after you have looked at thousands of logs you get a sixth sense.

but probably the unknown 020 entry

Rerun HJT,and put a checkmark beside these :-

O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O20 - Winlogon Notify: ntfat8 - C:\WINDOWS\SYSTEM32\ntfat8.dll
O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\jt8807lue.dll (file missing)
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\CWShredder.exe (file missing)

now close all windows and browsers and click FIX CHECKED

Then boot up in SAFE MODE

Then navigate to and delete these files\folders in BOLD

C:\WINDOWS\SYSTEM32\ntfat8.dll
C:\Program Files\winupdates<----folder

then reboot and post a fresh Hijackthis log.

Webuser.co.uk

Web User Alerts

Web User Network

Site Policies

Magazine Subscription

Contacts

Search