[evilfantasy]

There is an entry that came back located in

C:\Program Files\Common Files\Dllhost.exe

This process is not running from the System32 folder as it is supposed to be so it is probably malicious.

You can go to www.virustotal.com and scan the file there to see what it is.

Follow the removal process for Combofix then re-boot to safe mode and run Nod32.

You can post a new HijackThis log after running Nod to be sure everything was removed.

=========

Go to Start > Run and copy and paste next command in the field:

ComboFix /u



Make sure there's a space between Combofix and /
Then hit Enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

[Ancodi]

'tis gone! Thank you! What we did was find the file that you gave us, unlocked the folder using unlocker and deleted the file. I'm uninstalling Combofix as we speak! Thank you soooo much! Is there any way I can re-pay you?

[evilfantasy]

Good deal

I would still run the antivirus in safe mode when you have the time to.

Killing malware is payment enough, but if you want to donate a few bucks to the forums we are not against that.

Have a look at this post Keeping Yourself Safe On The Web for loads of free tools and information to prevent virus and malware.

If anything comes back, just let us know.

Safe surfing.......

[evilfantasy]

PS, almost forgot. Go to add/remove programs and check your Java, the entry in Combofix showed an out of date version. The current version is Java 6 Update 3
Remove any other version found and go to www.java.com to get the new one. Outdated Java is an entry point for malware.

EF