Ried

Hi,

You should be noticing a marked improvement in your system after running ComboFix as it neutralized the main infection.

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

***************************************************

Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SNM] "C:\Program Files\SpyNoMore\SNM.exe" /startup
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZJxdm120YYUS
O21 - SSODL: vpssup - {FE5E1327-022F-4DE1-BE44-0F860E04A6D5} - C:\WINDOWS\vpssup.dll (file missing)
O21 - SSODL: expro - {2E3D4FFD-0B06-48B3-A0AE-1294323D556C} - C:\WINDOWS\expro.dll (file missing)


Click 'Fix Checked' and close HijackThis.

--------------------------------------------------------------------
Of the above listed programs, SuperAntiSpyware was the only proven trustworthy program. The others were previously known as rogue programs and I highly recommend their removal. You have a good set up with AdAware Personal, SpySweeper and Iolo. I'll have a couple more for you to add once we're cleaning your system.

Uninstall SpyNoMore via the Add/Remove programs.

-------------------------------------------------------------------

Delete the following folders: (if they still exist)

C:\Program Files\NoAdware5.0
C:\Program Files\SpyNoMore

-------------------------------------------------------------------

Reboot you system.

-------------------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6-windowsi586-p.exe to install the newest version.

------------------------------------------------------------

Please run this online scan to search for any remnants that may be lurking about. It can take some time, so please be patient and allow it to run it's full course:

Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------------

Run a new scan with HijackThis and save the log.

--------------------------------------------------------------------

Please include the following in your next reply:

Panda results
New HijackThis log
Update on system behavior