HijackThis log - please help

KEM

Ran SpyBot and it only came up with one DoubleClick tracking cookie so fixed that.

Have manually deleted the files you suggested - is it possible that they didn't delete because there was a gap in the word "installer"?

Is that everything now?

Very briefly, what does ComboFix do? Does it fix things it finds when it runs? What sort of things?

aliEnRIK

I think this site puts the gap in for some reason (And yes, thats probably the reason as I manually removed the gaps before posting them)

Combofix should NEVER be run unless someone tells you to that knows how to read the logs. It will auto remove certain infections and create a logfile for people to look through to determine what the next plan of action is

aliEnRIK

Download and run the FREE version of DR WEB
http://www.freedrweb.com/download+cureit/gr/
Turn your anti virus OFF
Click CANCEL to the 'Would you like to read purchase terms now?' message
Click START click OK
It will auto QUICK scan
After that set to scan the WHOLE computer and press the 'play' icon

***DO NOT UPGRADE TO FULL VERSION***

KEM

The Quick scan has just finished (took almost an hour) and asks if I want to restore the default HOSTS file. Do I answer yes or no?

aliEnRIK

Click YES. Once the full scan has run then youll need to rerun spybots IMMUNISE section

KEM

Now running a complete scan - when finished I'll immunise in spybot.

Will that be everything then or is there more to do?

Have I removed much from the machine so far? And what has gone? Sorry, just curious to know what has actually been done.

Many thanks for all the help so far.

aliEnRIK

Combofix removed some dodgy 'recycle' files and youve manually deleted some dodgy installers
Dr web has reset the hosts file (No bad thing as many dodgy rograms use the hosts file to redirect to pages you dont want to go to)
We've yet to see if it finds anything
Spybot checks for spyware (generally) and whilst it never really found anything malicious its 'immunise' feature will prevent attacks from certain websites

The reason ive aksed you to run them is simply to make absolute sure your machine is as it should be

aliEnRIK

Once youve done everything. Please rerun HIJACK THIS so we can see exactly whats left running now

KEM

The Dr Web scan is taking forever (looks like it has done approx 80k files of 942k in nearly an hour) and has just come up with:

Combofix.exe - Archive contains infected objects - move?
Yes to all, yes, no, no to all?

Help!!

aliEnRIK

put yes to all for everything