[bachmanva]

Hi Howard,

I've followed your instructions for removing this malware from your sticky. Looks like things went OK. I've attached the option 1 from FINDAWF as well as the scan log from Hijack this. Both were run after following your instructions for options 1-4. Pls let me know how it looks. Thanks.

I'm not sure if I ran the log from 'crusty' or hijack this. Here is the crusty log.

[Howard]

Hello and welcome to


Your log files are clean.

However, I`d like to check for any hidden infections.

Download combofix.exe. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "Y" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Combofix will automatically save the log file to C:\combofix.txt

Please post the Combofix log.

Regards Howard

This thread is for the use of bachmanva only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[bachmanva]

ok, here is the attached file. I noted a lot of security warnings when running with pc-illin. I assume this is OK? Thanks.

[Howard]

That seems fine mate. No problem with the pc-cillin alerts.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of bachmanva only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[Howard]

I`m marking this thread as solved.

If you need this thread re-opened please contact a moderator or PM me.

Regards Howard