Run HijackThis with no other programs open and have it do a scan. Place a check in the little box next to the following items (if there):
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions
present
O8 - Extra context menu item: &Search - [http]edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSzed044YYJM_ZB
Click the Fix Checked button. Close HJT.
Now go into Add/Remove Programs in your Control Panel and remove anything having to do with MyWebSearch.
If you have any flash drives that you've used recently (i.e. since your computer was infected), insert them now. Scan all drives on your system for the filename
sxs.exe and delete all instances found. Then leave your flash drive(s) connected and scan all drives with ComboFix and AVG Antispyware, and post their logs. Also scan with HijackThis and post a fresh log. Scan all drives with AVG Antirootkit and post the results here.
Regards
This thread is for the use of Jacal only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.