Pierre-Normand Houle wrote:
> "CalamityKen" wrote:
>> Pierre-Normand Houle wrote:
>>> I've been trying to eradicate this virus for several days. It was
>>> detected
>>> by Spybot. I have installed Ad-Aware SE Personal and bought a copy
>>> of Spyhunter for 30$. I've also run the FxIsbar.exe utility provided
>>> by Symantec.
>>
>> Read about SpyHunter:
>> Rogue/Suspect Anti-Spyware Products & Web Sites
>> http://www.spywarewarrior.com/rogue_...re.htm#sh_note
>>
>>> I start WinXp in safe mode and run all these utilities, scan all my
>>> drives, remove all the pest and all seems clean. I reboot and it
>>> just reinstalls itself. The suspicious processes that keep coming
>>> back are qquwa.exe, qquwm.exe, xpjrvh.exe and, of course,
>>> istsvc.exe, plus a load of registry entries referring to XXXToolbar
>>> and other crap. I kill and clean everything but it keeps coming
>>> back after each reboot. (I've tried most of the manual removal
>>> procedures
>>> for XXXToolbar and Istbar that I've found on the web or usenet)
>>>
>>> It there a *free* antivirus out there that would block it from
>>> reinstalling itself at reboot or make a better job of detecting and
>>> eradicating it than Spybot, AdAware and Spyhunter do? I'd be glad to
>>> stop spending money trying to
>>> get rid of that nuisance.
>>>
>>> Thanks for any help!
>>
>> Download the latest v1.99.1 version of HijackThis to use and post
>> your new log in a support forum after you have followed all
>> directions: http://tools.radiosplace.com/hijackthis.zip
>> or
>> http://www.spywareinfo.com/~merijn/files/hijackthis.zip
>>
>> *Important:* Create a folder on the C: drive called C:\HJT.
>> You can do this by going to My Computer (Windows key+e) then double
>> click on C: then right click and select New then Folder and name it
>> HJT.
>>
>> Move HijackThis.exe into this folder as you do not want the
>> HijackThis backup logs in the Temp folder that should be cleaned out
>> periodically nor all over your Desktop.
>>
>> When you run HijackThis from C:\HJT folder by double clicking on it
>> and have it "Fixed checked" it will create a backup file of
>> modifications to use if restore is necessary.
>>
>> Support forum:
>> http://forums.maddoktor2.com/index.php?showforum=17
>
> Thanks Kenny,
>
> My PC is still infected but I've run HijackThis and posted the log to
> forums.maddoktor2.com. Hopefully, somebody can see something
> that's being missed by AdAware, SpyHunter and the Symantec removal
> tool.

I answered your request.
http://forums.maddoktor2.com/index.php?showtopic=3705
--
YoKenny
Keep your Security software up to date at CoU
http://www.dozleng.com/updates/index.php?&act=calendar