15

Thanks for your patience vbs.

Since Spyware Remover and Download Accelerator Plus seem to be in the past tense we won’t worry about them now. I’m not sure there is 100% agreement on Spyware Remover being a rogue, and DAP might have been the bigger of those two problems as it is a source of adware and possibly worse.

Anyway, I’ve felt since the being that the trojan was the main priority so lets go for that.

Since putting C:\WINDOWS\system\smss.exe in quarantine isn’t an option burn a copy to CD - this is just a conservative approach prior to deletion. Put the CD in a safe place since you don’t want the file finding its way back on anybody’s computer.

Open HijackThis from the C:\HJT\ folder and fix this line

O4 - HKLM..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w

Close HijackThis and boot into safe mode. Delete smss.exe from C:\Windows\System, remembering to leave the file in System32 intact.

While in safe mode scan again with SuperAntispyware and a-Squared. Quarantine anyting found.

Reboot into normal mode and get that firewall installed. Update Windows as you’re behind on the security patches. Then run HijckThis and post the log again. There may be a couple other things we need to fix but I’m still researching.