Ok well... Yes, NOD32 found several things that the other ones didn't... But.. I'm still getting the random IE7 opening and going to weird sites... I really don't want to re-format... But it's starting to look like I have no choice... If any of you know something that will work, please let me know soon.

Darlyle.

__________________
[IMG]file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/moz-screenshot-2.jpg[/IMG]

Scan with all the anti-spyware apps including AVG Anti-Spyware, Ad-Aware SE, Spybot S&D, CounterSpy, Webroot SpySweeper, and Spyware Doctor. You can also switch to FireFox, install the No Script and Ad-Block plugins. It's probably easier to reformat. You can always backup any key documents first, but if you really want to keep your system as-is, then go nuts scanning with anti-spy apps.

__________________

Try the immunize option in Spybot, should be a bit of help.

__________________

Yep, SpyBot has some really great stuff that no one uses, like the bad download blocker for IE, startup, BHO, and ActiveX control management, a shredder, etc.

__________________

Are they different sites each time, or is it one...like a runonce url?

__________________
::XSGfX::
::My dA::

Different sites every time... Somtimes it's a search engine, sometimes it's pr0n, sometimes it's movie reviews... It just changes =/

And I can't seem to remove the 3 files from my HJT log, those looked sketchy to me too... But, nothing pics them up... cept nod32, and it says it removed them, but then hjt still finds them <_<

*Sighs* I'm just gonna have to re-format aren't I?

__________________
[IMG]file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/moz-screenshot-2.jpg[/IMG]

Did you try removing them in safe mode? To enter safe mode, hold F8 at boot up.

__________________

if you didn't....turn off system restore before you scan or try to remove them. Sometimes they lurk in there and reapply themselves cause you only took out the branches and not the roots.

Worth a try.


Also...look up the file names that you find in your HJT log and see if anyone else has had an issue with them. They might have found an easy way to remove them and you just havent tried it yet.

__________________
[SIGPIC]http://img81.imageshack.us/img81/6458/signaturexr5.png[/SIGPIC]

One other thing you could try is SmitFraudFix: SmitFraudFix

I had a work pc with the same problems that you're talking about, and this is what fixed it.

__________________
::XSGfX::
::My dA::