xuuypb.exe
C:\WINDOWS\system32\ztinetzt.exe
c:\WINDOWS\system32\RAVMY523.dll
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\qwetop.exe
C:\WINDOWS\system32\upxdnd.dll
C:\WINDOWS\system32\nwizhx2.dll
C:\WINDOWS\system32\nwizhx2.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\system32\mydata.exe
C:\WINDOWS\system32\moyu103.dll
C:\WINDOWS\system32\dh2103.dll
C:\WINDOWS\system32\nwizdh.exe
C:\WINDOWS\system32_rejoice44.exe
C:\WINDOWS\system32\gomvet.exe
C:\WINDOWS\system32\servet.exe
C:\WINDOWS\system32\bbqpri.dll
C:\WINDOWS\system32\nwizAsktao.exe
C:\WINDOWS\AVPSrv.exe
C:\WINDOWS\system32\qwetop.exe
C:\WINDOWS\system32\7.exe
Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new Hijack log.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
WARNING these fixes are designed for this user only and may cause damage if run on an uninfected machine
First we must back up the entire registry.To do this
REGISTRY BACKUP
Go START > RUN and type in REGEDIT then press your enter key.
When Regedit is open ensure that ‘my computer’ is highlighted in the left pane.
Go to FILE and select EXPORT.
Check the ‘all’ button at the bottom of the screen to backup the entire registry.
You will need to select a location to save the exported registry (it will be saved as a single file) I would suggest the Desktop
Choose the FILE NAME as Oldreg
In the drop down box called SAVE AS TYPE select registration files (*.reg).
Then click SAVE
This will create a file on your desktop called Oldreg.reg
http://img127.imageshack.us/img127/433/regtg8.jpg
REGISTRY FIX
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
rxsa=-
qjsa=-
mhsa=-
[HKEY_USERS.default\software\microsoft\windows\currentversion\run]
4jbbhd=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
RavMon=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks{62A612A4-4334-4424-4234-42261A31A238}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks{27622928-28E4-115D-40A0-0BBFE89C54D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks{DE35052A-9E37-4827-A1EC-79BF400D27A4}]
Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file. Ensure there is no space above the REGEDIT4.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
This will create a fix.reg file on your desktop
http://img127.imageshack.us/img127/433/regtg8.jpg
To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.
Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in. If, after posting, the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.
We appear to be about halfway there at the moment you have one of the new chinese type infections so most of the removal will be manual
