tetonbob

I've corrected the attached regfix. Discard the one you already downloaded, and download the newly uploaded zip file in the previous post. There's no need to unzip it, you can run it from within the zip folder, as long as you download the zip file to your desktop.

Please do so now using the previous instructions.

Spysweeper still appears to be active on your machine, and it is this program's protection which I think is preventing some HJT entries from staying fixed.

Is this a paid version of Spysweeper, or a trial?

While this program is still enabled, it may prevent us from fixing HJT entries.

We can try again:

Please disable Webroot SpySweeper, as it may hinder the removal of some entries. You can re-enable it after you're clean.

To disable Webroot SpySweeper:

• Go to the Options>Program Options
• Uncheck Load at Windows Startup
• Click Shields on the left.
• Click Internet Explorer and uncheck all items.
• Click Windows System and uncheck all items.
• Click Startup Programs and uncheck all items.
• Click Browser Add-Ons and uncheck all items.
• Exit Spysweeper.

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\oocqrc.exe reg_run
O4 - HKLM\..\RunOnce: [stampsregk] C:\PROGRA~1\STAMPS~1.COM\regall.exe -k -s
O4 - HKLM\..\RunOnce: [stampsrego] C:\PROGRA~1\STAMPS~1.COM\regall.exe -o -s
O4 - HKLM\..\RunOnce: [stampsreg] C:\PROGRA~1\STAMPS~1.COM\RegAll.exe -s

---------------------------------------------------------------------------------------------

Then run another HJT scan, save the log and post it.

Right click on http://www.silentrunners.org/Silent%20Runners.vbs and choose Save As...Save it to your Desktop. Double click on 'Silent Runners' to run it. Choose 'No' at the prompt. It will create a file called 'Startup Programs' (followed by your computer name and current date) on your desktop. Do NOT open it yet. Wait until you get the prompt 'All Done'. Then open up that file and post all the contents here in your next post. If you receive a warning message about scripts, choose to allow it to run.