This is easy then it sound. Just take your time, ask if you have any questions.
Open HJT, run a system scan only, check mark these lines if present
O4 - HKLM..\Run: [pyqv41] C:\WINDOWS\system32\pyqv41.exe
O4 - HKCU..\Run: [pyqv41] C:\WINDOWS\system32\pyqv41.exe
Close all other browsers/windows, click fix, close HJT.
Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.(no check mark beside it)
Copy and paste all the text in the quote box below into Notepad.
Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.
File::
C:\WINDOWS\system32\zqdpepnk.dat
C:\WINDOWS\system32\libssl32.dll
C:\WINDOWS\system32\mjnshxkg.dat
C:\WINDOWS\system32\atkgljcb.dat
C:\WINDOWS\system32\ujaeljov.dat
C:\WINDOWS\system32\uubesphh.dat
C:\WINDOWS\system32\libeay32.dll
C:\WINDOWS\system32\pyqv41.exe
This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HJT log.
