Hi
If you can attach the SAS log, I’d like to have a look. It would give a better idea of what has been already removed.
Just copy and paste the log into a notepad and save it to your desktop. Then use the additional options on the reply page and browse to the note pad you saved to your desk top.
There’s still a bit to to.
Download ComboFix from Here or Here to your Desktop.
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a new HJT log in your next reply
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall.
Run combofix first then HJT. You can copy/paste the logs into notepad and attach if you wish.
