Solved problem deleting registry keys

Great! Was that using the Kaspersky VRT or the online scanner? Would likely be useful for others in the future if you could provide a bit more detail about the procedure ......... it's a common problem for us all since the online scan report no longer identifies which email is infected.


Lets clean up our tools now. Click Start>Run and type or paste the following command then hit enter to uninstall gmer.

%systemroot%\gmer_uninstall.cmd

Restart the computer to complete the uninstallation of gmer.


Open MBAM and remove any items quarantined. Do the same with your resident antivirus (is the McAfee installation still active and up-to-date?).

Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.

You can delete any other logs that were created/saved too.
Empty the recycle bin when done.

Uninstall all old Java components via Add/Remove Programs then install the latest JRE 6 Update 12 from here

 

I used Kaspersky online scanner to find the infected email(s) ... which were stored in outlook express folders (C:\documents and settings\username\local settings\application data\identities\{*-*-*-*}\microsoft\outlook express\*.dbx) ... I had thousands of emails in some folders so I used a "20 questions" method of halfing the emails and dropping into a "test" outlook folder (and dragging that test.dbx folder into a "test" windows explorer folder that was used to point-to/and speed up Kaspersky scans to just that file) ... the infected half of the emails were pared down to a small number of suspicious emails after a half dozen iterations ... which were manually deleted

thanks for all the help ... gmer and combofix removal complete

 

Thanks for the explanation.

Glad I could help ... you're most welcome. Geri has posted some very helpful information and recommendations regarding future protection in the following link.

http://www.windowsbbs.com/showthread.php?t=67958

Surf safe!

 

sorry, ... that was halving not "halfing "