[Metallica]

Good detective work.

The Sysai folder is from Apropos spyware and can be deleted completely.

param32.dll will be a bit more difficult.

Copy the part in bold below into notepad and save it as param.reg

REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{D56A1203-1452-EBA1-7294-EE3377770000}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{D56A1203-1452-EBA1-7294-EE3377770000}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command]
@="\"%1\" %*"

Then have HijackThis fix:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newgenlook.info/ad/ad0278/

Then reboot and you should be able to delete the file.

Let me know.

Regards,

Pieter

[Advertisements]

Save param.reg in which directory?

HJT can't seem to fix that entry... after i fix, when i run HJT again, it remains there.

[roamer]

Save param.reg in which directory?

HJT can't seem to fix that entry... after i fix, when i run HJT again, it remains there.

[roamer]

I have created param.reg in the same directory as param32.dll. Now it doesnt appear as hidden. So I should delete param32.dll now?

[Metallica]

I have created param.reg in the same directory as param32.dll. Now it doesnt appear as hidden. So I should delete param32.dll now?

Yes please. Then fix the entry in HijackThis and reboot.

param32.dll is the one sustaining that I think.

Regards,

Pieter

[roamer]

IT IS RESOLVED!

param32.dll is really the culprit. Thanks so much for your time and patience! *tears of joy*

[Metallica]

Glad I was able to help.
I do hope your memory banks hold out for a while longer, but you really should look at your options regarding those. Better prepared then sorry.

Alos have a look at my site for some tips on protecting your system.

Regards,

Pieter

[Metallica]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If your the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.