Major Problem - browser hijacked, cannot get rid of routing.exe, wserving.exe

[floppsybunny]

i've looked again for a version of the 'wake me up' program that has an uninstall, but can't find it anywhere. is there a way to manually remove it from both the startup programs and from the startup services list (it's still in both, though currently disabled)?

[jholland1964]

i've looked again for a version of the 'wake me up' program that has an uninstall, but can't find it anywhere. is there a way to manually remove it from both the startup programs and from the startup services list (it's still in both, though currently disabled)?

Yes there is, looks to me like Combofix did remove the "orphan" files remaining from WakeMeUp and also your old MSN messenger.
Post a new HJT log and we can probably get those out of there.

[floppsybunny]

beautiful, thanks so much again, j. (log attached.)

[jholland1964]

Hi, You can run HJT again and place a checkmark next to this entry;
23 - Service: WakeMeUp! Service (svcWMU) - Unknown owner - C:\Program Files\WakeMeUp\WMUSvc.exe (file missing)
Then click the Fix Checked button and then exit HJT.

Can you tell me about this program? ClamWin. I am not familiar with it. But from what I can find

ClamWin is a Free Antivirus program for Microsoft Windows 98/Me/2000/XP/2003 and Vista.

It does show as being in your Startups in your original HJT log, I just failed to mention it earler, since we sort of got "waylaid" by other things.

[floppsybunny]

checked and fixed the wakemeup entry in hjt but doesn't seem to have gotten rid of it, checked by restarting and still there.

clamwin is a free antivirus recommended to me by a friend, hadn't noticed it doing anything strange (lets me shut it off w/out much fuss in task manager, which is actually probably not a great feature for an antivirus to have). now that i remember - i did actually uninstall (or attempt to) from the control panel but it claimed to have corrupted files and didn't uninstall properly...