1. In your latest log, I don't see anything indicating that you installed MS Antispyware beta. Did you install and run that program in addition to ewido? If not, please do that now.
2. Click Start – Run - and type in:
services.msc
Click OK.
In the services window find: Power Manager (PowerManager)
Right click and choose Properties. On the General tab under Service Status click the Stop button to stop the service. Beside Startup Type in the dropdown menu select Disabled. Click Apply then OK. Exit the Services utility.
Note: You may get an error here when trying to access the properties of the service. If you do get an error, just select the service and look there in the top left of the main service window and click "Stop" to stop the service. If that gives an error or it is already stopped, just skip this step and proceed with the rest.
3. Boot into Safe Mode.
a) Open Hijack This and click on the "Open Misc Tools section" button. Click on the "Delete an NT Service" button.
Copy and paste this line in that box:
PowerManager
Click OK.
b) Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".
- For every user account listed under C:\Documents and Settings, delete the entire contents of the following folders (but not the folders themselves):
(Important: One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if any data that you care about is living in those Temp folders, you need to move it to a safe location now, or it will be erased along with everything else!)
1. Cookies
2. Local Settings\Temp
3. Local Settings\History
4. Local Settings\Temporary Internet Files
- Delete the entire content of your C:\Windows\Temp folder.
- Delete the entire content of your C:\Windows\Prefetch folder.
Note- If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed. Windows will allow you to delete the versions of those files which exist in sub-folders within the main Temp/Temorary folders, but might not let you delete the versions of those files that exist in the main Temp folders themselves; this is normal and OK.
- Empty your Recycle Bin.
4. While still in Safe Mode, run full scans/fixes with both ewido and MS Antispyware.
5. Reboot normally, run HijackThis again, and post the new log. Also let us know if the original problem still persists.
