Logs from XP procedure

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

• 
  [Services][Root.Necurs] HKLM\[...]\ControlSet001\Services\868334a9e0e392ea (C:\WINDOWS\System32\Drivers\868334a9e0e392ea.sys) -> FOUND
  [Services][Root.Necurs] HKLM\[...]\ControlSet003\Services\868334a9e0e392ea (C:\WINDOWS\System32\Drivers\868334a9e0e392ea.sys) -> FOUND
  [TASK][SUSP PATH] Security Center Update - 3615320570.job : C:\Documents and Settings\Joni\Application Data\Bowataz\poteifh.exe -> FOUND
  [TASK][SUSP PATH] Security Center Update - 1414583858.job : C:\Documents and Settings\Joni\Application Data\Xudywu\irugigy.exe -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

Now click the Files/folders tab and locate these detections:

• 
  [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-18\$f9644ece1e752963eaa09888c3ca158c\@ [-] --> FOUND
  [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-21-1801674531-1972579041-839522115-1004\$f9644ece1e752963eaa09888c3ca158c\@ [-] --> FOUND
  [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$f9644ece1e752963eaa09888c3ca158c\U --> FOUND
  [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-1801674531-1972579041-839522115-1004\$f9644ece1e752963eaa09888c3ca158c\U --> FOUND
  [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$f9644ece1e752963eaa09888c3ca158c\L --> FOUND
  [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-1801674531-1972579041-839522115-1004\$f9644ece1e752963eaa09888c3ca158c\L --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Do not reboot your computer yet.

Now rerun Hitman and have it fix everything it found!!

Reboot and rescan with both RogueKiller and Hitman and attach both those new logs as well.

Be sure to tell me how things are running now.

 

Rerun Hitman and have it remove those items that it found. Reboot and rescan with Hitman and attach the new log.

Be sure to tell me how things are running.

 

You can restore the defaults for the Start Menu, Accessories and Administrative Tools as follows:

• Restore Accessories Program Files Menu with accrestore.zip for XP
  
  • Extract (unzip) the tool, double-click on it to run and ensure that the following check boxes are checked (as shown below):
  
  http://forums.majorgeeks.com/chaslang/images/restore-start-menu-accessories-folder.png
  
  • Then click on the Restore button.
  
  

Now use windows explorer to find and delete:
C:\Documents and Settings\Joni\Application Data\Xudywu
C:\Documents and Settings\All Users\Application Data\-YbXxSGftvqFgiS
C:\Documents and Settings\All Users\Application Data\-YbXxSGftvqFgiSr
C:\Documents and Settings\All Users\Application Data\YbXxSGftvqFgiS


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Attach the new C:\MGLogs.zip.

 

IF folder C:\Documents and Settings\user_name\Local Settings\Temp\smtmp exist...

Copy all content of this folder:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\1
and paste it to this folder:
C:\Documents and Settings\All Users\Start Menu


Copy all content of this folder:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\2
and paste it to this folder:
C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch


Copy all content of this folder:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\3
and paste it to this folder:
C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar


Copy all content of this folder:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\4
and paste it to this folder:
C:\Documents and Settings\All Users\Desktop

 

You may need to reinstall some of the programs.