"CalamityKen" <YKnot@home.invalid> wrote in message news:Py_3e.2965$Fy3.177283@news20.bellglobal.com.. .
> Pierre-Normand Houle wrote:
> > I've been trying to eradicate this virus for several days. It was
> > detected
> > by Spybot. I have installed Ad-Aware SE Personal and bought a copy
> > of Spyhunter for 30$. I've also run the FxIsbar.exe utility provided
> > by Symantec.
>
> Read about SpyHunter:
> Rogue/Suspect Anti-Spyware Products & Web Sites
> http://www.spywarewarrior.com/rogue_...re.htm#sh_note
>
> > I start WinXp in safe mode and run all these utilities, scan all my
> > drives, remove all the pest and all seems clean. I reboot and it just
> > reinstalls itself. The suspicious processes that keep coming back are
> > qquwa.exe, qquwm.exe, xpjrvh.exe and, of course, istsvc.exe, plus a
> > load of registry entries referring to XXXToolbar and other crap. I
> > kill and clean everything but it keeps coming back after each reboot.
> > (I've tried most of the manual removal procedures
> > for XXXToolbar and Istbar that I've found on the web or usenet)
> >
> > It there a *free* antivirus out there that would block it from
> > reinstalling itself at reboot or make a better job of detecting and
> > eradicating it than Spybot, AdAware and Spyhunter do? I'd be glad to
> > stop spending money trying to
> > get rid of that nuisance.
> >
> > Thanks for any help!
>
> Download the latest v1.99.1 version of HijackThis to use and post your new
> log in a support forum after you have followed all directions:
> http://tools.radiosplace.com/hijackthis.zip
> or
> http://www.spywareinfo.com/~merijn/files/hijackthis.zip
>
> *Important:* Create a folder on the C: drive called C:\HJT.
> You can do this by going to My Computer (Windows key+e) then double click on
> C: then right click and select New then Folder and name it HJT.
>
> Move HijackThis.exe into this folder as you do not want the HijackThis
> backup logs in the Temp folder that should be cleaned out periodically nor
> all over your Desktop.
>
> When you run HijackThis from C:\HJT folder by double clicking on it and have
> it "Fixed checked" it will create a backup file of modifications to use if
> restore is necessary.
>
> Support forum:
> http://forums.maddoktor2.com/index.php?showforum=17

Thanks Kenny,

My PC is still infected but I've run HijackThis and posted the log to
forums.maddoktor2.com. Hopefully, somebody can see something
that's being missed by AdAware, SpyHunter and the Symantec removal
tool.