Ried

Almost there.

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out these instructions.

Once again, it is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

***************************************************

Download KillBox. (it's important that you get version v2.0.0.175). We'll use it shortly.

***************************************************

From Normal Mode:

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries:

O20 - AppInit_DLLs: d3dishsv.dll wmneprfl.dll
O20 - Winlogon Notify: winbjt32 - C:\WINDOWS\
O20 - Winlogon Notify: wnmicf - wnmicf.dll (file missing)

Click 'Fix Checked' and close HijackThis.

-----------------------------------------------------

Go to <<Start>> then <<Run>> then paste in the single line command then click OK

"%userprofile%\desktop\combofix.exe" /v d3dishsv wmneprfl

When finished, it shall produce a log for you. Post that log in your next reply along with a new HijackThis log.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

-----------------------------------------------------

Launch KillBox.exe & select the following options:

• Delete on Reboot
• All files (if available)

Copy the file names below to the clipboard by highlighting them and pressing Ctrl-C:

C:\dumwnmifc.sys
C:\dumwnmicf.sys
C:\dumwnmicf.dll

Select/tick the following:
* Delete on Reboot
* End Explorer Shell While Killing File
Click the RED X button.

Click Yes at the 'Delete on Reboot' prompt. Click Yes at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, download and run missingfilesetup.exe. Then try Killbox again.
* If you received a message such as: "PendingFileRenameOperations registry data has been removed by external process", you have to manually restart Windows.

***************************************************

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply along with a new HijackThis log.