Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should
not have any open browsers when you are following the procedures below.
I will assume System Restore is still off and hidden files are still visible.
Reboot into Safe Mode (hit F8 key until menu shows up).
Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click
Kill process for each one if they are still listed (they shouldn't be - but double check it):
C:\Program Files\Win Comm\WinComm.exe
C:\WINDOWS\System32\mscom32.exe
C:\WINDOWS\System32\mscnfg32.exe
C:\WINDOWS\System32\svshost.exe
C:\Program Files\Win Comm\WinLock.exe
Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
WinComm
IncrediFind
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_...count_id=154445
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_...count_id=154445
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.slotch.com/?&account_id=154445
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_...count_id=154445
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe
O4 - HKLM\..\Run: [Sys29] c:\windows\system32\wingau32.exe
O4 - HKLM\..\Run: [Windows Dcom2 Fix] mscom32.exe
O4 - HKLM\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] svshost.exe
O4 - HKLM\..\RunServices: [Windows Dcom2 Fix] mscom32.exe
O4 - HKLM\..\RunServices: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] svshost.exe
O4 - HKCU\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] svshost.exe
O4 - HKCU\..\Run: [Window Monitor] winmon32.exe
O4 - HKCU\..\Run: [Windows Dcom2 Fix] mscom32.exe
O4 - HKCU\..\RunServices: [Window Monitor] winmon32.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f... 1c81306a97bea
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softw...006_regular.cab
Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:
C:\Program Files\Win Comm\
C:\Program Files\IncrediFind\
BE VERY CAREFUL TO ONLY DELETE THESE EXACT FILE NAMES! THERE ARE SIMILARLY NAMED CRITICAL WINDOWS FILES, WHICH SHOULD NOT BE AFFECTED IN ANY WAY!
C:\WINDOWS\System32\mscom32.exe
C:\WINDOWS\System32\mscnfg32.exe
C:\WINDOWS\System32\svshost.exe
Also delete ALL those EXE and DLL files (in their corresponding directory) listed above in RED.
Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean.