[darrenholden]

Please someone help!
I was hit by a virus at the weekend and everytime I think Ive nailed it I find something else.
I know the root of the problem is pokapoka in various forms but I cant seem to flush it out.
Spysweeper crashes whilst sweeping the registry, if i just sweep cookies and files it finds the spyware (elitebar) but says it needs to reboot to finish removing it, but its still there after reboot
I have been running hijack this and have removed most things (probably too much).
I have now joined this forum after 2 days of lurking trying to work the problem out myself.
I have followed the thread regarding prepost tasks, I have ran clean up and downloaded and updated Adaware.
Now when I run adaware it runs for 10 secs and then I get notification of system shutdown because windows/system32/services.exe terminated unexpectedly

heres hijackthis log

I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\csrss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\alg.exe
I:\WINDOWS\system32\pctspk.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
I:\WINDOWS\System32\wdfmgr.exe
I:\WINDOWS\System32\UAService7.exe
I:\WINDOWS\wanmpsvc.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
I:\WINDOWS\etb\pokapoka61.exe
I:\WINDOWS\System32\cmd.exe
I:\WINDOWS\System32\wuauclt.exe
I:\Program Files\AOL 8.0\waol.exe
I:\Program Files\AOL 8.0\shellmon.exe
I:\Program Files\Hijack This\Hijack This.exe
I:\Program Files\Internet Explorer\iexplore.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapp...//www.yahoo.com
O4 - HKLM\..\Run: [Runner] I:\WINDOWS\svchost.exe /i
O4 - HKLM\..\Run: [NeroCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Installer] I:\WINDOWS\System32\ntdll.exe
O4 - HKLM\..\Run: [Windows Spooler] I:\WINDOWS\System32\spoolsv32.exe
O4 - HKLM\..\Run: [SpySweeper] "I:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O17 - HKLM\System\CCS\Services\Tcpip\..\{A1491CE9-A6FF-4818-AEF1-A3DBF19A15D7}: NameServer = 205.188.146.145

my main problems at the moment are pop ups, IE errors (im on aol) and worst of all AOL crashes on any redirect

[Advertisements]

Hi, Still trying like [bleep] to get things running smoothly

yesterdays thread

I have now tried manually removing the etb file, ive tried to delete and erase it, but sure enough on reboot the etb file is back.

also this may be a separate issue but pc is slower than ever and task manager shows that cmd.exe(80%), crss.exe(20%) are using 100% of cpu

please help me get my pc back

[darrenholden]

Hi, Still trying like [bleep] to get things running smoothly

yesterdays thread

I have now tried manually removing the etb file, ive tried to delete and erase it, but sure enough on reboot the etb file is back.

also this may be a separate issue but pc is slower than ever and task manager shows that cmd.exe(80%), crss.exe(20%) are using 100% of cpu

please help me get my pc back