Hello everyone, I can usually remove spyware/adware myself without difficulty but this one particular trojan I have is a doozie. Can someone please help me?? I believe it is a Vundo stored in stubborn DLL files in the C:\WINDOWS\SYSTEM32 directory. Specifically, they appear in my hijackthis log (full log attached) as this line: O20 - AppInit_DLLs: C:\WINDOWS\system32\wunufaku.dll C:\WINDOWS\system32\nizukipu.dll c:\windows\system32\hejivego.dll For the life of me I cannot remove these three files! Here are the things I've attempted so far, and I've tried them in both regular and safe mode: Initially I did the following scans: - AVG Free Antivirus 8.0 full system scan - Lavasoft Ad-aware - Spyware Doctor - CCleaner - VundoFix.exe - HijackThis (removing clearly bad entries) Each found some infections and claimed to remove them. Then I noticed that about 10 bad DLLs were in my System32 folder still not removed... So I used HijackThis's "delete file on reboot" utility to remove most of them... But the three listed above will not delete. Then I tried: - FileAssassin - the program crashes (error message "needs to be shutdown") whenever I try either "FileAssassin's method" or "delete on reboot" - KillBox - tried to delete on reboot but keeps giving me the "PendingFileRenameOperations Registry Data has been Removed by External Process" error; and when reboot is done manually, nothing happens. Here is log: Pocket Killbox version 22.214.171.1241 Running on Windows XP as Administrator was started @ Sunday, January 04, 2009, 8:28 AM # 1 [Delete on Reboot] Path = c:\windows\system32\nizukipu.dll PendingFileRenameOperations Registry Data has been Removed by External Process! @ 8:29:16 AM Killbox Closed(Exit) @ 8:29:23 AM I feel like I tried everything and nothing works... the files are still there causing popups and slowing down my computer! PLEASE HELP ME! thanks!!!