23

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Start
Startup: C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62626.js ()
Startup: C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65.js ()
Startup: C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6868.js ()
Startup: C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a3a.js ()
Startup: C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b3a.js ()
Startup: C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c3a6.js ()
C:\Users\1V4N0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.js
HKU\S-1-5-21-1736404222-114842431-3765707497-1001\...\Run: [387] - C:\Users\1V4N0\AppData\Roaming\2e6e\387.js [46924 2014-03-31] ()
C:\Users\1V4N0\AppData\Roaming\2e6e\*.js
2014-03-22 21:06 - 2014-03-26 00:24 - 00000000 __SHD () C:\Users\1V4N0\AppData\Roaming\2e6e
2014-03-22 21:06 - 2014-03-22 21:06 - 00000000 __SHD () C:\2fd
C:\Users\1V4N0\AppData\Local\Temp\GLB1A2B.EXE
C:\Users\1V4N0\AppData\Local\Temp\HssInstaller.exe
C:\Users\1V4N0\AppData\Local\Temp\ose00000.exe
HKU\S-1-5-21-1736404222-114842431-3765707497-1001\...\MountPoints2: {aee4d28b-b59c-11e3-8ea4-60eb696d6d97} - E:\SETUP.EXE
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.