Please help with Vundo and others

[Bryanr]

Sorry, yes I did run CleanupXP+ and used the program to manually delete all the files you listed.

[TurcoLoco]

Hi,

Please save this custom cleaner to your desktop, then reboot in Safe Mode and run it.
Afterwards, reboot in Normal mode and run AnalyzerXP to see if the files are gone or not.

Attach your new log file to your next post please.

[Bryanr]

OK I ran the utility, Log file attached:

Thanks for all the support so far!
It seems to be making a difference!!

[jholland1964]

Hi Bryan,
This log looks much better.
Run a new scan with HiJackThis and post the log here. Think, hopefully anyway, we are on the last leg of this removal journey

[Bryanr]

This morning is the first time since my Original post that I have not had any popups! YAY!!

HJT scan log attached

[jholland1964]

For safety reasons boot to Safe Mode;
Look for these two files noted in RED

C:\WINDOWS\plite731.exe
C:\WINDOWS\system32\ljdsrngl.exe

If you find them, delete them. If you don't then don't be concerned.

Reboot to normal mode and run HJT again and place a checkmark next to the following entries if they still remain

O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\ljdsrngl.exe
O20 - Winlogon Notify: hgdabby - hgdabby.dll (file missing)

Once you have placed the checkmarks then click the FIX button.
Exit HJT.
Reboot and run a new HJT scan and post the new log

[Bryanr]

Ok I did as instructed; here is the log file:

PS a lot of my program Icons (Microosft Word, Excell, Autocad, Adobe Acrobat, etc) have turned to a windows default Icon (the programs work fine, it just seems the Icons were lost). Is there a way to restore them?

[Bryanr]

Hi,

Please save this custom cleaner to your desktop, then reboot in Safe Mode and run it.
Afterwards, reboot in Normal mode and run AnalyzerXP to see if the files are gone or not.

Attach your new log file to your next post please.

I lost the Icons after this step.

I have AVG AntiSpyware 7.5 installed and enabled.
more to follow