That's fine. I knew some of these would require a second pass.
Download
KillBox http://www.bleepingcomputer.com/file...re/KillBox.zip
Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be but make sure)
Go to Start->Run and type
Services.msc then hit Ok
Scroll down and find the service called:
System Startup Service (SvcProc)
When you find it, double-click on it. In the next window that opens, click the
Stop button, then click on properties and under the General Tab, change the Startup Type to
Disabled. Now hit
Apply and then
Ok and close any open windows.
Repeat the same procedure for this service:
Task Monitor (Taskmon)
Click START…RUN…Type in regedit. Make sure just “My Computer” is showing in the left pane and click..FILE….EXPORT…and save a copy some were in case you make a mistake. Now navigate to each of the following keys and delete the file/folder/entry I highlighted in
RED
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\
ZepMon\Driver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver
Close regedit.
Run hijackthis and fix the following...
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: Task Monitor (Taskmon) - Unknown owner - c:\windows\system\svchost.exe
Run KILL box. Paste the following locations into KILL BOX one at a time. Checkmark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say
YES and when the next box opens prompting you to reboot now...click
NO...and proceed with the next file. Once you get to the last one click
YES and it will reboot.
C:\WINDOWS\svcproc.exe
c:\windows\system\svchost.exe
Once you reboot..post another hijackthis log.