[maliprog]

Good job! Now run OTL fix in infected account just like you did last time. After this make sure you reboot your system and test infected account. Let's see if this fix the problem...

Please close all running programs and Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
  O35 - HKCU\..exefile [open] -- "C:\Documents and Settings\Anna\Local Settings\Application Data\vaq.exe" -a "%1" %*
  [2011/06/12 18:28:26 | 000,017,364 | -HS- | C] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\d0h8oedl0y462n0bmu7xyw4
  
  :Files
  ipconfig /flushdns /c
  C:\Documents and Settings\Anna\Local Settings\Application Data\vaq.exe
  C:\Documents and Settings\Anna\Local Settings\Application Data\d0h8oedl0y462n0bmu7xyw4
  
  :Commands
  [purity]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post the fix log it produces in your next reply or you can find it in C:\_OTL\MovedFiles

[Advertisements]

========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Classes\exefile\shell\open\command\\'' updated successfully.
File "C:\Documents and Settings\Anna\Local Settings\Application Data\vaq.exe" -a "%1" %* not found.
C:\Documents and Settings\Anna\Local Settings\Application Data\d0h8oedl0y462n0bmu7xyw4 moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\cmd.bat deleted successfully.
C:\cmd.txt deleted successfully.
File\Folder C:\Documents and Settings\Anna\Local Settings\Application Data\vaq.exe not found.
File\Folder C:\Documents and Settings\Anna\Local Settings\Application Data\d0h8oedl0y462n0bmu7xyw4 not found.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.26.1 log created on 08052011_072127

[AnnaMarie07]

========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Classes\exefile\shell\open\command\\'' updated successfully.
File "C:\Documents and Settings\Anna\Local Settings\Application Data\vaq.exe" -a "%1" %* not found.
C:\Documents and Settings\Anna\Local Settings\Application Data\d0h8oedl0y462n0bmu7xyw4 moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\cmd.bat deleted successfully.
C:\cmd.txt deleted successfully.
File\Folder C:\Documents and Settings\Anna\Local Settings\Application Data\vaq.exe not found.
File\Folder C:\Documents and Settings\Anna\Local Settings\Application Data\d0h8oedl0y462n0bmu7xyw4 not found.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.26.1 log created on 08052011_072127

[maliprog]

Good... How is your system now? Any changes?

[AnnaMarie07]

I can now open programs under the infected user, but I am not able to turn Windows Automatic Update back on!

[maliprog]

Let's repair that too.

Download Microsoft FixIt and run it in order to repair updates. Test your system and come back with results so we can continue to make sure your system is clean.

[maliprog]

Hi AnnaMarie07,

Are you still with me? Did you manage to repair your updates?

[maliprog]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.