Win64/Patched.A

Rescan with HitmanPro, when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace.

Choose to Delete these files if they are detected:

• 
  
  C:\Windows\assembly\GAC_32\Desktop.ini
  C:\Windows\assembly\GAC_64\Desktop.ini
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\80000000.@
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\80000032.@
  C:\Windows\system32\services.exe
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\@ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\L\ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\L\00000004.@ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\L\201d3dde (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\00000004.@ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\00000008.@ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\000000cb.@ (ZeroAccess)
  C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U\80000064.@ (ZeroAccess)

Ignore all other detections.
Afterwards, click the Next button.
HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

Now rescan with RogueKiller and when it opens, press the Scan button

Now click the DNS tab and locate these detections:[/B]

• 
  [DNS] HKLM\[...]\ControlSet001\Services\Interfaces\{E80D4202-38F4-4BEB-BDB1-38DD76B2A74D} : NameServer (130.88.203.7,130.88.13.7) -> FOUND
  [DNS] HKLM\[...]\ControlSet002\Services\Interfaces\{E80D4202-38F4-4BEB-BDB1-38DD76B2A74D} : NameServer (130.88.203.7,130.88.13.7) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.


Now click the Files/folders tab and locate these detections:

• 
  [ZeroAccess][FILE] @ : C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\@ --> FOUND
  [ZeroAccess][FOLDER] U : C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\U --> FOUND
  [ZeroAccess][FOLDER] L : C:\Windows\Installer\{0cc5a250-030b-c32c-270e-5d7533e31767}\L --> FOUND
  [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
  [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
  [Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Now rescan with both RogueKiller and Hitman and attach both those new logs as well.

 

Looks much better. Let me just check one more log and then you will probably be good to go.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).
Then attach the below logs:
* C:\MGlogs.zip
Make sure you tell me how things are working now!