Can you post a new log please? We need to know what it removed and what it left behind... ;)

You appear to have the following:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.BHF&VSect=T

You might be able to remove it by running...

Actually I was looking for a simple method, rather than data recovery. I just grabbed the files off the 'live' sites to replace them, rather than mess about restoring them.
Thanks for all the...

umm that looks like the program rather than the log...
the log file is stored in the directory you ran the script from, but it's a .txt file I think.

Have you considered AVG free antivirus?...

follow the instructions for xp on this page: http://www.pchell.com/virus/systemrestore.shtml do the re-enable first, then the disable, then re-enable. ;)

Ah I see. Well if you don't delete your existing restore points the one containing the virus will still be there...
Try re-enabling, disabling and removing all system restore points.
Log looks...

also did you click yes to delete existing system restore points when you turned off system restore?

you tick the box next to them and click 'fix checked'.

btw it appears that you're using an old version. Could you update it and rescan please?

Ok that looks clean but there are a few broken links you might want to fix:
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O9 - Extra button: ieSpell -...

can you post a hijackthis log please? there should be instructions somewhere, and there's a link in my sig.
Cheers
Dave

Excuse my ignorance but why would you need a crack for a free download? :confused:
Or has it been released?

try start -> run
type msconfig
click the startup tab and copy out everything in there.

Have you tried using adaware, spybot, online virus scans etc?

it could also be a partly random filename

Well first off you might as well post a hijackthis log so someone can eliminate the possibility of you having spyware/viruses... Other than that... are you sure you have the right address? e.g. with...

Do you have any idea what this is: C:\WINDOWS\system32\hmktauvn.exe ?

Can you scan with Adaware and Spybot:
http://www.majorgeeks.com/download506.html
http://www.majorgeeks.com/download2471.html
Update them both before running them.

Then go to...

Yeah it seems to be based on Giant AntiSpyware's Solution. Still, I will admit it has detected things that Adaware and Spybot didn't. Actually, let me rephrase that: it detected things that adaware...

have you tested it yet or is it just the usual Microsoft Hype...

please ignore - I missed the fact there was a second page, and now I can't delete this!

Hey Crunchie - these merged threads are kinda confusing... ;)
'View backup list' should be on the first screen of hijackthis, or as Crunchie said you can do a system restore.

basically the above stuff is what should be on your system. A few of them aren't essential, but... it gets your machine back anyway.

Locate the 'view backup list' button and click it.
next tick the following entries and press restore:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =...

Download and run the standalone version of CWshredder from http://www.intermute.com/spysubtract/cwshredder_download.html

Next get adaware http://www.majorgeeks.com/download506.html
download it,...

it looks clean to me, but you still need to tick the R3 URLSearchHook entry.
Open Hijackthis, choose 'misc. tools', select 'delete a file on reboot' navigate to searchupgrader.exe file and select...

it is on my list... I think... In any case it's netster spyware that needs to go ;)

I think mounter.exe may be related to a Mustek digital camera - the description on the 04 entry corresponds to http://www.ciao.co.uk/Mustek_MDC_3000__5303302

You may wish to wait for someone else to confirm these instructions before you follow them.

Download and run the standalaone version of CWShredder:...

Hey Casperjack what about:

That was the reason I didn't post the first time :)

Thanks DLH6213 I've downloaded it and I'll try it after breakfast! ;)

Here are some of the options:
1) overheating - does the case very hot? if you take the side off the case does the inside seem hot (by hot I mean something more than warm...) If it does you may need...

Recently one of my computers was infected with a vbs worm that spread through a backup folder adding an activeX script to my html pages. When I installed and ran AVG it deleted most of the files.Is...

well you have this strange entry in your log:
O2 - BHO: wowfawk - {5CE88842-FCF5-7575-9F91-520F80390773} - C:\WINNT\System32\WOWFAWK.dll
I can't find any info on it. Do you know what it is?

I...

Can you go to this page:
http://www.sophos.com/support/disinfection/donkd.html
and follow the 'windows disinfector' instructions?
You also have a second worm in there which probably won't be...

Would you like to post a hijackthis log?
You can download the current version from http://radiosplace.com/ - just hit the 'scan and save log button', then post it in here.
Cheers

no, but
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} -
is back again as well.

Yeah I was just thinking that using AOL to avoid the holes in Internet Explorer didn't make much sense... ;)

Doesn't AOL use Internet Explorer as it's browser core? read it somewhere... not sure how reliable it is.

ok ta. ;) .

Are you sure you didn't download the update which actually detected the virus you had? ;)
In any case, I once took a pc out to a client, set it up, dialed up the internet to download zonealarm cos...

Does it make any difference when it just shows the number, not the description or address? e.g. do a google search for that number and it has a description and an address, whereas here it has...