I recently caught the Vundo--SmitFraud--Psapianalyzer browser-hijacker bug that's going around. Spybot was able to detect the Psapianalyzer files (which it labeled Win32.Agent.at), and claimed to be fixing them, but they would immediately reappear. I went to another forum (BleepingComputer) and, with the help I obtained there, was able to get rid of the bug. The ONLY trace of this experience that's left anywhere on my computer (as far as I can tell) is that there are four entries at the bottom of the "System Startup" page on SpyBot's Tools tab for combd (loading from c:\winnt\inf\combd.dll), hggebaa (loading from hggebaa.dll), nnlkj (loading from C:\winnt\system32\nnlkj.dll), and SensLogn (loading from WINotify.dll). SpyBot says these are loading from System.ini, but there is no mention of these files (or much of anything else) in my System.ini file. Incidentally, I'm running Win2K Pro, SP4, with all updates and patches current.

Before the BleepingComputer repair process, when I un-checked these entries to disable them, new checked non-disabled ones automatically regenerated the next time I viewed the Tools/System Startup page. After the BleepingComputer repair process, the check boxes for these items are no longer checked, but as before, if I delete the entries on the Tools/System Startup page, they automatically regenerate the next time I view that page. The referenced files are NOT in the locations shown, and I have exhaustively searched my computer (with both Windows and third-party search programs), and have exhaustively scanned my Registry, and there are NO references to these files that I can find anywhere...except on the Tools/System Startup page of SpyBot. Other programs that show what's starting when my computer boots up (such as AVG AntiSpyware's Analysis/Autostart tab) do NOT show these four entries. I have even completely uninstalled SpyBot, rebooted, completely deleted the subdirectory where SpyBot was formerly installed, downloaded the current installation file directly from the Safer Networking website mirror, done a fresh install, performed all updates, and enabled the Immunize feature, only to find that the four (unchecked) entries are STILL listed, and STILL cannot be deleted. I am 99.99999999% certain that these four files are NOT anywhere on my computer any longer, and that these four entries are just a false positive, but that last tiny bit of doubt exists because SpyBot is still listing them on the Tools/System Startup page. Any thoughts or suggestions?