A Friend Needs Help

Got rid of snapple... which is good... that google thing is still there though

Maybe something will show in the Silent Runners log.

Like I said, I'm really sorry about the delay, it seems I only get a reply from him in the early hours

I think he's logged off now so I doubt we are going to get this log same time tomorrow.

Thankyou for your patience with this, I will edit the logfile in (below the HJT one) when I receive it and bump the thread.

You can show me how silent runners works too

No problem.... got some more instructions for you to pass on though.

Have him fire up regedit again and go to the
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Key.

Look for and delete any/all of the following entries if found:

".Prog"="%Windir%\system\services.exe"
"BuildLab"= "%Windir%\system\services.exe"
"ccApps"="%Windir%\system\services.exe"
"FriendlyTypeName"="%Windir%\system\services.exe"
"Microsoft Visual SourceSafe"="%Windir%\system\services.exe"
"RegDone"="%Windir%\system\services.exe"
"TEXTCONV"="%Windir%\system\services.exe"
"WMAudio"="%Windir%\system\services.exe"

Run and scan with HijackThis. With all other browsers and windows closed, place a check besdie the following and Fix:

O4 - HKLM\..\Run: [MsCom32Agent] C:\WINDOWS\System32\google.exe
O4 - HKLM\..\RunOnce: [*MsCom32Agent] C:\WINDOWS\System32\google.exe
O4 - HKCU\..\Run: [MsCom32Agent] C:\WINDOWS\System32\google.exe
O4 - HKCU\..\RunOnce: [*MsCom32Agent] C:\WINDOWS\System32\google.exe

Boot to Safe Mode. Search for and delete google.exe

Clean temp files, Recycle Bin, etc...

Reboot Windows normally and post a new log along with the Silent Runners log.

Thanks :

He's currently online and said that he cannot download the silent runners file, it just takes him to that script page that I attempted to post I regave him the link to double check (tested it myself too) and he's assured me that all he gets when clicking on it is the script??

*Bangs head against the wall*

I will post that fix for him to try though

Have him copy/paste the contents of that link into a new text document.

Name it "SilentRunners.vbs". Save it as File Type "All Files".

He should then be able to run the script.

He hasn't got back to me since, I can only presume this topic is now dead

OK rayzer... let us know if there is a change in the situation.