hi E-literat,

crap, its still there. no i dont think winbuyer is causing all the problems. i saw there website: looks harmless, iam surprised they wouldnt have a uninstaller in the add/remove programs folder though. we can come back to that later.

we will use pocket killbox then do some stuff in safe mode again, you might want to copy/paste the safe mode stuff into notepad and save it to desktop.

have you gotton killbox yet, if not you can get it here:

http://www.downloads.subratam.org/KillBox.zip
-----------------------------
start killbox.exe

Select the options: Replace on Reboot AND use dummy

copy paste this line into the field Full Path of File to Delete

C:\WINDOWS\system32\c00E4CE7.dat

then click the button with a white X on red background

When asked if you would like to Reboot, select >No.
Once again, in Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\system32\ntos.exe

Press the button with a red circle and a white X.
When asked to Reboot, select >Yes this time

your computer will reboot, during the reboot tap the f8 key so it starts in safe mode again.
once in safe mode. please run superantispyware once. and do this also:

using explorer(right click on start>explore) drill down to these >>> you want to delete whats >inside< the folder, not the folder itself<< delete what you can

C:\Windows\Temp\ (at the top you can use: Edit>select all File>delete

C:\Documents and Settings\-Your Profile-\Local Settings\Temporary Internet Files\ (will dump all your cached internet content including cookies)

C:\Documents and Settings\-Your Profile-\Local Settings\Temp\

C:\Documents and Settings\-Any other users Profile-\Local Settings\Temporary Internet Files\

C:\Documents and Settings\-Any other users Profile-\Local Settings\Temp\

reboot normally and post a new hjt log please

shelf life