Hi

Please download VundoFix.exe version 4.2.29 to your desktop.
http://www.atribune.org/ccount/click.php?id=4

* Double-click VundoFix.exe to run it.
* Click the Scan for Vundo button.
* Once it's done scanning, click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.
* Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Steve

After you run the Vmundo fix please run this fix.

Download HaxFix.exe.
http://users.telenet.be/marcvn/tools/haxfix.exe
Save it to the Desktop.
Double click on the HaxFix icon
HaxFix opens a red DOS window
A message: Press any key to continue… appears

Next it tells you to insert the haxdoor notify subkey without the
numbers…
Type the following: pptp

Press Enter to continue.

If the haxdoor variant is found, a message to close all other open
windows appears.

Close them, except the red DOS window from HaxFix and press Enter.
The computer reboots.

After reboot, a new red DOS window opens.
Once again it tells you to insert the haxdoor notify subkey without the
numbers...
Type the following again: pptp
Press Enter to continue.

After the red DOS window closes, the contents of the HaxFix log file
are located at: C:\haxfix.txt

Now post C:\haxfix.txt, the Vmundo log, and a fresh HJT log

Steve