Got a laptop in that was highly infected.
After removal of many tool bars and programs. I think i have most everything cleaned.
Malwaybytes comes up clean
Spybot comes up clean
Ran TdssKiller found zero
Gmer finds nothing from the rootkit scan.
I couldn't get into the Windows fireall.
Last ditch before reinstall, was combo fix. I ran that, It found the infections and deleted them.
Firewall is back. No browser redirects or popups. (Combo fix didn't save the log to my flash drive..)
The hijackthis log is what concerns me.
There are many entires that I remove and they come right back.
Here's the sample of the enties.
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nwprovau.dll' missing
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
There are a bunch of the 023 entries all with different file names.
So far the computer seems to run just fine.