Hmm they have twigged that I am trying to remove it
Lets try the sneaky way, stop OTL and run this new fix please
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
[quote]
:OTL
[2011/08/20 21:56:50 | 000,000,100 | ---- | M] () – C:\WINDOWS\System32\2050979796
[2011/06/29 19:13:08 | 000,000,026 | -H-- | C] () – C:\Documents and Settings\All Users\Application Data.119889580931711767808769176
[2011/06/07 10:22:58 | 000,001,538 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\qf7j006i307x31d2eq0db61ygjdt21e46428472a
[2011/06/07 10:22:57 | 000,001,538 | -HS- | C] () – C:\Documents and Settings\Adrianj\Local Settings\Application Data\qf7j006i307x31d2eq0db61ygjdt21e46428472a
[2011/05/07 12:05:36 | 000,002,334 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\r5ku7gdgmu5b3sx20
[2011/05/07 12:05:36 | 000,002,334 | -HS- | C] () – C:\Documents and Settings\Adrianj\Local Settings\Application Data\r5ku7gdgmu5b3sx20
[2011/05/03 02:35:26 | 000,004,322 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\43w6lxpv7oi544k68hcx16hdbx
[2011/05/03 02:35:26 | 000,004,322 | -HS- | C] () – C:\Documents and Settings\Adrianj\Local Settings\Application Data\43w6lxpv7oi544k68hcx16hdbx
:Reg
[HKU.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-21-2983767572-2663097725-3796344406-1008\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
quote]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.