Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.
- Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:
- Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
- Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.
Please disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes.
- Open Microsoft AntiSpyware.
- Click on Tools, Settings.
- In the left pane, click on Real-time Protection.
- Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
- Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
- After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
- Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.
O4 - HKLM\..\Run: [repcqwr] C:\WINDOWS\system32\drevqc.exe r <-- the filename may be different but the line will end in a lower case r.
Reboot once more and post a new hijackthis log.