Spyware/adware/popups just wont go away

[TurcoLoco]

Hi Jim,

I am trying to fill in for Judy while she is out on vacation but I have been very busy lately so I am a bit behind. She should be back to pick up the slack but if not, I will do my best to follow up, ok?

Hang in there!

[jholland1964]

Can I ask that you please turn off Windows Defender, AdAware 2007 Service.



Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the
Scan for Vundo button." when VundoFix appears at reboot.

Update your AdAware2007. Then reboot to SAFE MODE

Using the F8 Method

1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
3. Select the option for Safe Mode using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode.

Once in SAFE MODE please run a full system Scan with AdAware. Be sure to quarantine everything found. One item showing in your logs is the Look2Me infection AdAware 2007 has this removal tool fully integrated into the program.
Also run the AVG Anti-spy program in SAFE MODE and fix all that is found.
Once you have completed the above steps then reboot into normal mode and run a new scan with HJT and post that log along with the new AVG log.

[jim532]

thanks again for your help I followed the instructions and I've attached all relative information. One thing that is very persistant is whenever I open the browser for the first time after rebooting is I get a script error refering to a file called func.js, then immediatly after Auto-protect finds and deletes a file call func.exe.

thanks again,

jim